Transcription
Image Management ServiceAPI ReferenceDate2021-06-30
Image Management ServiceAPI ReferenceContentsContents1 Before You Start. 11.1 Overview. 11.2 API Calling.11.3 Endpoints.11.4 Constraints. 11.5 Concepts. 21.6 Selecting an API Type.32 API Overview. 43 Calling APIs. 53.1 Making an API Request. 53.2 Authentication. 93.3 Response. 114 Getting Started. 135 IMS APIs. 155.1 Image. 155.1.1 Querying Images. 155.1.2 Updating Image Information. 295.1.3 Creating an Image.385.1.4 Importing an Image File Quickly. 505.1.5 Creating a Data Disk Image Using an External Image File. 565.1.6 Creating a Full-ECS Image.595.1.7 Registering an Image. 645.1.8 Exporting an Image. 665.1.9 Querying Supported Image OSs.685.2 Image Sharing. 715.2.1 Deleting Image Members in Batches. 715.2.2 Adding Image Members in Batches. 725.2.3 Updating the Status of Image Members in Batches. 745.3 Image Replication. 765.3.1 Replicating an Image Within a Region. 765.3.2 Replicating an Image Across Regions.785.4 Image Quota. 812021-06-30ii
Image Management ServiceAPI ReferenceContents5.4.1 Querying the Image Quota. 815.5 Image Jobs.835.5.1 Asynchronous Job Query.836 Native OpenStack APIs. 866.1 Image (Native OpenStack APIs). 866.1.1 Querying Images (Native OpenStack API). 866.1.2 Querying Image Details (Native OpenStack API).1026.1.3 Updating Image Information (Native OpenStack API).1106.1.4 Uploading an Image (Native OpenStack API). 1206.1.5 Deleting an Image (Native OpenStack API). 1226.1.6 Creating Image Metadata (Native OpenStack API).1246.1.7 Deleting an Image (Native OpenStack API v1.1 - Abandoned and Not Recommended). 1316.1.8 Querying Image Metadata (Native OpenStack API v1 - Abandoned and Not Recommended).1326.1.9 Querying Image Details (Native OpenStack API v1.1 - Abandoned and Not Recommended). 1356.2 Image Schema (Native OpenStack APIs). 1376.2.1 Querying an Image Schema (Native OpenStack API). 1376.2.2 Querying an Image List Schema (Native OpenStack API). 1426.2.3 Querying an Image Member Schema (Native OpenStack API). 1476.2.4 Querying an Image Member List Schema (Native OpenStack API). 1486.3 Image Sharing (Native OpenStack APIs). 1506.3.1 Adding an Image Member (Native OpenStack API). 1506.3.2 Updating the Image Sharing Status in Batches (Native OpenStack API). 1526.3.3 Querying Image Member Details (Native OpenStack API).1546.3.4 Querying Image Members (Native OpenStack API).1566.3.5 Deleting an Image Member (Native OpenStack API).1586.4 API Version Query (Native OpenStack API). 1596.4.1 Querying API Versions (Native OpenStack API).1596.4.2 Querying an API Version (Native OpenStack API). 1617 Examples. 1647.1 Creating an Image from an ISO File. 1648 Permission Policies and Supported Actions. 1678.1 Introduction. 1678.2 Image Management. 1688.3 Image Schema. 1728.4 Image Sharing. 1738.5 Image Replication.1748.6 Image Quota. 1759 Common Parameters.1769.1 Image Attributes. 1769.2 Image Tag Data Formats. 1809.3 Restrictions on Image Sharing. 1812021-06-30iii
Image Management ServiceAPI ReferenceContents9.4 Obtaining a Project ID. 1819.5 Values of Related Parameters. 183A Status Codes. 191B Error Codes. 193C Change History. 2122021-06-30iv
Image Management ServiceAPI Reference1 Before You Start1Before You Start1.1 OverviewWelcome to Image Management Service API Reference. An image is a templateused to create a server or disk. Image Management Service (IMS) provides imagelifecycle management. You can use a server or an external image file to create asystem or data disk image, or use an Elastic Cloud Server (ECS) or Cloud Backupand Recovery (CBR) backup to create a full-ECS image.This document describes how to use application programming interfaces (APIs) toperform operations on images, such as creating, querying, deleting and updatingimages. For details about all supported operations, see API Overview.If you plan to access IMS through an API, ensure that you are familiar with IMSconcepts. For details, see section "Overview" in Image Management Service UserGuide.1.2 API CallingIMS supports Representational State Transfer (REST) APIs, allowing you to callAPIs using HTTPS. For details about API calling, see Calling APIs.1.3 EndpointsAn endpoint is the request address for calling an API. Endpoints vary dependingon services and regions. For the endpoints of all services, see Regions andEndpoints.1.4 Constraints2021-06-30 The number of images that you can create is determined by your quota. Toview or increase the quota, see section "How Do I Increase the Image Quota?"in Image Management Service User Guide. For more constraints, see API description.1
Image Management ServiceAPI Reference1 Before You Start1.5 Concepts AccountAn account is created upon successful registration. The account has full accesspermissions for all of its cloud services and resources. It can be used to resetuser passwords and grant user permissions. The account is a payment entity,which should not be used directly to perform routine management. Forsecurity purposes, create Identity and Access Management (IAM) users andgrant them permissions for routine management. UserAn IAM user is created by an account in IAM to use cloud services. Each IAMuser has its own identity credentials (password and access keys).API authentication requires information such as the account name, username,and password. RegionA region is a geographic area in which cloud resources are deployed.Availability zones (AZs) in the same region can communicate with each otherover an intranet, while AZs in different regions are isolated from each other.Deploying cloud resources in different regions can better suit certain userrequirements or comply with local laws or regulations. AZAn AZ comprises of one or more physical data centers equipped withindependent ventilation, fire, water, and electricity facilities. Computing,network, storage, and other resources in an AZ are logically divided intomultiple clusters. AZs within a region are interconnected using high-speedoptical fibers to allow you to build cross-AZ high-availability systems. ProjectA project corresponds to a region. Default projects are defined to group andphysically isolate resources (including computing, storage, and networkresources) across regions. Users can be granted permissions in a defaultproject to access all resources under their accounts in the region associatedwith the project. If you need more refined access control, create subprojectsunder a default project and create resources in subprojects. Then you canassign users the permissions required to access only the resources in thespecific subprojects.Figure 1-1 Project isolation model2021-06-302
Image Management ServiceAPI Reference1 Before You Start1.6 Selecting an API TypeThe following APIs have been abandoned and are not recommended:2021-06-30 Deleting an Image (Native OpenStack API v1.1 - Abandoned and NotRecommended) Querying Image Metadata (Native OpenStack API v1 - Abandoned andNot Recommended) Querying Image Details (Native OpenStack API v1.1 - Abandoned andNot Recommended)3
Image Management ServiceAPI Reference2 API Overview2API OverviewIMS APIs include native OpenStack APIs and extension APIs.A combination of the two types of APIs allows you to use all functions provided byIMS. For example, you can use either native OpenStack APIs or extension APIs tocreate private images.Table 2-1 API descriptionTypeSubtypeDescriptionIMS APIsImageCreate, query, and export images.ImagesharingShare private images with other tenants.ImagereplicationReplicate an existing image as another one. Whenreplicating an image, you can change the imageattributes to meet the requirements of differentscenarios.Image quotaQuery the number of private images in the currentregion.Image jobsQuery the execution status of an asynchronousjob.ImageCreate, query, and export images.ImageschemaAn image schema is used to display details of animages or image entity, such as the entity'sattributes and their data types. With an imageschema, you can understand basic informationabout an image.ImagesharingShare private images with other tenants.NativeOpenStackAPI2021-06-304
Image Management ServiceAPI Reference3 Calling APIs3Calling APIs3.1 Making an API RequestThis section describes the structure of a REST API request, and uses the IAM APIfor obtaining a user token as an example to demonstrate how to call an API. Theobtained token can then be used to authenticate the calling of other APIs.Request URIA request URI is in the following query-string}Although a request URI is included in the request header, most programminglanguages or frameworks require the request URI to be transmitted separately.Table 3-1 URI parameter descriptionParameterDescriptionURI-schemeProtocol used to transmit requests. All APIs use HTTPS.EndpointDomain name or IP address of the server bearing the RESTservice. The endpoint varies between services in differentregions. It can be obtained from Regions and Endpoints.For example, the endpoint of IAM in the ae-ad-1 region Access path of an API for performing a specified operation.Obtain the path from the URI of an API. For example, theresource-path of the API used to obtain a user token is /v3/auth/tokens.5
Image Management ServiceAPI Reference3 Calling APIsParameterDescriptionquery-stringQuery parameter, which is optional. Ensure that a questionmark (?) is included before each query parameter that is in theformat of Parameter name Parameter value. For example, ?limit 10 indicates that a maximum of 10 data records will bedisplayed.For example, to obtain an IAM token in the ae-ad-1 region, obtain the endpoint ofIAM (iam.ae-ad-1.g42cloud.com) for this region and the resource-path (/v3/auth/tokens) in the URI of the API used to obtain a user token. Then, constructthe URI as okensFigure 3-1 Example URINOTETo simplify the URI display in this document, each API is provided only with a resourcepath and a request method. The URI-scheme of all APIs is HTTPS, and the endpoints of allAPIs in the same region are identical.Request MethodsThe HTTP protocol defines the following request methods that can be used tosend a request to the server.Table 3-2 HTTP methods2021-06-30MethodDescriptionGETRequests the server to return specified resources.PUTRequests the server to update specified resources.POSTRequests the server to add resources or perform specialoperations.DELETERequests the server to delete specified resources, forexample, an object.HEADSame as GET except that the server must return onlythe response header.6
Image Management ServiceAPI Reference3 Calling APIsMethodDescriptionPATCHRequests the server to update partial content of aspecified resource.If the resource does not exist, a new resource will becreated.For example, in the case of the API used to obtain a user token, the requestmethod is POST. The request is as follows:POST uest HeaderYou can also add additional header fields to a request, such as the fields requiredby a specified URI or HTTP method. For example, to request for the authenticationinformation, add Content-Type, which specifies the request body type.Common request header fields are as follows.Table 3-3 Common request header le ValueHostSpecifies the serverdomain name and portnumber of the resourcesbeing requested. Thevalue can be obtainedfrom the URL of theservice API. The value isin the format ofHostname:Port number.If the port number is notspecified, the defaultport is used. The defaultport number for https is443.Nocode.test.comThis field ismandatory forAK/SKauthentication.orContent-TypeSpecifies the type (orformat) of the messagebody. The default valueapplication/json isrecommended. Othervalues of this field will beprovided for specific APIsif any.Yesapplication/jsonContentLengthSpecifies the length ofthe request body. Theunit is byte.No3495code.test.com:4437
Image Management ServiceAPI Reference3 Calling APIsParameterDescriptionMandatoryExample ValueX-Project-IdSpecifies the project ID.Obtain the project ID byfollowing the instructionsin Obtaining a -TokenSpecifies the user token.NoIt is a response to the APIfor obtaining a usertoken (This is the onlyAPI that does not requireauthentication).This field ismandatory fortokenauthentication.The following ispart of anexample r the request isprocessed, the value ofX-Subject-Token in theresponse header is thetoken value.NOTEIn addition to supporting authentication using tokens, APIs support authentication usingAK/SK, which uses SDKs to sign a request. During the signature, the Authorization(signature authentication) and X-Sdk-Date (time when a request is sent) headers areautomatically added in the request.For more details, see "Authentication Using AK/SK" in Authentication.The API used to obtain a user token does not require authentication. Therefore,only the Content-Type field needs to be added to requests for calling the API. Anexample of such requests is as follows:POST tent-Type: application/json(Optional) Request BodyThis part is optional. The body of a request is often sent in a structured format asspecified in the Content-Type header field. The request body transfers contentexcept the request header.The request body varies between APIs. Some APIs do not require the request body,such as the APIs requested using the GET and DELETE methods.In the case of the API used to obtain a user token, the request parameters andparameter description can be obtained from the API request. The followingprovides an example request with a body included. Replace username,domainname, ******** (login password), and xxxxxxxxxxxxxxxxxx (project name)with the actual values. Obtain a project name from Regions and Endpoints.2021-06-308
Image Management ServiceAPI Reference3 Calling APIsNOTEThe scope parameter specifies where a token takes effect. You can set scope to an accountor a project under an account. In the following example, the token takes effect only for theresources in a specified project. For more information about this API, see Obtaining a UserToken.POST tent-Type: application/json{}"auth": {"identity": {"methods": ["password"],"password": {"user": {"name": "username","password": "********","domain": {"name": "domainname"}}}},"scope": {"project": {"name": "xxxxxxxxxxxxxxxxxx"}}}If all data required for the API request is available, you can send the request to callthe API through curl, Postman, or coding. In the response to the API used toobtain a user token, x-subject-token is the desired user token. This token canthen be used to authenticate the calling of other APIs.3.2 AuthenticationRequests for calling an API can be authenticated using either of the followingmethods: Token authentication: Requests are authenticated using tokens. AK/SK authentication: Requests are encrypted using AK/SK pairs. AK/SKauthentication is recommended because it is more secure than tokenauthentication.Token AuthenticationNOTEThe validity period of a token is 24 hours. When using a token for authentication, cache itto prevent frequently calling the IAM API used to obtain a user token.A token specifies temporary permissions in a computer system. During APIauthentication using a token, the token is added to requests to get permissions forcalling the API. You can obtain a token by calling the Obtaining User Token API.A cloud service can be deployed as either a project-level service or global service.2021-06-309
Image Management ServiceAPI Reference3 Calling APIs For a project-level service, you need to obtain a project-level token. When youcall the API, set auth.scope in the request body to project. For a global service, you need to obtain a global token. When you call theAPI, set auth.scope in the request body to domain.IMS is a project-level service. When you call the API, set auth.scope in the requestbody to project.{}"auth": {"identity": {"methods": ["password"],"password": {"user": {"name": "username","password": "********","domain": {"name": "domainname"}}}},"scope": {"project": {"name": "xxxxxxxx"}}}After a token is obtained, the X-Auth-Token header field must be added torequests to specify the token when calling other APIs. For example, if the token isABCDEFJ., X-Auth-Token: ABCDEFJ. can be added to a request as follows:POST ontent-Type: application/jsonX-Auth-Token: ABCDEFJ.AK/SK AuthenticationNOTEAK/SK authentication supports API requests with a body not larger than 12 MB. For APIrequests with a larger body, token authentication is recommended.In AK/SK authentication, AK/SK is used to sign requests and the signature is thenadded to the requests for authentication. AK: access key ID, which is a unique identifier used in conjunction with asecret access key to sign requests cryptographically. SK: secret access key, which is used in conjunction with an AK to sign requestscryptographically. It identifies a request sender and prevents the request frombeing modified.In AK/SK authentication, you can use an AK/SK to sign requests based on thesignature algorithm or using the signing SDK. For details about how to signrequests and use the signing SDK, see API Request Signing Guide.2021-06-3010
Image Management ServiceAPI Reference3 Calling APIsNOTEThe signing SDK is only used for signing requests and is different from the SDKs providedby services.3.3 ResponseStatus CodeAfter sending a request, you will receive a response, including a status code,response header, and response body.A status code is a group of digits, ranging from 1xx to 5xx. It indicates the statusof a request. For more information, see Status Codes.For example, if status code 201 is returned for calling the API used to obtain auser token, the request is successful.Response HeaderSimilar to a request, a response also has a header, for example, Content-Type.Figure 3-2 shows the response header fields for the API used to obtain a usertoken. The x-subject-token header field is the desired user token. This token canthen be used to authenticate the calling of other APIs.Figure 3-2 Header fields of the response to the request for obtaining a user token(Optional) Response BodyThe body of a response is often returned in structured format as specified in theContent-Type header field. The response body transfers content except theresponse header.2021-06-3011
Image Management ServiceAPI Reference3 Calling APIsThe following is part of the response body for the API used to obtain a usertoken.{"token": {"expires at": "2019-02-13T06:52:13.855000Z","methods": ["password"],"catalog": [{"endpoints": [{"region id": "az-01",.If an error occurs during API calling, an error code and a message will bedisplayed. The following shows an error response body.{}"error msg": "The format of message is error","error code": "AS.0001"In the response body, error code is an error code, and error msg providesinformation about the error.2021-06-3012
Image Management ServiceAPI Reference4 Getting Started4Getting StartedThis section describes how to make API calls to create a private image from anECS.For details about how to call APIs, see Calling APIs.NOTE Before using an ECS to create a private image, ensure that the ECS is stopped. The token obtained from IAM is valid for only 24 hours. If you want to use a token forauthentication, you can cache it to avoid frequently calling the IAM API.Involved APIsIf you use a token for authentication, you must obtain the token and add X-AuthToken to the request header of the IMS API when making an API call. IAM API used to obtain the token IMS API used to create a private image1.Obtain the token by referring to Authentication.2.Send POST https://IMS endpoint/v2/cloudimages/action.3.Add X-Auth-Token to the request header.4.Specify the following parameters in the request body:Procedure{}"name": "ims test", //Image name (a mandatory string)"description": "Image creation from an ECS", //Image descr
Deleting an Image (Native OpenStack API v1.1 - Abandoned and Not Recommended) Querying Image Metadata (Native OpenStack API v1 - Abandoned and Not Recommended) Querying Image Details (Native OpenStack API v1.1 - Abandoned and Not Recommended) Image Management Service API Reference 1 Before You Start 2021-06-30 3
