> This page is for API. > For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.eon.io/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.eon.io/_mcp/server. # Connect Restore AWS Organizational Unit POST https://%7Baccount-domain%7D.console.eon.io/api/v1/projects/{projectId}/restore-aws-organizational-units Content-Type: application/json Connects an AWS organizational unit to the given project as a restore destination. All current and future descendant AWS accounts within the organizational unit are discovered and available as restore accounts. Reference: https://docs.eon.io/api/api-reference/restore-connections/restore-aws-ous/connect-restore-aws-organizational-unit ## Authentication - `Authorization` header (bearer token, required) — Bearer authentication of the form `Bearer `, where token is your auth token. ## Request ### Path parameters - `projectId` (string, required) — ID of the project you want to connect the AWS organizational unit to. You can get your project ID from the [API Credentials](https://console.eon.io/global-management/api-credentials) page in your global management console. ### Headers - `X-Action-Approval-Request-Id` (string, optional) — ID of an approved action request. Applicable only when the method is protected by an action approval policy and the action request has been approved.  When used, the current API request must match the original request parameters. The approved action request can be executed only by the original requester. ### Body (application/json) This endpoint expects a ConnectRestoreAwsOrganizationalUnitRequest. - `roleArn` (string, required) — ARN of the role Eon assumes to access the organizational unit in AWS. - `providerOrganizationalUnitId` (string, required) — AWS-assigned organizational unit ID. ## Response ### 200 AWS organizational unit connected. - `organizationalUnit` (RestoreAwsOrganizationalUnit, required) — The connected AWS organizational unit. ### 201 Applicable only when the method is protected by an [action approval policy]. An action request was created in an initial state. The action request needs to be submitted for approval by passing its ID to [Submit Action Approval Request](https://docs.eon.io/api/api-reference/access-management/action-approvals/my-action-requests/create-action-approval-request). [action approval policy]: /api/using-the-api/action-approvals - `actionApprovalRequest` (MPARequest, required) — Action request details. ## Errors ### 409 Conflict Error AWS organizational unit already exists in Eon. - `any` ## Types ### RestoreAwsOrganizationalUnit - `id` (string, required) — Eon-assigned organizational unit ID. - `roleArn` (string, required) — ARN of the role Eon assumes to access the organizational unit in AWS. - `name` (string, required) — Organizational unit display name in Eon. - `providerOrganizationalUnitId` (string, required) — AWS-assigned organizational unit ID. - `providerManagementAccountId` (string, required) — AWS-assigned ID of the organization's management account. - `status` (enum, required) — Connection status of the organizational unit. Only `CONNECTED` organizational units have their accounts available as restore destinations. - Allowed values: `CONNECTED`, `DISCONNECTED`, `INSUFFICIENT_PERMISSIONS`, `ACCOUNT_STATUS_UNSPECIFIED` ### MPARequest Action request details. - `id` (string, required) — ID of the action request. - `operation` (enum, required) — Operation that requires action approval before it can be completed. - Allowed values: `MPA_OPERATION_TYPE_UNSPECIFIED`, `MPA_OPERATION_ADD_RESTORE_ACCOUNT`, `MPA_OPERATION_RESTORE_RESOURCE`, `MPA_OPERATION_UPDATE_BACKUP_POLICY`, `MPA_OPERATION_DELETE_BACKUP_POLICY`, `MPA_OPERATION_CREATE_BACKUP_POLICY` - `requesterEmail` (string, required) — Email address of the requester. - `status` (enum, required) — Action request status. For an explanation of statuses, see [Action Request Statuses](/data-protection/account-administration/access-management/action-approvals/action-request-statuses). - Allowed values: `MPA_REQUEST_STATUS_UNSPECIFIED`, `CREATED`, `PENDING_APPROVAL`, `APPROVED`, `DENIED`, `EXPIRED_PENDING_APPROVAL`, `EXPIRED_APPROVED`, `EXECUTED`, `CANCELED_PENDING_APPROVAL`, `CANCELED_APPROVED`, `DISCARDED` - `policyDetails` (list of MPARequestPolicyDetail, required) — List of the action request's approval rules. Each item contains the rule's configuration and approval progress. - `createdTime` (datetime, required) — Time when the approval request was created. - `requesterName` (string, optional) — Display name of the requester at the time the request was created. - `comment` (string, optional) — Comment from the requester explaining why they want to perform the action. - `approvalExpirationTime` (datetime, optional, nullable) — Deadline for gathering approvals. Omitted before the request is submitted or after it's discarded. - `executionExpirationTime` (datetime, optional, nullable) — Deadline for completing the approved action. Set when the request is approved. - `resolvedTime` (datetime, optional, nullable) — Time when the request reached a terminal state, such as executed, expired, canceled, denied, or discarded. Omitted while the request is still active. ### MPARequestPolicyDetail - `requiredApprovals` (integer, required) — Count of approvals the rule requires. - `currentApprovals` (integer, required) — Count of qualifying approvals received. - `executionWindowHours` (integer, required) — After all required approvals are received, number of hours the requester has to complete the action. - `approvalWindowHours` (integer, required) — After submitting the action request, number of hours allowed for gathering all required approvals. - `description` (string, optional) — Rule description. - `approverIdpId` (string, optional, nullable) — Eon-assigned ID of the SAML identity provider the approver group belongs to. Used in combination with `approverProviderGroupId`. - `approverProviderGroupId` (string, optional, nullable) — Identity-provider-assigned ID of the group. Used in combination with `approverIdpId`. ## Examples ### Example 1 **Request** ```json { "roleArn": "arn:aws:iam::123412341234:role/EonRestoreAccountRole", "providerOrganizationalUnitId": "ou-a1b2-f6g7h111" } ``` **Response** ```json { "organizationalUnit": { "id": "fc495499-9796-5fc9-ade7-1ba924cbcc42", "roleArn": "arn:aws:iam::123412341234:role/EonRestoreAccountRole", "name": "dr-eu organizational unit", "providerOrganizationalUnitId": "ou-a1b2-f6g7h111", "providerManagementAccountId": "123456789012", "status": "CONNECTED" } } ``` **SDK Code** ```python import requests url = "https://{account-domain}.console.eon.io/api/v1/projects/cc4fe8ee-0c62-56f2-9fda-f27bc7753e55/restore-aws-organizational-units" payload = { "roleArn": "arn:aws:iam::123412341234:role/EonRestoreAccountRole", "providerOrganizationalUnitId": "ou-a1b2-f6g7h111" } headers = { "Authorization": "Bearer ", "Content-Type": "application/json" } response = requests.post(url, json=payload, headers=headers) print(response.json()) ``` ```javascript const url = 'https://{account-domain}.console.eon.io/api/v1/projects/cc4fe8ee-0c62-56f2-9fda-f27bc7753e55/restore-aws-organizational-units'; const options = { method: 'POST', headers: {Authorization: 'Bearer ', 'Content-Type': 'application/json'}, body: '{"roleArn":"arn:aws:iam::123412341234:role/EonRestoreAccountRole","providerOrganizationalUnitId":"ou-a1b2-f6g7h111"}' }; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ```java import com.mashape.unirest.http.HttpResponse; import com.mashape.unirest.http.Unirest; HttpResponse response = Unirest.post("https://{account-domain}.console.eon.io/api/v1/projects/cc4fe8ee-0c62-56f2-9fda-f27bc7753e55/restore-aws-organizational-units") .header("Authorization", "Bearer ") .header("Content-Type", "application/json") .body("{\n \"roleArn\": \"arn:aws:iam::123412341234:role/EonRestoreAccountRole\",\n \"providerOrganizationalUnitId\": \"ou-a1b2-f6g7h111\"\n}") .asString(); ``` ### Example 2 **Request** ```json { "roleArn": "arn:aws:iam::123412341234:role/EonRestoreAccountRole", "providerOrganizationalUnitId": "ou-a1b2-f6g7h111" } ``` **Response** ```json { "actionApprovalRequest": { "approvalExpirationTime": "2026-05-05T03:00:05Z", "comment": "Removing a backup policy that has been replaced.", "createdTime": "2026-05-04T23:00:05Z", "executionExpirationTime": "2026-05-05T07:00:05Z", "id": "018f3b3f-4818-7c31-a0d7-2e02f2f83a10", "operation": "MPA_OPERATION_DELETE_BACKUP_POLICY", "policyDetails": [ { "approvalWindowHours": 24, "approverIdpId": "018f3b3f-4818-7c31-a0d7-2e02f2f83a31", "approverProviderGroupId": "platform-admins", "currentApprovals": 1, "description": "Require approval before deleting backup policies.", "executionWindowHours": 4, "requiredApprovals": 2 } ], "requesterEmail": "requester@example.com", "requesterName": "Riley Chen", "resolvedTime": "2026-05-05T02:10:12Z", "status": "PENDING_APPROVAL" } } ``` **SDK Code** ```python import requests url = "https://{account-domain}.console.eon.io/api/v1/projects/cc4fe8ee-0c62-56f2-9fda-f27bc7753e55/restore-aws-organizational-units" payload = { "roleArn": "arn:aws:iam::123412341234:role/EonRestoreAccountRole", "providerOrganizationalUnitId": "ou-a1b2-f6g7h111" } headers = { "Authorization": "Bearer ", "Content-Type": "application/json" } response = requests.post(url, json=payload, headers=headers) print(response.json()) ``` ```javascript const url = 'https://{account-domain}.console.eon.io/api/v1/projects/cc4fe8ee-0c62-56f2-9fda-f27bc7753e55/restore-aws-organizational-units'; const options = { method: 'POST', headers: {Authorization: 'Bearer ', 'Content-Type': 'application/json'}, body: '{"roleArn":"arn:aws:iam::123412341234:role/EonRestoreAccountRole","providerOrganizationalUnitId":"ou-a1b2-f6g7h111"}' }; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ```java import com.mashape.unirest.http.HttpResponse; import com.mashape.unirest.http.Unirest; HttpResponse response = Unirest.post("https://{account-domain}.console.eon.io/api/v1/projects/cc4fe8ee-0c62-56f2-9fda-f27bc7753e55/restore-aws-organizational-units") .header("Authorization", "Bearer ") .header("Content-Type", "application/json") .body("{\n \"roleArn\": \"arn:aws:iam::123412341234:role/EonRestoreAccountRole\",\n \"providerOrganizationalUnitId\": \"ou-a1b2-f6g7h111\"\n}") .asString(); ```