{
  "version": "1.0",
  "examples": {
    "CreateDeployment": [
      {
        "input": {
          "associatedPolicyList": [
            {
              "policyIdentifier": "arn:aws:network-security-manager:us-east-1:123456789012:policy:xyz789"
            }
          ],
          "associatedScopeList": [
            {
              "scopeIdentifier": "arn:aws:network-security-manager:us-east-1:123456789012:scope:abc123"
            }
          ],
          "clientToken": "550e8400-e29b-41d4-a716-446655440003",
          "deploymentConfiguration": {
            "enableCrossAccountVisibility": false
          },
          "deploymentDescription": "Production deployment for US East 1 region",
          "deploymentName": "prod-us-east-1-deployment",
          "isPublished": false
        },
        "output": {
          "version": "1",
          "associatedPolicyList": [
            {
              "policyArn": "arn:aws:network-security-manager:us-east-1:123456789012:policy:xyz789"
            }
          ],
          "associatedScopeList": [
            {
              "scopeArn": "arn:aws:network-security-manager:us-east-1:123456789012:scope:abc123"
            }
          ],
          "deploymentArn": "arn:aws:network-security-manager:us-east-1:123456789012:deployment:def456",
          "deploymentConfiguration": {
            "enableCrossAccountVisibility": false
          },
          "deploymentDescription": "Production deployment for US East 1 region",
          "deploymentId": "def456",
          "deploymentName": "prod-us-east-1-deployment",
          "hasPublishedVersion": false,
          "isSnapshot": false,
          "status": "DRAFT",
          "updateToken": "f4a5b6c7-7d8e-4f9a-8b1c-1d2e3f4a5b6c"
        },
        "description": "Creates a new deployment in draft state.",
        "id": "example-1",
        "title": "Create a deployment"
      }
    ],
    "CreateDeploymentSnapshot": [
      {
        "input": {
          "clientToken": "550e8400-e29b-41d4-a716-446655440014",
          "deploymentIdentifier": "arn:aws:network-security-manager:us-east-1:123456789012:deployment:def456"
        },
        "output": {
          "version": "2",
          "associatedPolicyList": [
            {
              "policyArn": "arn:aws:network-security-manager:us-east-1:123456789012:policy:xyz789"
            }
          ],
          "associatedScopeList": [
            {
              "scopeArn": "arn:aws:network-security-manager:us-east-1:123456789012:scope:abc123"
            }
          ],
          "deploymentArn": "arn:aws:network-security-manager:us-east-1:123456789012:deployment:def456:2",
          "deploymentConfiguration": {
            "enableCrossAccountVisibility": true
          },
          "deploymentId": "def456",
          "deploymentName": "prod-us-east-1-deployment",
          "isSnapshot": true,
          "status": "ACTIVE",
          "updatedAt": "2026-08-20T12:00:00Z"
        },
        "description": "Creates an immutable snapshot of the current published version of a deployment. The snapshot is addressable by a version-qualified ARN.",
        "id": "example-1",
        "title": "Create a deployment snapshot"
      }
    ],
    "CreatePolicy": [
      {
        "input": {
          "associatedTemplateAndRuleList": [
            {
              "templateIdentifier": "arn:aws:network-security-manager:us-east-1:123456789012:template:xyz789"
            }
          ],
          "clientToken": "550e8400-e29b-41d4-a716-446655440002",
          "firewallType": "WAF",
          "isPublished": false,
          "policyConfiguration": {
            "remediationEnabled": false,
            "resourcesCleanUp": false,
            "wafConfig": {
              "conflictResolution": "MERGE_WHERE_APPLICABLE",
              "existingCustomerWebACLResolution": "NO_REMEDIATION"
            }
          },
          "policyDescription": "WAF policy for web application protection",
          "policyName": "web-app-waf-policy",
          "priority": 1
        },
        "output": {
          "version": "1",
          "associatedTemplateAndRuleList": [
            {
              "templateArn": "arn:aws:network-security-manager:us-east-1:123456789012:template:xyz789"
            }
          ],
          "firewallType": "WAF",
          "hasPublishedVersion": false,
          "isSnapshot": false,
          "policyArn": "arn:aws:network-security-manager:us-east-1:123456789012:policy:xyz789",
          "policyConfiguration": {
            "remediationEnabled": false,
            "resourcesCleanUp": false,
            "wafConfig": {
              "conflictResolution": "MERGE_WHERE_APPLICABLE",
              "existingCustomerWebACLResolution": "NO_REMEDIATION"
            }
          },
          "policyDescription": "WAF policy for web application protection",
          "policyId": "xyz789",
          "policyName": "web-app-waf-policy",
          "priority": 1,
          "status": "DRAFT",
          "updateToken": "e3f4a5b6-6c7d-4e8f-9a0b-0c1d2e3f4a5b"
        },
        "description": "Creates a new WAF policy in draft state with a template association.",
        "id": "example-1",
        "title": "Create a WAF policy"
      }
    ],
    "CreatePolicySnapshot": [
      {
        "input": {
          "clientToken": "550e8400-e29b-41d4-a716-446655440013",
          "policyIdentifier": "arn:aws:network-security-manager:us-east-1:123456789012:policy:xyz789"
        },
        "output": {
          "version": "2",
          "associatedTemplateAndRuleList": [
            {
              "templateArn": "arn:aws:network-security-manager:us-east-1:123456789012:template:xyz789"
            }
          ],
          "firewallType": "WAF",
          "isSnapshot": true,
          "policyArn": "arn:aws:network-security-manager:us-east-1:123456789012:policy:xyz789:2",
          "policyConfiguration": {
            "remediationEnabled": true,
            "resourcesCleanUp": false,
            "wafConfig": {
              "conflictResolution": "MERGE_WHERE_APPLICABLE",
              "existingCustomerWebACLResolution": "NO_REMEDIATION"
            }
          },
          "policyId": "xyz789",
          "policyName": "web-app-waf-policy",
          "priority": 2,
          "status": "ACTIVE",
          "updatedAt": "2026-08-20T12:00:00Z"
        },
        "description": "Creates an immutable snapshot of the current published version of a policy. The snapshot is addressable by a version-qualified ARN.",
        "id": "example-1",
        "title": "Create a policy snapshot"
      }
    ],
    "CreateRule": [
      {
        "input": {
          "clientToken": "550e8400-e29b-41d4-a716-446655440000",
          "configuration": {},
          "firewallType": "WAF",
          "isPublished": false,
          "ruleDescription": "Blocks requests from known malicious IP addresses",
          "ruleName": "block-known-bad-ips",
          "ruleType": "INSPECTION"
        },
        "output": {
          "version": "1",
          "configuration": {},
          "firewallType": "WAF",
          "hasPublishedVersion": false,
          "isSnapshot": false,
          "ruleArn": "arn:aws:network-security-manager:us-east-1:123456789012:rule:abc123",
          "ruleDescription": "Blocks requests from known malicious IP addresses",
          "ruleId": "abc123",
          "ruleName": "block-known-bad-ips",
          "ruleType": "INSPECTION",
          "status": "DRAFT",
          "updateToken": "c1d2e3f4-4a5b-4c6d-9e7f-8a9b0c1d2e3f"
        },
        "description": "Creates a new WAF inspection rule in draft state.",
        "id": "example-1",
        "title": "Create a WAF rule"
      }
    ],
    "CreateRuleSnapshot": [
      {
        "input": {
          "clientToken": "550e8400-e29b-41d4-a716-446655440011",
          "ruleIdentifier": "arn:aws:network-security-manager:us-east-1:123456789012:rule:abc123"
        },
        "output": {
          "version": "2",
          "configuration": {},
          "firewallType": "WAF",
          "isSnapshot": true,
          "ruleArn": "arn:aws:network-security-manager:us-east-1:123456789012:rule:abc123:2",
          "ruleId": "abc123",
          "ruleName": "block-known-bad-ips",
          "ruleType": "INSPECTION",
          "status": "ACTIVE",
          "updatedAt": "2026-08-20T12:00:00Z"
        },
        "description": "Creates an immutable snapshot of the current published version of a rule. The snapshot is addressable by a version-qualified ARN.",
        "id": "example-1",
        "title": "Create a rule snapshot"
      }
    ],
    "CreateScope": [
      {
        "input": {
          "clientToken": "550e8400-e29b-41d4-a716-446655440001",
          "isPublished": true,
          "scopeConfiguration": {
            "accountFilter": {
              "includeAll": {}
            },
            "resourceScopes": {}
          },
          "scopeDescription": "Scope covering all production web application resources",
          "scopeName": "production-web-apps"
        },
        "output": {
          "version": "1",
          "hasPublishedVersion": true,
          "isSnapshot": false,
          "scopeArn": "arn:aws:network-security-manager:us-east-1:123456789012:scope:abc123",
          "scopeConfiguration": {
            "accountFilter": {
              "includeAll": {}
            },
            "resourceScopes": {}
          },
          "scopeDescription": "Scope covering all production web application resources",
          "scopeId": "abc123",
          "scopeName": "production-web-apps",
          "status": "ACTIVE",
          "updateToken": "b0c4d1e2-3f4a-4b5c-8d6e-7f8a9b0c1d2e"
        },
        "description": "Creates a new scope in published (ACTIVE) state.",
        "id": "example-1",
        "title": "Create a scope"
      }
    ],
    "CreateScopeSnapshot": [
      {
        "input": {
          "clientToken": "550e8400-e29b-41d4-a716-446655440010",
          "scopeIdentifier": "arn:aws:network-security-manager:us-east-1:123456789012:scope:abc123"
        },
        "output": {
          "version": "2",
          "isSnapshot": true,
          "scopeArn": "arn:aws:network-security-manager:us-east-1:123456789012:scope:abc123:2",
          "scopeConfiguration": {
            "accountFilter": {
              "includeAll": {}
            },
            "resourceScopes": {}
          },
          "scopeId": "abc123",
          "scopeName": "production-web-apps",
          "status": "ACTIVE",
          "updatedAt": "2026-08-20T12:00:00Z"
        },
        "description": "Creates an immutable snapshot of the current published version of a scope. The snapshot is addressable by a version-qualified ARN.",
        "id": "example-1",
        "title": "Create a scope snapshot"
      }
    ],
    "CreateTemplate": [
      {
        "input": {
          "associatedRuleList": [
            {
              "ruleIdentifier": "arn:aws:network-security-manager:us-east-1:123456789012:rule:abc123"
            }
          ],
          "clientToken": "550e8400-e29b-41d4-a716-446655440004",
          "firewallType": "WAF",
          "isPublished": true,
          "templateDescription": "Standard WAF template with baseline rule groups",
          "templateName": "standard-waf-template"
        },
        "output": {
          "version": "1",
          "associatedRuleList": [
            {
              "ruleArn": "arn:aws:network-security-manager:us-east-1:123456789012:rule:abc123"
            }
          ],
          "firewallType": "WAF",
          "hasPublishedVersion": true,
          "isSnapshot": false,
          "status": "ACTIVE",
          "templateArn": "arn:aws:network-security-manager:us-east-1:123456789012:template:xyz789",
          "templateDescription": "Standard WAF template with baseline rule groups",
          "templateId": "xyz789",
          "templateName": "standard-waf-template",
          "updateToken": "d2e3f4a5-5b6c-4d7e-8f9a-9b0c1d2e3f4a"
        },
        "description": "Creates a new WAF template in published (ACTIVE) state with an associated rule.",
        "id": "example-1",
        "title": "Create a WAF template"
      }
    ],
    "CreateTemplateSnapshot": [
      {
        "input": {
          "clientToken": "550e8400-e29b-41d4-a716-446655440012",
          "templateIdentifier": "arn:aws:network-security-manager:us-east-1:123456789012:template:xyz789"
        },
        "output": {
          "version": "2",
          "associatedRuleList": [
            {
              "ruleArn": "arn:aws:network-security-manager:us-east-1:123456789012:rule:abc123"
            }
          ],
          "firewallType": "WAF",
          "isSnapshot": true,
          "status": "ACTIVE",
          "templateArn": "arn:aws:network-security-manager:us-east-1:123456789012:template:xyz789:2",
          "templateId": "xyz789",
          "templateName": "standard-waf-template",
          "updatedAt": "2026-08-20T12:00:00Z"
        },
        "description": "Creates an immutable snapshot of the current published version of a template. The snapshot is addressable by a version-qualified ARN.",
        "id": "example-1",
        "title": "Create a template snapshot"
      }
    ],
    "DeleteAdminAccount": [
      {
        "input": {
          "accountId": "234567890123"
        },
        "description": "Removes an account's Network Security Manager administrator designation.",
        "id": "example-1",
        "title": "Remove an administrator account"
      }
    ],
    "DeleteDeployment": [
      {
        "input": {
          "deploymentIdentifier": "arn:aws:network-security-manager:us-east-1:123456789012:deployment:def456"
        },
        "description": "Deletes a deployment by its ARN. Deleting an active deployment stops enforcement and triggers cleanup of managed firewall resources.",
        "id": "example-1",
        "title": "Delete a deployment"
      }
    ],
    "DeletePolicy": [
      {
        "input": {
          "policyIdentifier": "arn:aws:network-security-manager:us-east-1:123456789012:policy:xyz789"
        },
        "description": "Deletes a policy by its ARN. The policy must not be associated with any deployment.",
        "id": "example-1",
        "title": "Delete a policy"
      }
    ],
    "DeleteRule": [
      {
        "input": {
          "ruleIdentifier": "arn:aws:network-security-manager:us-east-1:123456789012:rule:abc123"
        },
        "description": "Deletes a rule by its ARN. The rule must not be associated with any template or policy.",
        "id": "example-1",
        "title": "Delete a rule"
      }
    ],
    "DeleteScope": [
      {
        "input": {
          "scopeIdentifier": "arn:aws:network-security-manager:us-east-1:123456789012:scope:abc123"
        },
        "description": "Deletes a scope by its ARN. The scope must not be associated with any deployment.",
        "id": "example-1",
        "title": "Delete a scope"
      }
    ],
    "DeleteTemplate": [
      {
        "input": {
          "templateIdentifier": "arn:aws:network-security-manager:us-east-1:123456789012:template:xyz789"
        },
        "description": "Deletes a template by its ARN. The template must not be associated with any policy.",
        "id": "example-1",
        "title": "Delete a template"
      }
    ],
    "GenerateRuleConfiguration": [
      {
        "input": {
          "clientToken": "550e8400-e29b-41d4-a716-446655440015",
          "prompt": "Create a rate limiting rule that blocks IP addresses sending more than 2000 requests in 5 minutes",
          "ruleFirewallType": "WAF",
          "ruleType": "INSPECTION"
        },
        "output": {
          "configuration": "{\"name\":\"rate-limit-rule\",\"priority\":1,\"statement\":{\"rateBasedStatement\":{\"limit\":2000,\"evaluationWindowSec\":300,\"aggregateKeyType\":\"IP\"}},\"action\":{\"block\":{}}}"
        },
        "description": "Generates a firewall rule configuration from a natural language description. The response contains the generated configuration as a JSON string, ready to use as the configuration of a rule.",
        "id": "example-1",
        "title": "Generate a rule configuration from a description"
      }
    ],
    "GetAdminAccount": [
      {
        "input": {
          "accountId": "234567890123"
        },
        "output": {
          "adminAccountDetails": {
            "adminAccount": "234567890123",
            "adminScope": {
              "firewallTypeScope": {
                "allFirewallTypesEnabled": false,
                "firewallTypes": [
                  "WAF"
                ]
              },
              "scopeFilter": {
                "includeOnly": {
                  "organizationalUnits": [
                    {
                      "name": "Production",
                      "ouId": "ou-abcd-12345678"
                    }
                  ]
                }
              }
            },
            "priority": 2,
            "status": "ONBOARDED"
          }
        },
        "description": "Retrieves the details and administrative scope of a Network Security Manager administrator account.",
        "id": "example-1",
        "title": "Get an administrator account"
      }
    ],
    "GetDeployment": [
      {
        "input": {
          "deploymentIdentifier": "arn:aws:network-security-manager:us-east-1:123456789012:deployment:def456"
        },
        "output": {
          "version": "1",
          "associatedPolicyList": [
            {
              "policyArn": "arn:aws:network-security-manager:us-east-1:123456789012:policy:xyz789"
            }
          ],
          "associatedScopeList": [
            {
              "scopeArn": "arn:aws:network-security-manager:us-east-1:123456789012:scope:abc123"
            }
          ],
          "deploymentArn": "arn:aws:network-security-manager:us-east-1:123456789012:deployment:def456",
          "deploymentConfiguration": {
            "enableCrossAccountVisibility": false
          },
          "deploymentCoverage": [
            {
              "firewallType": "WAF",
              "inScopeResourceTypes": [
                "AWS::ElasticLoadBalancingV2::LoadBalancer::application",
                "AWS::CloudFront::Distribution"
              ],
              "policyArns": [
                "arn:aws:network-security-manager:us-east-1:123456789012:policy:xyz789"
              ]
            }
          ],
          "deploymentDescription": "Production deployment for US East 1 region",
          "deploymentId": "def456",
          "deploymentName": "prod-us-east-1-deployment",
          "hasPublishedVersion": true,
          "isSnapshot": false,
          "status": "ACTIVE",
          "updateToken": "f4a5b6c7-7d8e-4f9a-8b1c-1d2e3f4a5b6c"
        },
        "description": "Retrieves the current published version of a deployment by its base ARN, including per-firewall-type coverage showing which in-scope resource types each policy protects.",
        "id": "example-1",
        "title": "Get a deployment"
      }
    ],
    "GetPolicy": [
      {
        "input": {
          "policyIdentifier": "arn:aws:network-security-manager:us-east-1:123456789012:policy:xyz789"
        },
        "output": {
          "version": "1",
          "associatedTemplateAndRuleList": [
            {
              "templateArn": "arn:aws:network-security-manager:us-east-1:123456789012:template:xyz789"
            }
          ],
          "firewallType": "WAF",
          "hasPublishedVersion": true,
          "isSnapshot": false,
          "policyArn": "arn:aws:network-security-manager:us-east-1:123456789012:policy:xyz789",
          "policyConfiguration": {
            "remediationEnabled": true,
            "resourcesCleanUp": false,
            "wafConfig": {
              "conflictResolution": "MERGE_WHERE_APPLICABLE",
              "existingCustomerWebACLResolution": "NO_REMEDIATION"
            }
          },
          "policyDescription": "WAF policy for web application protection",
          "policyId": "xyz789",
          "policyName": "web-app-waf-policy",
          "priority": 1,
          "status": "ACTIVE",
          "updateToken": "e3f4a5b6-6c7d-4e8f-9a0b-0c1d2e3f4a5b"
        },
        "description": "Retrieves the current published version of a policy by its base ARN, including its associated templates and rules and its enforcement configuration.",
        "id": "example-1",
        "title": "Get a policy"
      }
    ],
    "GetRule": [
      {
        "input": {
          "ruleIdentifier": "arn:aws:network-security-manager:us-east-1:123456789012:rule:abc123"
        },
        "output": {
          "version": "1",
          "configuration": {},
          "firewallType": "WAF",
          "hasPublishedVersion": true,
          "isSnapshot": false,
          "ruleArn": "arn:aws:network-security-manager:us-east-1:123456789012:rule:abc123",
          "ruleDescription": "Blocks requests from known malicious IP addresses",
          "ruleId": "abc123",
          "ruleName": "block-known-bad-ips",
          "ruleType": "INSPECTION",
          "status": "ACTIVE",
          "updateToken": "c1d2e3f4-4a5b-4c6d-9e7f-8a9b0c1d2e3f"
        },
        "description": "Retrieves the current published version of a rule by its base ARN.",
        "id": "example-1",
        "title": "Get a rule"
      },
      {
        "input": {
          "ruleIdentifier": "arn:aws:network-security-manager:us-east-1:123456789012:rule:abc123:3"
        },
        "output": {
          "version": "3",
          "configuration": {},
          "firewallType": "WAF",
          "isSnapshot": true,
          "ruleArn": "arn:aws:network-security-manager:us-east-1:123456789012:rule:abc123:3",
          "ruleDescription": "Blocks requests from known malicious IP addresses",
          "ruleId": "abc123",
          "ruleName": "block-known-bad-ips",
          "ruleType": "INSPECTION",
          "status": "ACTIVE"
        },
        "description": "Retrieves a specific immutable version (snapshot) of a rule using a version-qualified ARN. The response has isSnapshot set to true. Omitting the version qualifier returns the current published rule instead.",
        "id": "example-2",
        "title": "Get a specific version of a rule"
      }
    ],
    "GetScope": [
      {
        "input": {
          "scopeIdentifier": "arn:aws:network-security-manager:us-east-1:123456789012:scope:abc123"
        },
        "output": {
          "version": "1",
          "hasPublishedVersion": true,
          "isSnapshot": false,
          "scopeArn": "arn:aws:network-security-manager:us-east-1:123456789012:scope:abc123",
          "scopeConfiguration": {
            "accountFilter": {
              "includeAll": {}
            },
            "resourceScopes": {}
          },
          "scopeDescription": "Scope covering all production web application resources",
          "scopeId": "abc123",
          "scopeName": "production-web-apps",
          "status": "ACTIVE",
          "updateToken": "b0c4d1e2-3f4a-4b5c-8d6e-7f8a9b0c1d2e"
        },
        "description": "Retrieves the current published version of a scope by its base ARN.",
        "id": "example-1",
        "title": "Get a scope"
      }
    ],
    "GetTemplate": [
      {
        "input": {
          "templateIdentifier": "arn:aws:network-security-manager:us-east-1:123456789012:template:xyz789"
        },
        "output": {
          "version": "1",
          "associatedRuleList": [
            {
              "ruleArn": "arn:aws:network-security-manager:us-east-1:123456789012:rule:abc123"
            }
          ],
          "firewallType": "WAF",
          "hasPublishedVersion": true,
          "isSnapshot": false,
          "status": "ACTIVE",
          "templateArn": "arn:aws:network-security-manager:us-east-1:123456789012:template:xyz789",
          "templateDescription": "Standard WAF template with baseline rule groups",
          "templateId": "xyz789",
          "templateName": "standard-waf-template",
          "updateToken": "d2e3f4a5-5b6c-4d7e-8f9a-9b0c1d2e3f4a"
        },
        "description": "Retrieves the current published version of a template by its base ARN, including its associated rules.",
        "id": "example-1",
        "title": "Get a template"
      }
    ],
    "ListAdminAccounts": [
      {
        "input": {
          "maxResults": 10
        },
        "output": {
          "adminAccounts": [
            {
              "accountId": "234567890123",
              "priority": 2
            }
          ]
        },
        "description": "Lists the Network Security Manager administrator accounts for the organization.",
        "id": "example-1",
        "title": "List administrator accounts"
      }
    ],
    "ListAggregateResourceSynchronizationStatuses": [
      {
        "input": {
          "maxResults": 10,
          "synchronizationStatus": "IN_SYNC"
        },
        "output": {
          "resourceSynchronizationStatuses": [
            {
              "accountId": "234567890123",
              "evaluatedAt": "2026-08-20T12:00:00Z",
              "resourceArn": "arn:aws:elasticloadbalancing:us-east-1:234567890123:loadbalancer/app/my-alb/50dc6c495c0c9188",
              "resourceType": "AWS::ElasticLoadBalancingV2::LoadBalancer::application",
              "synchronizationStatus": "IN_SYNC",
              "updatedAt": "2026-08-20T12:00:00Z"
            }
          ]
        },
        "description": "Lists the aggregate synchronization status of resources across all deployments in the account.",
        "id": "example-1",
        "title": "List synchronization statuses across all deployments"
      }
    ],
    "ListDeploymentSnapshots": [
      {
        "input": {
          "deploymentIdentifier": "arn:aws:network-security-manager:us-east-1:123456789012:deployment:def456",
          "maxResults": 10
        },
        "output": {
          "snapshots": [
            {
              "version": "2",
              "deploymentArn": "arn:aws:network-security-manager:us-east-1:123456789012:deployment:def456:2",
              "deploymentId": "def456",
              "deploymentName": "prod-us-east-1-deployment",
              "status": "ACTIVE",
              "updatedAt": "2026-08-20T12:00:00Z"
            }
          ]
        },
        "description": "Lists the immutable snapshots that have been created for a deployment.",
        "id": "example-1",
        "title": "List the snapshots of a deployment"
      }
    ],
    "ListDeployments": [
      {
        "input": {
          "maxResults": 10,
          "status": "ACTIVE"
        },
        "output": {
          "deployments": [
            {
              "version": "2",
              "deploymentArn": "arn:aws:network-security-manager:us-east-1:123456789012:deployment:def456",
              "deploymentId": "def456",
              "deploymentName": "prod-us-east-1-deployment",
              "hasPublishedVersion": true,
              "status": "ACTIVE",
              "updatedAt": "2026-08-20T12:00:00Z"
            }
          ]
        },
        "description": "Lists the published deployments in the account, one page at a time.",
        "id": "example-1",
        "title": "List deployments"
      }
    ],
    "ListPolicies": [
      {
        "input": {
          "maxResults": 10,
          "status": "ACTIVE"
        },
        "output": {
          "policies": [
            {
              "version": "2",
              "firewallType": "WAF",
              "hasPublishedVersion": true,
              "policyArn": "arn:aws:network-security-manager:us-east-1:123456789012:policy:xyz789",
              "policyId": "xyz789",
              "policyName": "web-app-waf-policy",
              "priority": 2,
              "status": "ACTIVE",
              "updatedAt": "2026-08-20T12:00:00Z"
            }
          ]
        },
        "description": "Lists the published policies in the account, one page at a time.",
        "id": "example-1",
        "title": "List policies"
      }
    ],
    "ListPolicySnapshots": [
      {
        "input": {
          "maxResults": 10,
          "policyIdentifier": "arn:aws:network-security-manager:us-east-1:123456789012:policy:xyz789"
        },
        "output": {
          "snapshots": [
            {
              "version": "2",
              "firewallType": "WAF",
              "policyArn": "arn:aws:network-security-manager:us-east-1:123456789012:policy:xyz789:2",
              "policyId": "xyz789",
              "policyName": "web-app-waf-policy",
              "priority": 2,
              "status": "ACTIVE",
              "updatedAt": "2026-08-20T12:00:00Z"
            }
          ]
        },
        "description": "Lists the immutable snapshots that have been created for a policy.",
        "id": "example-1",
        "title": "List the snapshots of a policy"
      }
    ],
    "ListResourceAssociations": [
      {
        "input": {
          "maxResults": 10,
          "resourceIdentifier": "arn:aws:network-security-manager:us-east-1:123456789012:rule:abc123"
        },
        "output": {
          "resourceAssociations": [
            {
              "arn": "arn:aws:network-security-manager:us-east-1:123456789012:template:xyz789",
              "resourceType": "Template"
            },
            {
              "arn": "arn:aws:network-security-manager:us-east-1:123456789012:policy:xyz789",
              "resourceType": "Policy"
            }
          ]
        },
        "description": "Lists the resources that reference the given rule, such as the templates and policies it is associated with.",
        "id": "example-1",
        "title": "List what references a rule"
      }
    ],
    "ListResourceSynchronizationStatuses": [
      {
        "input": {
          "deploymentIdentifier": "arn:aws:network-security-manager:us-east-1:123456789012:deployment:def456",
          "maxResults": 10,
          "synchronizationStatus": "OUT_OF_SYNC"
        },
        "output": {
          "resourceSynchronizationStatuses": [
            {
              "accountId": "123456789012",
              "deploymentArn": "arn:aws:network-security-manager:us-east-1:123456789012:deployment:def456",
              "evaluatedAt": "2026-08-20T12:00:00Z",
              "outOfSyncReasons": {
                "reasons": {
                  "WAF": {
                    "missingFirewall": "No web ACL is associated with the resource"
                  }
                }
              },
              "resourceArn": "arn:aws:cloudfront::123456789012:distribution/EDFDVBD6EXAMPLE",
              "resourceType": "AWS::CloudFront::Distribution",
              "synchronizationStatus": "OUT_OF_SYNC",
              "updatedAt": "2026-08-20T12:00:00Z"
            }
          ]
        },
        "description": "Lists the resources tracked by a deployment that are out of sync, including the structured reason. Here a CloudFront distribution has no web ACL where the policy requires one.",
        "id": "example-1",
        "title": "List out-of-sync resources for a deployment"
      }
    ],
    "ListRuleSnapshots": [
      {
        "input": {
          "maxResults": 10,
          "ruleIdentifier": "arn:aws:network-security-manager:us-east-1:123456789012:rule:abc123"
        },
        "output": {
          "snapshots": [
            {
              "version": "2",
              "firewallType": "WAF",
              "ruleArn": "arn:aws:network-security-manager:us-east-1:123456789012:rule:abc123:2",
              "ruleId": "abc123",
              "ruleName": "block-known-bad-ips",
              "ruleType": "INSPECTION",
              "status": "ACTIVE",
              "updatedAt": "2026-08-20T12:00:00Z"
            },
            {
              "version": "3",
              "firewallType": "WAF",
              "ruleArn": "arn:aws:network-security-manager:us-east-1:123456789012:rule:abc123:3",
              "ruleId": "abc123",
              "ruleName": "block-known-bad-ips",
              "ruleType": "INSPECTION",
              "status": "ACTIVE",
              "updatedAt": "2026-08-21T09:30:00Z"
            }
          ]
        },
        "description": "Lists the immutable snapshots that have been created for a rule.",
        "id": "example-1",
        "title": "List the snapshots of a rule"
      }
    ],
    "ListRules": [
      {
        "input": {
          "maxResults": 10,
          "status": "ACTIVE"
        },
        "output": {
          "rules": [
            {
              "version": "2",
              "firewallType": "WAF",
              "hasPublishedVersion": true,
              "ruleArn": "arn:aws:network-security-manager:us-east-1:123456789012:rule:abc123",
              "ruleId": "abc123",
              "ruleName": "block-known-bad-ips",
              "ruleType": "INSPECTION",
              "status": "ACTIVE",
              "updatedAt": "2026-08-20T12:00:00Z"
            }
          ]
        },
        "description": "Lists the published rules in the account, one page at a time.",
        "id": "example-1",
        "title": "List rules"
      }
    ],
    "ListScopeSnapshots": [
      {
        "input": {
          "maxResults": 10,
          "scopeIdentifier": "arn:aws:network-security-manager:us-east-1:123456789012:scope:abc123"
        },
        "output": {
          "snapshots": [
            {
              "version": "2",
              "scopeArn": "arn:aws:network-security-manager:us-east-1:123456789012:scope:abc123:2",
              "scopeId": "abc123",
              "scopeName": "production-web-apps",
              "status": "ACTIVE",
              "updatedAt": "2026-08-20T12:00:00Z"
            }
          ]
        },
        "description": "Lists the immutable snapshots that have been created for a scope.",
        "id": "example-1",
        "title": "List the snapshots of a scope"
      }
    ],
    "ListScopes": [
      {
        "input": {
          "maxResults": 10,
          "status": "ACTIVE"
        },
        "output": {
          "nextToken": "eyJsYXN0RXZhbHVhdGVkS2V5IjoiYWJjMTIzIn0=",
          "scopes": [
            {
              "version": "2",
              "hasPublishedVersion": true,
              "scopeArn": "arn:aws:network-security-manager:us-east-1:123456789012:scope:abc123",
              "scopeId": "abc123",
              "scopeName": "production-web-apps",
              "status": "ACTIVE",
              "updatedAt": "2026-08-20T12:00:00Z"
            }
          ]
        },
        "description": "Lists the published scopes in the account, one page at a time.",
        "id": "example-1",
        "title": "List scopes"
      }
    ],
    "ListTagsForResource": [
      {
        "input": {
          "resourceArn": "arn:aws:network-security-manager:us-east-1:123456789012:policy:xyz789"
        },
        "output": {
          "tags": {
            "Environment": "Production",
            "Team": "NetworkSecurity"
          }
        },
        "description": "Lists the tags associated with a Network Security Manager resource.",
        "id": "example-1",
        "title": "List the tags on a resource"
      }
    ],
    "ListTemplateSnapshots": [
      {
        "input": {
          "maxResults": 10,
          "templateIdentifier": "arn:aws:network-security-manager:us-east-1:123456789012:template:xyz789"
        },
        "output": {
          "snapshots": [
            {
              "version": "2",
              "firewallType": "WAF",
              "status": "ACTIVE",
              "templateArn": "arn:aws:network-security-manager:us-east-1:123456789012:template:xyz789:2",
              "templateId": "xyz789",
              "templateName": "standard-waf-template",
              "updatedAt": "2026-08-20T12:00:00Z"
            }
          ]
        },
        "description": "Lists the immutable snapshots that have been created for a template.",
        "id": "example-1",
        "title": "List the snapshots of a template"
      }
    ],
    "ListTemplates": [
      {
        "input": {
          "maxResults": 10,
          "status": "ACTIVE"
        },
        "output": {
          "templates": [
            {
              "version": "2",
              "firewallType": "WAF",
              "hasPublishedVersion": true,
              "status": "ACTIVE",
              "templateArn": "arn:aws:network-security-manager:us-east-1:123456789012:template:xyz789",
              "templateId": "xyz789",
              "templateName": "standard-waf-template",
              "updatedAt": "2026-08-20T12:00:00Z"
            }
          ]
        },
        "description": "Lists the published templates in the account, one page at a time.",
        "id": "example-1",
        "title": "List templates"
      }
    ],
    "PutAdminAccount": [
      {
        "input": {
          "accountId": "234567890123",
          "adminScope": {
            "firewallTypeScope": {
              "allFirewallTypesEnabled": false,
              "firewallTypes": [
                "WAF"
              ]
            },
            "scopeFilter": {
              "includeOnly": {
                "organizationalUnits": [
                  "ou-abcd-12345678"
                ]
              }
            }
          },
          "priority": 2
        },
        "output": {
          "adminAccountDetails": {
            "adminAccount": "234567890123",
            "adminScope": {
              "firewallTypeScope": {
                "allFirewallTypesEnabled": false,
                "firewallTypes": [
                  "WAF"
                ]
              },
              "scopeFilter": {
                "includeOnly": {
                  "organizationalUnits": [
                    {
                      "name": "Production",
                      "ouId": "ou-abcd-12345678"
                    }
                  ]
                }
              }
            },
            "priority": 2,
            "status": "ONBOARDED"
          }
        },
        "description": "Designates an account as a Network Security Manager administrator, scoped to a specific organizational unit and the WAF firewall type.",
        "id": "example-1",
        "title": "Designate an administrator account"
      }
    ],
    "TagResource": [
      {
        "input": {
          "resourceArn": "arn:aws:network-security-manager:us-east-1:123456789012:policy:xyz789",
          "tags": {
            "Environment": "Production",
            "Team": "NetworkSecurity"
          }
        },
        "description": "Adds tags to a Network Security Manager resource.",
        "id": "example-1",
        "title": "Tag a resource"
      }
    ],
    "UntagResource": [
      {
        "input": {
          "resourceArn": "arn:aws:network-security-manager:us-east-1:123456789012:policy:xyz789",
          "tagKeys": [
            "Environment"
          ]
        },
        "description": "Removes the specified tag keys from a Network Security Manager resource.",
        "id": "example-1",
        "title": "Remove tags from a resource"
      }
    ],
    "UpdateDeployment": [
      {
        "input": {
          "associatedPolicyList": [
            {
              "policyIdentifier": "arn:aws:network-security-manager:us-east-1:123456789012:policy:xyz789"
            }
          ],
          "associatedScopeList": [
            {
              "scopeIdentifier": "arn:aws:network-security-manager:us-east-1:123456789012:scope:abc123"
            }
          ],
          "deploymentConfiguration": {
            "enableCrossAccountVisibility": true
          },
          "deploymentDescription": "Production deployment for US East 1 region - updated",
          "deploymentIdentifier": "arn:aws:network-security-manager:us-east-1:123456789012:deployment:def456",
          "isPublished": true,
          "updateToken": "f4a5b6c7-7d8e-4f9a-8b1c-1d2e3f4a5b6c"
        },
        "output": {
          "version": "2",
          "associatedPolicyList": [
            {
              "policyArn": "arn:aws:network-security-manager:us-east-1:123456789012:policy:xyz789"
            }
          ],
          "associatedScopeList": [
            {
              "scopeArn": "arn:aws:network-security-manager:us-east-1:123456789012:scope:abc123"
            }
          ],
          "deploymentArn": "arn:aws:network-security-manager:us-east-1:123456789012:deployment:def456",
          "deploymentConfiguration": {
            "enableCrossAccountVisibility": true
          },
          "deploymentCoverage": [
            {
              "firewallType": "WAF",
              "inScopeResourceTypes": [
                "AWS::ElasticLoadBalancingV2::LoadBalancer::application",
                "AWS::CloudFront::Distribution"
              ],
              "policyArns": [
                "arn:aws:network-security-manager:us-east-1:123456789012:policy:xyz789"
              ]
            }
          ],
          "deploymentDescription": "Production deployment for US East 1 region - updated",
          "deploymentId": "def456",
          "deploymentName": "prod-us-east-1-deployment",
          "hasPublishedVersion": true,
          "isSnapshot": false,
          "status": "ACTIVE",
          "updateToken": "a5b6c7d8-8e9f-4a0b-9c1d-2e3f4a5b6c7d",
          "updatedAt": "2026-08-20T12:00:00Z"
        },
        "description": "Updates the deployment's associations and publishes the change. The response includes deploymentCoverage showing which resource types the associated policies can protect. The updateToken from the most recent read is required for optimistic locking.",
        "id": "example-1",
        "title": "Update a deployment and publish it"
      }
    ],
    "UpdatePolicy": [
      {
        "input": {
          "associatedTemplateAndRuleList": [
            {
              "templateIdentifier": "arn:aws:network-security-manager:us-east-1:123456789012:template:xyz789"
            }
          ],
          "isPublished": true,
          "policyConfiguration": {
            "remediationEnabled": true,
            "resourcesCleanUp": false,
            "wafConfig": {
              "conflictResolution": "MERGE_WHERE_APPLICABLE",
              "existingCustomerWebACLResolution": "NO_REMEDIATION"
            }
          },
          "policyDescription": "WAF policy for web application protection - updated",
          "policyIdentifier": "arn:aws:network-security-manager:us-east-1:123456789012:policy:xyz789",
          "priority": 2,
          "updateToken": "e3f4a5b6-6c7d-4e8f-9a0b-0c1d2e3f4a5b"
        },
        "output": {
          "version": "2",
          "associatedTemplateAndRuleList": [
            {
              "templateArn": "arn:aws:network-security-manager:us-east-1:123456789012:template:xyz789"
            }
          ],
          "firewallType": "WAF",
          "hasPublishedVersion": true,
          "isSnapshot": false,
          "policyArn": "arn:aws:network-security-manager:us-east-1:123456789012:policy:xyz789",
          "policyConfiguration": {
            "remediationEnabled": true,
            "resourcesCleanUp": false,
            "wafConfig": {
              "conflictResolution": "MERGE_WHERE_APPLICABLE",
              "existingCustomerWebACLResolution": "NO_REMEDIATION"
            }
          },
          "policyDescription": "WAF policy for web application protection - updated",
          "policyId": "xyz789",
          "policyName": "web-app-waf-policy",
          "priority": 2,
          "status": "ACTIVE",
          "updateToken": "f4a5b6c7-7d8e-4f9a-8b1c-1d2e3f4a5b6c",
          "updatedAt": "2026-08-20T12:00:00Z"
        },
        "description": "Updates the policy's description, priority, and configuration and publishes the change. The updateToken from the most recent read is required for optimistic locking.",
        "id": "example-1",
        "title": "Update a policy and publish it"
      }
    ],
    "UpdateRule": [
      {
        "input": {
          "configuration": {},
          "isPublished": true,
          "ruleDescription": "Blocks requests from known malicious IP addresses - updated list",
          "ruleIdentifier": "arn:aws:network-security-manager:us-east-1:123456789012:rule:abc123",
          "ruleType": "INSPECTION",
          "updateToken": "c1d2e3f4-4a5b-4c6d-9e7f-8a9b0c1d2e3f"
        },
        "output": {
          "version": "2",
          "configuration": {},
          "firewallType": "WAF",
          "hasPublishedVersion": true,
          "isSnapshot": false,
          "ruleArn": "arn:aws:network-security-manager:us-east-1:123456789012:rule:abc123",
          "ruleDescription": "Blocks requests from known malicious IP addresses - updated list",
          "ruleId": "abc123",
          "ruleName": "block-known-bad-ips",
          "ruleType": "INSPECTION",
          "status": "ACTIVE",
          "updateToken": "d2e3f4a5-5b6c-4d7e-8f9a-9b0c1d2e3f4a",
          "updatedAt": "2026-08-20T12:00:00Z"
        },
        "description": "Updates the rule's description and configuration and publishes the change. The updateToken from the most recent read is required for optimistic locking.",
        "id": "example-1",
        "title": "Update a rule and publish it"
      }
    ],
    "UpdateScope": [
      {
        "input": {
          "isPublished": true,
          "scopeConfiguration": {
            "accountFilter": {
              "includeAll": {}
            },
            "resourceScopes": {}
          },
          "scopeDescription": "Scope covering all production web application resources in US East 1",
          "scopeIdentifier": "arn:aws:network-security-manager:us-east-1:123456789012:scope:abc123",
          "updateToken": "b0c4d1e2-3f4a-4b5c-8d6e-7f8a9b0c1d2e"
        },
        "output": {
          "version": "2",
          "hasPublishedVersion": true,
          "isSnapshot": false,
          "scopeArn": "arn:aws:network-security-manager:us-east-1:123456789012:scope:abc123",
          "scopeConfiguration": {
            "accountFilter": {
              "includeAll": {}
            },
            "resourceScopes": {}
          },
          "scopeDescription": "Scope covering all production web application resources in US East 1",
          "scopeId": "abc123",
          "scopeName": "production-web-apps",
          "status": "ACTIVE",
          "updateToken": "c1d2e3f4-4a5b-4c6d-9e7f-8a9b0c1d2e3f",
          "updatedAt": "2026-08-20T12:00:00Z"
        },
        "description": "Updates the scope's description and configuration and publishes the change. The updateToken from the most recent read is required for optimistic locking.",
        "id": "example-1",
        "title": "Update a scope and publish it"
      }
    ],
    "UpdateTemplate": [
      {
        "input": {
          "associatedRuleList": [
            {
              "ruleIdentifier": "arn:aws:network-security-manager:us-east-1:123456789012:rule:abc123"
            }
          ],
          "isPublished": true,
          "templateDescription": "Standard WAF template with baseline rule groups - updated",
          "templateIdentifier": "arn:aws:network-security-manager:us-east-1:123456789012:template:xyz789",
          "updateToken": "d2e3f4a5-5b6c-4d7e-8f9a-9b0c1d2e3f4a"
        },
        "output": {
          "version": "2",
          "associatedRuleList": [
            {
              "ruleArn": "arn:aws:network-security-manager:us-east-1:123456789012:rule:abc123"
            }
          ],
          "firewallType": "WAF",
          "hasPublishedVersion": true,
          "isSnapshot": false,
          "status": "ACTIVE",
          "templateArn": "arn:aws:network-security-manager:us-east-1:123456789012:template:xyz789",
          "templateDescription": "Standard WAF template with baseline rule groups - updated",
          "templateId": "xyz789",
          "templateName": "standard-waf-template",
          "updateToken": "e3f4a5b6-6c7d-4e8f-9a0b-0c1d2e3f4a5b",
          "updatedAt": "2026-08-20T12:00:00Z"
        },
        "description": "Updates the template's description and rule associations and publishes the change. The updateToken from the most recent read is required for optimistic locking.",
        "id": "example-1",
        "title": "Update a template and publish it"
      }
    ]
  }
}