/

The Amazon SSM multi-region endpoint

http://ssm.{region}.amazonaws.com

POST

Retrieves information about the patches on the specified managed node and their state relative to the patch baseline being used for the node.

Request Example

Shell

JavaScript

Java

Swift

curl --location -g --request POST 'http://ssm.{region}.amazonaws.com/' \
--header 'X-Amz-Target;' \
--header 'Content-Type: application/json' \
--data-raw '{
    "InstanceId": "string",
    "Filters": [],
    "NextToken": "string",
    "MaxResults": 0
}'

Response Example

200 - Example 1

{
    "Patches": [],
    "NextToken": "string"
}

Request

Query Params

MaxResults

string

optional

Pagination limit

NextToken

string

optional

Pagination token

Header Params

X-Amz-Target

string

required

Body Params application/json

InstanceId

string

required

The ID of the managed node whose patch state information should be retrieved.

Match pattern:

(^i-(\w{8}|\w{17})$)|(^mi-\w{17}$)

Filters

array[object (PatchOrchestratorFilter) {2}]

optional

Each element in the array is a structure containing a key-value pair.

Supported keys for DescribeInstancePatchesinclude the following:

Classification

Sample values: Security | SecurityUpdates
KBId

Sample values: KB4480056 | java-1.7.0-openjdk.x86_64
Severity

Sample values: Important | Medium | Low
State

Sample values: Installed | InstalledOther | InstalledPendingReboot

>= 0 items<= 5 items

Key

string

optional

The key for the filter.

>= 1 characters<= 128 characters

Values

array[string]

optional

The value for the filter.

NextToken

string

optional

The token for the next set of items to return. (You received this token from a previous call.)

MaxResults

integer

optional

The maximum number of patches to return (per page).

>= 10<= 100

Examples

Responses

🟢200Success

application/json

Body

Patches

array[object (PatchComplianceData) {7}]

optional

Each entry in the array is a structure containing:

Title (string)
KBId (string)
Classification (string)
Severity (string)
State (string, such as "INSTALLED" or "FAILED")
InstalledTime (DateTime)
InstalledBy (string)

Title

string

required

The title of the patch.

KBId

string

required

The operating system-specific ID of the patch.

Classification

string

required

The classification of the patch, such as SecurityUpdates, Updates, and CriticalUpdates.

Severity

string

required

The severity of the patch such as Critical, Important, and Moderate.

State

enum<string>

required

The state of the patch on the managed node, such as INSTALLED or FAILED.

For descriptions of each patch state, see About patch compliance in the Amazon Web Services Systems Manager User Guide.

Allowed values:

INSTALLEDINSTALLED_OTHERINSTALLED_PENDING_REBOOTINSTALLED_REJECTEDMISSINGNOT_APPLICABLEFAILED

InstalledTime

string <date-time>

required

The date/time the patch was installed on the managed node. Not all operating systems provide this level of information.

CVEIds

string

optional

The IDs of one or more Common Vulnerabilities and Exposure (CVE) issues that are resolved by the patch.

NextToken

string

optional

The token to use when requesting the next set of items. If there are no additional items to return, the string is empty.

🟠480InternalServerError

🟠481InvalidInstanceId

🟠482InvalidFilter

🟠483InvalidNextToken