Exchange a workload identity subject token

POST

https://host.com/apis/auth/token

POST

/apis/auth/token

$ curl -X POST https://host.com/apis/auth/token \
>      -H "Content-Type: application/x-www-form-urlencoded" \
>      -d "grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Atoken-exchange" \
>      -d "client_id=nemo-client-12345" \
>      -d "subject_token=eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ3b3JrbG9hZC1pZC10b2tlbiIsImF1ZCI6Im5lbW8tcGxhdGZvcm0iLCJleHAiOjE2ODU0MjQ4MDB9.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c" \
>      -d "subject_token_type=urn%3Aietf%3Aparams%3Aoauth%3Atoken-type%3Ajwt"

1 {
2   "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJuZW1vLWFjY2VzcyIsInNjb3BlIjoicmVhZCB3cml0ZSIsImV4cCI6MTY4NTQyODQwMCwiaXNzIjoibmVtby1hdXRoLXNlcnZlciJ9.dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk",
3   "issued_token_type": "urn:ietf:params:oauth:token-type:access_token",
4   "token_type": "Bearer",
5   "expires_in": 3600,
6   "scope": "read write"
7 }

Exchange a configured workload identity subject token for a NeMo Platform access token.

Request

This endpoint expects an object.

grant_typeenumRequired

OAuth 2.0 token exchange grant type.

Allowed values:

client_idstringRequired

Workload token exchange OAuth client ID.

subject_tokenstringRequired

JWT subject token to exchange.

subject_token_typeenumRequired

Token type identifier for the subject token.

Allowed values:

requested_token_typeenumOptionalDefaults to urn:ietf:params:oauth:token-type:access_token

Requested token type identifier for the issued token.

Allowed values:

audiencestringOptional

Requested audience for the issued access token.

scopestringOptional

Space-separated scopes requested for the issued access token.

Response

Successful Response

access_tokenstring

JWT access token minted for the workload identity.

issued_token_typestring

Token type identifier for the issued token.

token_typestring

OAuth token type used in Authorization headers.

expires_ininteger

Lifetime of the access token in seconds.

scopestring

Space-separated scopes granted to the access token.

Errors

400

Bad Request Error

401

Unauthorized Error