---
title: "POST /raw-creds"
method: POST
path: "/raw-creds"
tags: ["Authentication"]
---

# POST /raw-creds

`POST /raw-creds`

## Request

- Base URL: `https://api.akeyless.io`
- URL: `https://api.akeyless.io/raw-creds`
- Auth: none declared

## Request body

- RawCreds
  - `access-id` string
  - `access-key` string

## Response `200`

rawCredsResponse wraps response body.

- SystemAccessCredentialsReplyObj
  - `access_id` string
  - `auth_creds` string: Temporary credentials for accessing Auth
  - `csrf_token` string: CSRF token for synchronizer-token pattern (only populated for WebUI clients)
  - `expiry` integer: Credentials expiration date
  - `kfm_creds` string: Temporary credentials for accessing the KFMs instances
  - `need_mfa_app_first_config` boolean: If the user didn't complete to configure the MFA app
  - `recovery_key_id` string: RecoveryKeyID identifies the DPoP-bound recovery key for WebUI session recovery.
  - `required_mfa` string
  - `sub_claims` object: SubClaims carries the IdP-verified RBAC claims for offline placeholder creds (empty UAM JWT); parsed from the ID token at callback time.
  - `token` string: Credentials tmp token
  - `uam_creds` string: Temporary credentials for accessing the UAM service
  - `unique_id` string: UniqueId is set only on Gateway-minted offline placeholder creds (empty UAM JWT), carrying the IdP unique identifier so usage-time RBAC can resolve identity.

## Other responses

- `default`: errorResponse wraps any error to return it as a JSON object with one "error" field.

---

[API](https://skmtc.dev/akeyless/apis/identity-access.md) - [All operations](https://skmtc.dev/akeyless/apis/identity-access/llms.txt) - [OpenAPI document](https://skmtc.dev/akeyless/apis/identity-access/revisions/6fbc3858ec88?raw)