GET /identity/oauth2/token — imds-instancemetadataservice

Get token

Get a Token from Azure AD

get/identity/oauth2/token

Query parameters

resourcestring required

This is the urlencoded identifier URI of the sink resource for the requested Azure AD token. The resulting token contains the corresponding aud for this resource.

api-versionstring required

Version of the API to be used with the client request.

client_idstring

This identifies, by Azure AD client id, a specific explicit identity to use when authenticating to Azure AD. Mutually exclusive with object_id and msi_res_id.

object_idstring

This identifies, by Azure AD object id, a specific explicit identity to use when authenticating to Azure AD. Mutually exclusive with client_id and msi_res_id.

msi_res_idstring

This identifies, by urlencoded ARM resource id, a specific explicit identity to use when authenticating to Azure AD. Mutually exclusive with client_id and object_id.

authoritystring

This indicates the authority to request AAD tokens from. Defaults to the known authority of the identity to be used.

bypass_cache'true'

If provided, the value must be 'true'. This indicates to the server that the token must be retrieved from Azure AD and cannot be retrieved from an internal cache.

Headers

Metadata'true' required

This must be set to 'true'.

Response

Successful operation

access_tokenstring

This is the requested access token. The app can use this token to authenticate to the sink resource.

expires_instring

This is how long the access token is valid (in seconds).

expires_onstring

This is the time when the access token expires. The date is represented as the number of seconds from 1970-01-01T0:0:0Z UTC until the expiration time. This value is used to determine the lifetime of cached tokens.

ext_expires_instring

This indicates the extended lifetime of the token (in seconds).

not_beforestring

This is the time when the access token becomes effective. The date is represented as the number of seconds from 1970-01-01T0:0:0Z UTC until the expiration time.

resourcestring

This is the app ID URI of the sink resource.

token_typestring

This indicates the token type value.

client_idstring

This is the client_id specified in the request, if any.

object_idstring

This is the object_id specified in the request, if any.

msi_res_idstring

This is the msi_res_id specified in the request, if any.

Changes

Changed in 3 of the 25 revisions of this API.11

Jul 13, 20262018-02-01e65fff975b3a1See the full diff
- ○
  the endpoint scheme security basic_auth was added to the API
  api-security-added
Jul 13, 20262018-02-01503e7225df0f5See the full diff
- ○
  added the non-success response with the status 400
  response-non-success-status-added
- ○
  added the non-success response with the status 404
  response-non-success-status-added
- ○
  added the non-success response with the status 405
  response-non-success-status-added
- ○
  added the non-success response with the status 429
  response-non-success-status-added
- ○
  added the non-success response with the status 500
  response-non-success-status-added
Jul 13, 20262018-02-01eb496c25f2af5See the full diff
- ○
  removed the non-success response with the status 400
  response-non-success-status-removed
- ○
  removed the non-success response with the status 404
  response-non-success-status-removed
- ○
  removed the non-success response with the status 405
  response-non-success-status-removed
- ○
  removed the non-success response with the status 429
  response-non-success-status-removed
- ○
  removed the non-success response with the status 500
  response-non-success-status-removed

Full history