---
title: "Get service account token and set its TTL"
method: POST
path: "/tokens/{saNme}"
---

# Get service account token and set its TTL

`POST /tokens/{saNme}`

## Request

- Base URL: `127.0.0.1:5555` (relative, and the document was published on a file host, not at the API’s origin)
- URL: `127.0.0.1:5555/tokens/{saNme}`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/banzaicloud/apis/jwt-to-rbac/docs/tokens/:saNme/post.ts> (a function with typed inputs; its response is checked against the schema)

## Path parameters

- `saNme` string, required

## Request body

- SaTokenRequest
  - `duration` string

## Response `200`

Expected response to a valid request

- object[]
  - `data` object, required
    - `ca.crt` string, required
    - `namespace` string, required
    - `token` string, required
  - `name` string, required

## Other responses

- `401`: Missing or invalid ID token in the Authorization header
- `403`: ID token does not belong to the requested service account

## Changes

- **2026-09-25** `230061d4b44b`: 3 info
  - the endpoint scheme security `idToken` was added to the API
  - added the non-success response with the status `401`
  - added the non-success response with the status `403`

[Operation history](https://skmtc.dev/banzaicloud/apis/jwt-to-rbac/changes/tokens/:saNme/post.md)

---

[API](https://skmtc.dev/banzaicloud/apis/jwt-to-rbac.md) - [All operations](https://skmtc.dev/banzaicloud/apis/jwt-to-rbac/llms.txt) - [OpenAPI document](https://skmtc.dev/banzaicloud/apis/jwt-to-rbac/revisions/230061d4b44b?raw)