COconfluent
OAuth Tokens (sts/v1)

Exchange an OAuth Token

General Availability

Use this operation to exchange an access token (JWT) issued by an external identity provider for an access token (JWT) issued by Confluent.This enables the use of external identities to access Confluent Cloud APIs.

post/sts/v1/oauth2/token

Request

  • Base URL
    https://api.confluent.cloud
  • URL
    https://api.confluent.cloud/sts/v1/oauth2/token
  • Auth
    • HTTP basic
    • or HTTP basic
    • or OAuth 2
      Client credentials
      Token URL: https://api.confluent.cloud/sts/v1/oauth2/token

Request body application/x-www-form-urlencoded

api_version'sts/v1'

APIVersion defines the schema version of this representation of a resource.

kind'TokenExchangeRequest'

Kind defines the object this REST resource represents.

idstring

ID is the "natural identifier" for an object within its scope/namespace; it is normally unique across time but not space. That is, you can assume that the ID will not be reclaimed and reused after an object is deleted ("time"); however, it may collide with IDs for other object kinds or objects of the same kind within a different scope/namespace ("space").

grant_typestring required

The grant type. Must be urn:ietf:params:oauth:grant-type:token-exchange, which indicates a token exchange.

subject_tokenstring required

Confluent Cloud only accepts JSON Web Token (JWT) access tokens from customer identity provider

identity_pool_idstring required

Identity pool is a group of external identities that are assigned a certain level of access based on policy

subject_token_typestring required

An identifier for the type of requested security token. Supported values is urn:ietf:params:oauth:token-type:jwt.

requested_token_typestring required

An identifier for the type of requested security token. Supported values is urn:ietf:params:oauth:token-type:access_token.

expires_ininteger

The amount of time, in seconds, between the time when the access token was issued and the time when the access token will expire

Example request

{
  "id": "dlz-f3a90de",
  "metadata": {
    "self": "https://api.confluent.cloud/sts/v1/token-exchange-requests/ter-12345",
    "resource_name": "crn://confluent.cloud/organization=9bb441c4-edef-46ac-8a41-c49e44a3fd9a/token-exchange-request=ter-12345",
    "created_at": "2006-01-02T15:04:05-07:00",
    "updated_at": "2006-01-02T15:04:05-07:00",
    "deleted_at": "2006-01-02T15:04:05-07:00"
  },
  "grant_type": "urn:ietf:params:oauth:grant-type:token-exchange",
  "subject_token": "test_jwt_token",
  "identity_pool_id": "pool_1",
  "subject_token_type": "urn:ietf:params:oauth:token-type:jwt",
  "requested_token_type": "urn:ietf:params:oauth:token-type:access_token"
}

Response

access token used to access public control plane api

access_tokenstring required

An JWT access token, issued by Confluent, in response to the token exchange request. Client application could use the access token to access confluent public api

issued_token_typestring required

The token type. Always matches the value of requested_token_type from the request.

token_typestring required

Indicates the token type value. The only type that Confluent supports is Bearer

expires_ininteger required

The length of time, in seconds, that the access token is valid.

Example response

{
  "issued_token_type": "urn:ietf:params:oauth:token-type:access_token",
  "token_type": "Bearer",
  "expires_in": 3600
}

Changes

No recorded changes to this operation across all 7 revisions of this API.