FAfactory
Service Accounts

Verify an act-as delegation grant

Changed on

Service-account-only: authenticate with the API key of the service account the grant is bound to, not with the grant itself. Verifies a presented act-as grant and returns the bound operator, plus the shared-session scope when the daemon declares scope support. Used by the daemon the service account owns on connect and on re-verification. Returns 401 when the grant is unknown, revoked, or past its connect expiry (unless reverify is true), or when the operator is no longer active; returns 403 when sharedSessionScope does not match the grant kind or the operator may no longer act through the grant.

post/api/v0/act-as-grants/verify

Request

  • Base URL
    https://api.factory.ai
  • Auth
    HTTP bearer

Request body

grantstring required

The act-as grant the client presented to the daemon.

reverifyboolean

Defaults to false. Set to true only when re-verifying an already-connected act-as session: the short connect expiry of the grant is then not enforced, while revocation, service account, and operator checks still apply.

sharedSessionScopeboolean

Defaults to false. Set to true only when the daemon enforces shared-session scopes and the client presented the grant as a shared-session grant. A shared-session grant is accepted only with true and a full grant only with false; a mismatch returns 403.

Response

Response for status 200

operatorUserIdstring required
serviceAccountIdstring required
operatorNamestring
receiptstring

Changes