---
title: "Exchange Microsoft access token for system token"
method: POST
path: "/core/latest/token/by-microsoft"
tags: ["Authentication"]
---

# Exchange Microsoft access token for system token

`POST /core/latest/token/by-microsoft`

## Request

- Base URL: `https://api.klara.ch`
- URL: `https://api.klara.ch/core/latest/token/by-microsoft`
- Auth: none declared

Provide a Microsoft access token and tenant id to exchange for a system token.

## Response `200`

Token created

- AccessTokenResponse
  - `access_token` string
  - `expires_in` integer
  - `refresh_expires_in` integer
  - `refresh_token` string
  - `token_type` string
  - `id_token` string
  - `not-before-policy` integer
  - `session_state` string
  - `otherClaims` object

## Other responses

- `400`: Could not get token<br/><br/>Failures detected by a downstream service carry that service's own <code>code</code>, which this reference does not enumerate, so the <code>code</code> field may hold a value not documented here. Treat an unrecognised code as a generic failure of the status it arrives with, and do not branch on a code this reference does not list.
- `401`: Invalid credentials<br/><br/>Failures detected by a downstream service carry that service's own <code>code</code>, which this reference does not enumerate, so the <code>code</code> field may hold a value not documented here. Treat an unrecognised code as a generic failure of the status it arrives with, and do not branch on a code this reference does not list.
- `429`: API rate limit exceeded<br/><br/>Failures detected by a downstream service carry that service's own <code>code</code>, which this reference does not enumerate, so the <code>code</code> field may hold a value not documented here. Treat an unrecognised code as a generic failure of the status it arrives with, and do not branch on a code this reference does not list.
- `500`: Internal server error<br/><br/>Failures detected by a downstream service carry that service's own <code>code</code>, which this reference does not enumerate, so the <code>code</code> field may hold a value not documented here. Treat an unrecognised code as a generic failure of the status it arrives with, and do not branch on a code this reference does not list.

---

[API](https://skmtc.dev/klara/apis/klara-public-api.md) · [All operations](https://skmtc.dev/klara/apis/klara-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/klara/apis/klara-public-api/revisions/490b1a879fc2?raw)