OPopenobserve
Organizations

Assume a service account in a target organization

This endpoint allows meta service accounts to obtain temporary session tokens for accessing a target organization as a specific service account. The session automatically expires after the specified duration.

Security

  • Only meta service accounts can call this endpoint
  • The service account must exist in both _meta and target organization
  • The service account must have the appropriate role in the target organization
  • Maximum session duration is capped at 24 hours

Example

curl -X POST http://localhost:5080/api/_meta/assume_service_account \
  -H "Authorization: Bearer <meta_sa_token>" \
  -H "Content-Type: application/json" \
  -d '{
    "org_id": "customer1",
    "service_account": "tenant_admin_sa",
    "duration_seconds": 3600
  }'
post/api/{org_id}/organizations/assume_service_account

Request

Path parameters

org_idstring required

Organization name (must be _meta)

Request body

duration_secondsinteger nullable

Optional duration in seconds (default: 3600, max: 86400)

org_idstring required

Target organization ID

service_accountstring nullable

Service account email to assume (optional, defaults to caller's user_id)

Response

Session created successfully

expires_atstring required

Expiration timestamp (ISO 8601)

expires_ininteger required

Duration in seconds until expiration

org_idstring required

Target organization ID

role_namestring required

Assumed service account role

session_idstring required

Session ID to use for authentication

Changes

No recorded changes to this operation across all 1 revision of this API.