---
title: "Assume a service account in a target organization"
method: POST
path: "/api/{org_id}/organizations/assume_service_account"
tags: ["Organizations"]
---

# Assume a service account in a target organization

`POST /api/{org_id}/organizations/assume_service_account`

## Request

- Base URL: `https://api.openobserve.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.openobserve.ai/api/{org_id}/organizations/assume_service_account`
- Auth: API key in header `Authorization`
- TypeScript: <https://skmtc.dev/openobserve/apis/openobserve-api-http/docs/api/:org_id/organizations/assume_service_account/post.ts> (a function with typed inputs; its response is checked against the schema)

This endpoint allows meta service accounts to obtain temporary session tokens
for accessing a target organization as a specific service account. The session
automatically expires after the specified duration.

# Security
- Only meta service accounts can call this endpoint
- The service account must exist in both _meta and target organization
- The service account must have the appropriate role in the target organization
- Maximum session duration is capped at 24 hours

# Example
```bash
curl -X POST http://localhost:5080/api/_meta/assume_service_account \
  -H "Authorization: Bearer <meta_sa_token>" \
  -H "Content-Type: application/json" \
  -d '{
    "org_id": "customer1",
    "service_account": "tenant_admin_sa",
    "duration_seconds": 3600
  }'
```

## Path parameters

- `org_id` string, required

## Request body

- AssumeServiceAccountRequest: Request to assume a service account in a target organization This allows meta service accounts to obtain temporary session tokens for accessing a target organization as a specific service account.
  - `duration_seconds` integer, nullable: Optional duration in seconds (default: 3600, max: 86400)
  - `org_id` string, required: Target organization ID
  - `service_account` string, nullable: Service account email to assume (optional, defaults to caller's user_id)

## Response `200`

Session created successfully

- AssumeServiceAccountResponse: Response from assume service account operation Contains the session credentials needed to access the target organization.
  - `expires_at` string, required: Expiration timestamp (ISO 8601)
  - `expires_in` integer, required: Duration in seconds until expiration
  - `org_id` string, required: Target organization ID
  - `role_name` string, required: Assumed service account role
  - `session_id` string, required: Session ID to use for authentication

## Other responses

- `400`: Invalid request
- `403`: Not authorized or service account not assigned
- `500`: Internal server error
- `501`: Not available in non-enterprise builds

---

[API](https://skmtc.dev/openobserve/apis/openobserve-api-http.md) - [All operations](https://skmtc.dev/openobserve/apis/openobserve-api-http/llms.txt) - [OpenAPI document](https://skmtc.dev/openobserve/apis/openobserve-api-http/revisions/0529b8a10252?raw)