---
title: "Exchange OIDC ID token for ephemeral service account access token"
method: POST
path: "/service-accounts/assume"
tags: ["access-tokens-public"]
---

# Exchange OIDC ID token for ephemeral service account access token

`POST /service-accounts/assume`

## Request

- Base URL: `https://example.scalr.io/api/iacp/v3`
- URL: `https://example.scalr.io/api/iacp/v3/service-accounts/assume`
- Auth: HTTP bearer

This endpoint creates service account's access token.

## Request body

- AssumeServiceAccountRequest: An assume service account request.
  - `id-token` string, required
  - `lifetime` integer
  - `service-account-email` string, required

## Response `200`

Successfully exchanged.

- ServiceAccountTemporaryToken
  - `access-token` string
  - `expire-time` string, date-time

## Other responses

- `401`: Service account not found, or identity unauthorized to perform action.
- `4XX`: Client error.
- `5XX`: Server error.

---

[API](https://skmtc.dev/scalr/apis/scalr-iacp-api.md) - [All operations](https://skmtc.dev/scalr/apis/scalr-iacp-api/llms.txt) - [OpenAPI document](https://skmtc.dev/scalr/apis/scalr-iacp-api/revisions/d3e1dc85657a?raw)