STS

Assume a role on an org and receive a scoped JWT

Assumes a single Org/* role on a single org and returns a short-lived JWT bound to both.

  • Requires action sts:AssumeRole on resource srn:sts::<org_uid>:<role_uid>
  • role_uid must be an Org/* role UID; Global/* roles are not assumable
  • TTL default is 1200 seconds (20m); max is 3600 seconds (1h)
  • The resulting token carries the assumed role on the assumed org only; onward assumption is gated by whether that role grants sts:AssumeRole
post/api/v1/sts/assumerole

Request

  • Base URL: https://api.prod.spyderbat.com
  • URL: https://api.prod.spyderbat.com/api/v1/sts/assumerole
  • Auth: HTTP bearer

Request body

correlation_idstring

Audit/tracing identifier for this assumption (alphanumeric, max 64 chars)

org_uidstring required

UID of the org the scoped token will be locked to

role_uidstring required

UID of the Org/* role the scoped token will carry

ttl_secondsinteger

Requested lifetime in seconds. Clamped to [60, 3600]; 0 or unset applies the default (1200)

Response

OK

expires_atinteger

Unix timestamp (seconds) at which the token expires.

tokenstring

Signed scoped JWT. Present in the Authorization header as 'Bearer <token>' on subsequent requests.

Changes

No recorded changes to this operation across all 1 revision of this API.