Mint access token

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    grant_type: 'authorization_code',
    code: '<string>',
    redirect_uri: '<string>',
    scope_narrowing: {scopeId: 'proj-abc123', roles: ['member']}
  })
};

fetch('https://api.k0rdent.ai/v1/regions/global/auth/token', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.k0rdent.ai/v1/regions/global/auth/token"

	payload := strings.NewReader("{\n  \"grant_type\": \"authorization_code\",\n  \"code\": \"<string>\",\n  \"redirect_uri\": \"<string>\",\n  \"scope_narrowing\": {\n    \"scopeId\": \"proj-abc123\",\n    \"roles\": [\n      \"member\"\n    ]\n  }\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

curl --request POST \
  --url https://api.k0rdent.ai/v1/regions/global/auth/token \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "grant_type": "authorization_code",
  "code": "<string>",
  "redirect_uri": "<string>",
  "scope_narrowing": {
    "scopeId": "proj-abc123",
    "roles": [
      "member"
    ]
  }
}
'

import requests

url = "https://api.k0rdent.ai/v1/regions/global/auth/token"

payload = {
    "grant_type": "authorization_code",
    "code": "<string>",
    "redirect_uri": "<string>",
    "scope_narrowing": {
        "scopeId": "proj-abc123",
        "roles": ["member"]
    }
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

{
  "access_token": "<string>",
  "token_type": "Bearer",
  "expires_in": 900,
  "refresh_token": "<string>"
}

{
  "error": {
    "code": 123,
    "message": "<string>",
    "details": [
      {}
    ]
  }
}

{
  "error": {
    "code": 123,
    "message": "<string>",
    "details": [
      {}
    ]
  }
}

{
  "error": {
    "code": 123,
    "message": "<string>",
    "details": [
      {}
    ]
  }
}

{
  "error": {
    "code": 123,
    "message": "<string>",
    "details": [
      {}
    ]
  }
}

token

Mint access token

Visibility: public · internal ( OpenAPI Custom Extension: x-visibility )

Exchange a credential for a self-contained JWT access token. This endpoint proxies to the underlying identity provider for token issuance.

Three grant types are supported:

authorization_code — Interactive user session. Exchanges an authorization code obtained from the OAuth2 /authorize flow.

api_key — Programmatic access via an API key. The caller presents the opaque, prefixed API key token. Effective privileges are evaluated as the intersection of the key’s role list (if set) and the creating user’s current roles within the key’s scope.

client_credentials — Service account authentication. The caller presents a client_id and client_secret pair. Effective privileges are the service account’s directly assigned roles within its scope.

All grant types support optional scope narrowing at mint time: the caller can request a narrower scope and/or a subset of roles for the issued token. The requested scope must be at or below the credential’s scope in the resource hierarchy, and the requested roles must be a subset of the credential’s effective roles.

POST

regions

global

auth

token

Mint access token

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    grant_type: 'authorization_code',
    code: '<string>',
    redirect_uri: '<string>',
    scope_narrowing: {scopeId: 'proj-abc123', roles: ['member']}
  })
};

fetch('https://api.k0rdent.ai/v1/regions/global/auth/token', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.k0rdent.ai/v1/regions/global/auth/token"

	payload := strings.NewReader("{\n  \"grant_type\": \"authorization_code\",\n  \"code\": \"<string>\",\n  \"redirect_uri\": \"<string>\",\n  \"scope_narrowing\": {\n    \"scopeId\": \"proj-abc123\",\n    \"roles\": [\n      \"member\"\n    ]\n  }\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

curl --request POST \
  --url https://api.k0rdent.ai/v1/regions/global/auth/token \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "grant_type": "authorization_code",
  "code": "<string>",
  "redirect_uri": "<string>",
  "scope_narrowing": {
    "scopeId": "proj-abc123",
    "roles": [
      "member"
    ]
  }
}
'

import requests

url = "https://api.k0rdent.ai/v1/regions/global/auth/token"

payload = {
    "grant_type": "authorization_code",
    "code": "<string>",
    "redirect_uri": "<string>",
    "scope_narrowing": {
        "scopeId": "proj-abc123",
        "roles": ["member"]
    }
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

{
  "access_token": "<string>",
  "token_type": "Bearer",
  "expires_in": 900,
  "refresh_token": "<string>"
}

{
  "error": {
    "code": 123,
    "message": "<string>",
    "details": [
      {}
    ]
  }
}

{
  "error": {
    "code": 123,
    "message": "<string>",
    "details": [
      {}
    ]
  }
}

{
  "error": {
    "code": 123,
    "message": "<string>",
    "details": [
      {}
    ]
  }
}

{
  "error": {
    "code": 123,
    "message": "<string>",
    "details": [
      {}
    ]
  }
}

Authorizations

Authorization

string

header

required

Bearer token authentication using OAuth2/OIDC tokens

Body

application/json

Option 1
Option 2
Option 3

grant_type

enum<string>

required

Available options:

authorization_code

code

string

required

Authorization code from the OAuth2 /authorize flow.

redirect_uri

string<uri>

required

Redirect URI that was used in the authorization request. Must match exactly.

scope_narrowing

object

Optional scope narrowing for the minted token. When provided, the issued JWT will have a narrower scope and/or fewer roles than the credential's effective privileges. The requested scope must be at or below the credential's scope level in the hierarchy (org > project), and the requested roles must be a subset of the effective roles.

Show child attributes

Response

Token successfully minted.

access_token

string

required

Self-contained JWT access token. Contains claims for sub, iss, aud, exp, iat, jti, tenant_id, scope, scope_id, roles, and principal_type.

token_type

enum<string>

required

Token type. Always "Bearer".

Available options:

Bearer

expires_in

integer

required

Token lifetime in seconds.

Example:

900

refresh_token

string

Refresh token for obtaining new access tokens without re-authentication. Only issued for the authorization_code grant type. Not issued for api_key or client_credentials grants.

Platform APIs

Shared API Spec

Apps Team APIs Dev

Draft APIs

Archived APIs

Mint access token

Authorizations

Body

Response