Request Syntax URI Request Parameters Request Body Response Syntax Response Elements Errors See Also

CreateOAuth2TokenWithTokenExchange

Exchanges a supported token for an OAuth 2.0 access token scoped to a resource, which you can use to access AWS services from applications.

The issued access token is valid for up to 1 hour (3600 seconds).

Request Syntax


POST /v1/token?x-amz-oauth-token-method=token-exchange HTTP/1.1
Content-type: application/json

{
   "grant_type": "string",
   "resource": "string",
   "scope": "string",
   "subject_token": "string",
   "subject_token_type": "string"
}

URI Request Parameters

The request does not use any URI parameters.

Request Body

The request accepts the following data in JSON format.

grant_type

The OAuth 2.0 grant type. Currently only supports urn:ietf:params:oauth:grant-type:token-exchange.

Type: String

Pattern: urn:ietf:params:oauth:grant-type:token-exchange

Required: Yes

resource

The OAuth resource for which the access token is requested. Required when grant_type=urn:ietf:params:oauth:grant-type:token-exchange. Example: glue.amazonaws.com.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 2048.

Required: No

scope

IAM managed policy Amazon Resource Names (ARNs) to apply as session policies that further scope down the permissions of the issued access token, provided as a space-delimited list.

Example: arn:aws:iam::444455556666:policy/MyPolicy.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 4096.

Required: No

subject_token

The subject token that represents the identity of the party on whose behalf the request is made. Required when grant_type=urn:ietf:params:oauth:grant-type:token-exchange.

Type: String

Length Constraints: Minimum length of 4. Maximum length of 20000.

Required: No

subject_token_type

The token type of the subject token. Currently only supports urn:ietf:params:oauth:token-type:jwt. Required when grant_type=urn:ietf:params:oauth:grant-type:token-exchange.

Type: String

Pattern: urn:ietf:params:oauth:token-type:.+

Required: No

Response Syntax


HTTP/1.1 200
Content-type: application/json

{
   "access_token": "string",
   "expires_in": number,
   "issued_token_type": "string",
   "token_type": "string"
}

Response Elements

If the action is successful, the service sends back an HTTP 200 response.

The following data is returned in JSON format by the service.

access_token

Access token containing principal identity, resource scope, and session metadata. Use this token as a Bearer token when accessing the target resource.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 4096.

expires_in

Token lifetime in seconds. Value is the minimum of the subject token's validity and 1 hour (3600 seconds).

Type: Integer

Valid Range: Minimum value of 1. Maximum value of 3600.

issued_token_type

The token type of the issued token. Always urn:ietf:params:oauth:token-type:access_token as defined in RFC 8693 §2.2.1.

Type: String

Pattern: urn:ietf:params:oauth:token-type:access_token

token_type

The token type. Currently only supports Bearer as defined in RFC 6749.

Type: String

Pattern: Bearer

Errors

For information about the errors that are common to all actions, see Common Error Types.

InternalServerException

The request failed because of an internal server error.

HTTP Status Code: 500

InvalidGrantException

The request failed because the provided grant is invalid or expired.

HTTP Status Code: 400

InvalidScopeException

The request failed because the requested scope is invalid or exceeds the scope that can be granted.

HTTP Status Code: 400

ServiceUnavailableException

The request failed because a dependency is temporarily unavailable. You can retry the request.

HTTP Status Code: 503

TooManyRequestsError

The request failed because you exceeded the request rate limit for this operation.

HTTP Status Code: 429

ValidationException

The request failed because it contains a malformed, missing, or invalid parameter.

HTTP Status Code: 400