Skip to content
Authrim

Create elevation subject token

POST
/api/admin/approvals/{requestId}/grants/{grantId}/subject-token
Code sample: Shell / cURL 
curl --request POST \
  --url https://auth.example.com/api/admin/approvals/example/grants/example/subject-token \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "client_id": "admin-support-tool", "expires_in": 600 }'

Issues a short-lived subject token for OAuth token exchange from an active elevation grant.

Authorizations

Section titled “Authorizations ”

Parameters

Section titled “ Parameters ”

Path Parameters

Section titled “Path Parameters ”
requestId
required
string

Public approval request ID.

grantId
required
string

Public elevation grant ID.

Request Body required

Section titled “Request Body required ”
Media type application/json
object
client_id
required
string
expires_in
integer
>= 60 <= 1800
key
additional properties
Example 
{
  "client_id": "admin-support-tool",
  "expires_in": 600
}

Responses

Section titled “ Responses ”

200

Section titled “200 ”

Subject token for OAuth token exchange.

Media type application/json
object
grant_id
required
string
request_id
required
string
investigation_id
required
string
subject_token
required
string
subject_token_type
required
string
expires_in
required
integer
authorization_details
required
Array<object>
object
key
additional properties
token_exchange_hint
required
object
key
additional properties
integration_hint
required
object
key
additional properties
key
additional properties
Example 
{
  "grant_id": "grant_123",
  "request_id": "apreq_123",
  "investigation_id": "case_123",
  "subject_token": "subtok_redacted",
  "subject_token_type": "urn:authrim:params:oauth:token-type:elevation-grant",
  "expires_in": 600,
  "authorization_details": [
    {
      "type": "authrim_elevation",
      "resource_class": "approval_transport_detail",
      "resource_ids": [
        "apreq_123"
      ],
      "actions": [
        "detail_read"
      ]
    }
  ],
  "token_exchange_hint": {
    "grant_type": "urn:ietf:params:oauth:grant-type:token-exchange",
    "subject_token_type": "urn:authrim:params:oauth:token-type:elevation-grant",
    "requested_token_type": "urn:ietf:params:oauth:token-type:access_token",
    "client_id": "admin-support-tool"
  },
  "integration_hint": {
    "audience": "admin_api"
  }
}

409

Section titled “409 ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

default

Section titled “default ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}