create_access_token¶

AccessTokensApi.create_access_token(access_token_input, role_id=None, _request_timeout=None, _request_auth=None, _content_type=None, _headers=None, _host_index=0)¶

Create an access token

Creates a personal access token (PAT) for the calling user. The request must use a valid Cognito session token; a PAT cannot be used to create another PAT. The user must be active and have access to the specified role. On success, returns Message, AccessToken, and AccessTokenId.

Parameters:

access_token_input (AccessTokenInput) – (required)
role_id (str) – Amorphic role ID header.
_request_timeout (int, tuple(int, int), optional) – timeout setting for this request. If one number provided, it will be total request timeout. It can also be a pair (tuple) of (connection, read) timeouts.
_request_auth (dict, optional) – set to override the auth_settings for an a single request; this effectively ignores the authentication in the spec for a single request.
_content_type (str, Optional) – force content-type for the request.
_headers (dict, optional) – set to override the headers for a single request; this effectively ignores the headers in the spec for a single request.
_host_index (int, optional) – set to override the host_index for a single request; this effectively ignores the host_index in the spec for a single request.

Return type:

AccessTokenPostOutput

Returns:

Returns the result object.

Request and Response Examples¶

HTTP: POST /access-tokens

Request¶

Request / response example

{
  "Name": "ci-bot",
  "Description": "CI pipeline access",
  "ExpiresOn": 1780000000000,
  "RoleId": "role-123",
  "ExpirationAlertOne": 7,
  "ExpirationAlertTwo": 2
}

Success (HTTP 200)¶

Token created successfully. Message is either “Successfully created access token” or “Successfully created access token for service user”. AccessToken contains the JWT and is returned only once. AccessTokenId contains the token ID.

Cognito-session create

{
  "Message": "Successfully created access token",
  "AccessToken": "eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9...",
  "AccessTokenId": "a2f7d3b1-8e5c-4a6f-9d1e-2b3c4d5e6f7a"
}

Service-user PAT

{
  "Message": "Successfully created access token for service user",
  "AccessToken": "eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9...",
  "AccessTokenId": "c3d8e4f2-9a6b-5c7d-0e1f-3a4b5c6d7e8f"
}

Errors¶

Documented error codes: IPV-1001, GE-1034, AUTH-1003, AUTH-1012, IPV-1036, IPV-1012, IPV-1008, DB-1001, RTE-1001, EMF-1001.

HTTP 400

Validation or authorization failure. Body is {“Message”: “<CODE> - <text>”}. Common codes: IPV-1001 (empty field), GE-1034 (expiry in past/invalid), AUTH-1003 (no role access), AUTH-1012 (inactive user), IPV-1036 / IPV-1012 / IPV-1008 (alert day validation), DB-1001 (DynamoDB put failed).

Empty required field

{
  "Message": "IPV-1001 - Name cannot be empty"
}

ExpiresOn in the past

{
  "Message": "GE-1034 - Token expiry cannot be in the past"
}

Caller lacks RoleId access

{
  "Message": "AUTH-1003 - User is not authorized to use role - role-123"
}

User inactive

{
  "Message": "AUTH-1012 - User user1 is inactive."
}

ExpirationAlertTwo not smaller than One

{
  "Message": "IPV-1036 - Invalid parameter - ExpirationAlertTwo, value should be smaller than first alert days"
}

HTTP 500

Backend failure, or creating a PAT with another PAT (Message “Access tokens cannot be created using another access token”). Other failures typically RTE-1001 via EMF-1001. Missing required body keys may KeyError into 500.

Created using another access token

{
  "Message": "Access tokens cannot be created using another access token"
}

Unexpected failure

{
  "Message": "RTE-1001 - <exception text>"
}