Issue a short-lived JWT for a single modular-service audience
POST
/api/v4/token_exchange
Issues a short-lived RS256 JWT scoped to one modular-service audience (such as the Artifact Registry). Claims include the requesting user id (sub), organization id, and deployment realm (saas / self-managed). Presented to the corresponding backend and verified against the instance JWKS.
Authorizations
Section titled “Authorizations”Request Bodyrequired
Section titled “Request Bodyrequired”Media typeapplication/json
object
audience
required
Target service audience (e.g. gitlab-artifact-registry)
string
expires_in
Requested token lifetime in seconds. Defaults to 300; cap is 43200. Pending appsec review of client-controlled TTL.
integer
Responses
Section titled “Responses”Created
Bad Request
Unauthorized
Not Found