Issue a short-lived JWT for a single modular-service audience
POST
/api/v4/token_exchange
Issues a short-lived RS256 JWT scoped to one modular-service audience (such as the Artifact Registry). Claims include the requesting user id (sub), organization id, and deployment realm (saas / self-managed). Presented to the corresponding backend and verified against the instance JWKS.
Authorizations
Section titled “ Authorizations ”Request Body required
Section titled “ Request Body required ” Media type application/json
object
audience
required
Target service audience (e.g. gitlab-artifact-registry)
string
expires_in
Requested token lifetime in seconds. Defaults to 300; cap is 43200. Pending appsec review of client-controlled TTL.
integer
Responses
Section titled “ Responses ”Created
Bad Request
Unauthorized
Not Found