Exchange a signed external principal for a platform session credential
POST
/v1/internal/principal-sessionsInternal platform-BFF endpoint. The caller presents a short-lived, audience-bound principal assertion. The resulting API credential is time-bounded and must never be exposed to browser JavaScript.
How to call this endpoint
Every ACP API request uses bearer authentication. The examples here show the actual request path, auth header, and body shape that the platform expects.
Path, query, and header parameters
These parameters control which ACP object the endpoint acts on and how the request is processed.
Path parameters
None.
Query parameters
None.
Body schema
Content type: application/json · Optional
| Field | Type | Required | Description |
|---|---|---|---|
| ttlSeconds | integer | No | — |
What the API returns
Each response code below includes the documented payload shape for the ACP API.
201Principal and workload credential resolvedapplication/json
| Field | Type | Required | Description |
|---|---|---|---|
| profile | object | Yes | — |
| profile.userId | string | Yes | User ID. |
| profile.email | string | No | — |
| profile.displayName | string | No | — |
| profile.photoURL | string | No | — |
| profile.emailVerified | boolean | No | — |
| profile.identityLinkId | string | No | — |
| profile.identityProvider | oidc | firebase | Yes | — |
| profile.identityIssuer | string | Yes | — |
| subscription | object | Yes | — |
| subscription.tier | string | No | — |
| subscription.status | string | No | Current lifecycle status. |
| credential | object | Yes | — |
| credential.id | string | Yes | Unique identifier. |
| credential.key | string | Yes | — |
| credential.expiresAt | string | Yes | — |
401Principal assertion required
None.
403Principal assertion invalid or expired
None.
Exchange a signed external principal for a platform session credential
Loading...
Response 201
Loading...