Reference

Token exchanges

A TokenExchange is the record of one credential the Broker issued under a TrustPolicy: who asked, for which Agent, on which repository, with…

Checked 2026-09-28

A TokenExchange is the record of one credential the Broker issued under a TrustPolicy: who asked, for which Agent, on which repository, with which permissions, until when. The credential itself is never returned again; the record keeps only its SHA-256. The Broker holds the credential sealed until it is revoked or expires, so :revoke needs nothing from the caller.

Service Sylphx Broker · Resource type broker.sylphx.com/TokenExchange · Name pattern orgs/{org}/trust_policies/{trust_policy}/token_exchanges/{token_exchange} · Shape record

#Fields

Field	Type	What it is
name	string	orgs/{org}/trust_policies/{trust_policy}/token_exchanges/{token_exchange}.
uid	string	tkx_<cell><ulid>; also the {token_exchange} id. Output only.
meta	ResourceMeta	Resource metadata.
subject	string	The accountable principal, orgs/{org}/principals/{id}. Output only.
actor	string	The Agent the subject's delegated grant acted for; empty when the subject exchanged for itself. Output only.
repository	string	The one repository the credential covers, owner/name. Output only.
permissions	map<string, string>	The permissions the credential carries. Output only.
credential_kind	CredentialKind	What the credential is. Output only. One of access_token, runner_registration.
create_time	timestamp	When it was issued. Output only.
expire_time	timestamp	When the provider stops honoring it. Output only.
revoke_time	timestamp	When the provider confirmed it revoked; unset while live or when it simply expired. Output only.
token_sha256	string	Lowercase hex SHA-256 of the credential, to match a credential seen elsewhere to its record. Output only.
connection	string	The Connection the credential was issued on. Output only.
issuer	string	The provider identity that signed it: for GitHub, github-apps/{app_id}. Output only.

#Methods

Every method of the collection, in the registry's order, with the scope it needs. The full request, response and examples are one link away.

Method	Call	What it does
GET	get	Gets the record of one issued credential.
GET	list	Lists the credentials issued under a trust policy, newest first.
POST	revoke	Revokes an issued credential at the provider by its record. The Broker uses the credential it holds sealed, so the caller needs no token and no live delegation. Idempotent: a credential already revoked or expired answers the record. Erases the sealed credential once the provider confirms.

#get

Gets the record of one issued credential.

GET https://api.sylphx.com/v1/orgs/acme/trust_policies/trust-policy/token_exchanges/token-exchange · scope broker:read · effect read · Request, response and examples

#list

Lists the credentials issued under a trust policy, newest first.

GET https://api.sylphx.com/v1/orgs/acme/trust_policies/trust-policy/token_exchanges · scope broker:read · effect read · paginated · Request, response and examples

#revoke

Revokes an issued credential at the provider by its record. The Broker uses the credential it holds sealed, so the caller needs no token and no live delegation. Idempotent: a credential already revoked or expired answers the record. Erases the sealed credential once the provider confirms.

POST https://api.sylphx.com/v1/orgs/acme/trust_policies/trust-policy/token_exchanges/token-exchange:revoke · scope broker:read · effect destructive · Request, response and examples