---
# @generated by sylphx-gen. Do not edit.
title: "Token exchanges"
description: "The `token_exchanges` collection of Sylphx Broker: A TokenExchange is the record of one credential the Broker issued under a TrustPolicy: who asked, for which Agent, on which repository, with which permissions, until when."
type: reference
product: platform
summary: "A TokenExchange is the record of one credential the Broker issued under a TrustPolicy: who asked, for which Agent, on which repository, with…"
updated: 2026-09-28
order: 900
---

A TokenExchange is the record of one credential the Broker issued under a TrustPolicy: who asked, for which Agent, on which repository, with which permissions, until when. The credential itself is never returned again; the record keeps only its SHA-256. The Broker holds the credential sealed until it is revoked or expires, so `:revoke` needs nothing from the caller.

**Service** Sylphx Broker · **Resource type** `broker.sylphx.com/TokenExchange` · **Name pattern** `orgs/{org}/trust_policies/{trust_policy}/token_exchanges/{token_exchange}` · **Shape** `record`

## Fields

| Field | Type | What it is |
| --- | --- | --- |
| `name` | `string` | `orgs/{org}/trust_policies/{trust_policy}/token_exchanges/{token_exchange}`. |
| `uid` | `string` | `tkx_<cell><ulid>`; also the `{token_exchange}` id. Output only. |
| `meta` | `ResourceMeta` | Resource metadata. |
| `subject` | `string` | The accountable principal, `orgs/{org}/principals/{id}`. Output only. |
| `actor` | `string` | The Agent the subject's delegated grant acted for; empty when the subject exchanged for itself. Output only. |
| `repository` | `string` | The one repository the credential covers, `owner/name`. Output only. |
| `permissions` | `map<string, string>` | The permissions the credential carries. Output only. |
| `credential_kind` | `CredentialKind` | What the credential is. Output only. One of `access_token`, `runner_registration`. |
| `create_time` | `timestamp` | When it was issued. Output only. |
| `expire_time` | `timestamp` | When the provider stops honoring it. Output only. |
| `revoke_time` | `timestamp` | When the provider confirmed it revoked; unset while live or when it simply expired. Output only. |
| `token_sha256` | `string` | Lowercase hex SHA-256 of the credential, to match a credential seen elsewhere to its record. Output only. |
| `connection` | `string` | The Connection the credential was issued on. Output only. |
| `issuer` | `string` | The provider identity that signed it: for GitHub, `github-apps/{app_id}`. Output only. |

## Methods

Every method of the collection, in the registry's order, with the scope it
needs. The full request, response and examples are one link away.

| Method | Call | What it does |
| --- | --- | --- |
| `GET` | [`get`](/docs/api/token_exchanges#get) | Gets the record of one issued credential. |
| `GET` | [`list`](/docs/api/token_exchanges#list) | Lists the credentials issued under a trust policy, newest first. |
| `POST` | [`revoke`](/docs/api/token_exchanges#revoke) | Revokes an issued credential at the provider by its record. The Broker uses the credential it holds sealed, so the caller needs no token and no live delegation. Idempotent: a credential already revoked or expired answers the record. Erases the sealed credential once the provider confirms. |

## get

Gets the record of one issued credential.

`GET https://api.sylphx.com/v1/orgs/acme/trust_policies/trust-policy/token_exchanges/token-exchange` · scope `broker:read` · effect `read` · [Request, response and examples](/docs/api/token_exchanges/get)

## list

Lists the credentials issued under a trust policy, newest first.

`GET https://api.sylphx.com/v1/orgs/acme/trust_policies/trust-policy/token_exchanges` · scope `broker:read` · effect `read` · paginated · [Request, response and examples](/docs/api/token_exchanges/list)

## revoke

Revokes an issued credential at the provider by its record. The Broker uses the credential it holds sealed, so the caller needs no token and no live delegation. Idempotent: a credential already revoked or expired answers the record. Erases the sealed credential once the provider confirms.

`POST https://api.sylphx.com/v1/orgs/acme/trust_policies/trust-policy/token_exchanges/token-exchange:revoke` · scope `broker:read` · effect `destructive` · [Request, response and examples](/docs/api/token_exchanges/revoke)