Menu
Platform
AI
Alerts and status pages
App store purchases
Credits
Generated Assets
Knowledge
KV
Localization
Notifications
Organizations
Payments
Queues
Realtime
Sandboxes
Storage
Workflows
API reference
- Overview
- Access API keys
- Agent sessions API
- Agent versions API
- Agents API
- AI models API
- Artifacts API
- Assets API
- Auth configs API
- Bank receipts API
- Bank transfer accounts API
- Buckets API
- Builds API
- Catalogs API
- Chat profiles API
- Chat reports API
- Chat sticker packs API
- Checkout policies API
- Checkout sessions API
- Config changes API
- Config flags API
- Config segments API
- Connection providers API
- Connections API
- Connectors API
- Credit grants API
- Customer organizations API
- Customer subscriptions API
- Databases API
- Documents API
- Email domains API
- End users API
- Entities API
- Entitlement grants API
- Entries API
- Environments API
- Episodes API
- Error events API
- Error groups API
- Events API
- Exchange rates API
- Generations API
- Glossaries API
- Goals API
- Identities API
- Inbound emails API
- Inbound endpoints API
- Inbound sms API
- Invitations API
- Job runs API
- Jobs API
- Knowledge schemas API
- KV API
- KV namespaces API
- Lease events API
- Leases API
- Licence keys API
- Licence tokens API
- Mail domains API
- Mail routes API
- Mailbox connect links API
- Mailbox OAUTH apps API
- Mailboxes API
- Memberships API
- Memories API
- Memory stores API
- Merchant accounts API
- Message topics API
- Messages API
- OAUTH clients API
- Objects API
- Organization roles API
- Owner pools API
- Phone numbers API
- Portal sessions API
- Preferences API
- Price catalogs API
- Processor events API
- Projects API
- Queued executions API
- Queues API
- Realtime channels API
- Realtime members API
- Realtime messages API
- Recipients API
- Relations API
- Releases API
- Revenue API
- Revenue facts API
- Revenue sources API
- Runs API
- Sandbox shapes API
- Schedules API
- Scrubbing policies API
- Search API
- Search indexes API
- Secret versions API
- Secrets API
- Service enablements API
- Service observations API
- Services API
- Serving routes API
- Session events API
- Sessions API
- Signing key versions
- Signing keys
- Sms numbers API
- Source maps API
- Spaces API
- Store connections API
- Store purchases API
- Subscriptions API
- Suppressions API
- Tax threshold statuses API
- Templates API
- Test clocks API
- Token exchanges API
- Transfers API
- Trust policies API
- Trusted issuers API
- Uptime checks API
- Uptime manifests API
- Uptime sources API
- Usage events API
- Usage invoices API
- Usage meter prices API
- Usage meters API
- Usage reservations API
- Usage settings API
- Usage tiers API
- Volumes API
- Waits API
- Webhook deliveries API
- Webhook endpoints API
- Workflows API
Getting Started
Authentication
KV Store
Deploy & Infrastructure
Reference
Exchange read token on a trust policy
Exchanges the caller's Access grant for a read-only GitHub App installation token.
Exchanges the caller's Access grant for a read-only GitHub App installation token. Requires the explicit broker:exchange:read scope on this policy, with the same subject, actor, Connection and repository checks as ExchangeToken. Every resolved permission must be read-only: omitting permissions inherits the policy and is refused if it has writes. The provider's returned permissions must confirm the requested ceiling. Writes one TokenExchange audit record; broker:read cannot issue tokens.
- Path
POST https://api.sylphx.com/v1/orgs/acme/trust_policies/trust-policy:exchangeReadToken - Scope
broker:exchange:read - Effect
write— a successful call changes state. - Collection trust_policies
#Request
| Field | Type | What it is |
|---|---|---|
name | string | The trust policy to exchange under. Required. |
permissions | map<string, string> | The permissions this call needs, at most the policy's; empty means the policy's. Every resolved permission must be read-only. |
repositories | string[] | The one repository this call needs, owner/name, one of the policy's. Required. |
ttl | duration | How long the credential should live, at most the policy's max_ttl. A GitHub installation token always lives one hour: unset or 3600s. |
#Response
| Field | Type | What it is |
|---|---|---|
token | string | The provider credential. Never logged, persisted, or cached by the caller beyond expire_time. Never returned again. |
credential_kind | CredentialKind | What token is. One of access_token, runner_registration, vapid_assertion. |
expire_time | timestamp | When the credential stops working. |
permissions | map<string, string> | The permissions the credential carries. |
repositories | string[] | The one repository the credential covers. |
token_exchange | string | The record of this credential, orgs/{org}/trust_policies/{trust_policy}/token_exchanges/{token_exchange}: the name to revoke it by. |
connection | string | The Connection the credential was issued on, the policy's. |
issuer | string | The provider identity that signed the credential: for GitHub, github-apps/{app_id} of the installation it was minted against. |
#Errors
UNAUTHENTICATED— No valid key or token was presented.PERMISSION_DENIED— The key lacks the method's permission.RESOURCE_NOT_FOUND— The named Resource does not exist or is not visible.INVALID_FIELD— A field failed validation.INVALID_STATE— The Resource is in a state that forbids the call.RATE_LIMITED— The rate limit is reached; see Retry-After.UNAVAILABLE— The Resource store, the owning service's backend, or the key verifier's snapshot is unavailable; retry after Retry-After.
Every error arrives in the body Errors describes.
#Examples
curl -X POST "https://api.sylphx.com/v1/orgs/acme/trust_policies/trust-policy:exchangeReadToken" \
-H "Authorization: Bearer $SYLPHX_API_KEY" \
-H "Content-Type: application/json" \
-d '{"repositories":["…"]}'