---
# @generated by sylphx-gen. Do not edit.
title: "Exchange read token on a trust policy"
description: "`broker.trust_policies.exchange_read_token` (POST /v1/{name}:exchangeReadToken): Exchanges the caller's Access grant for a read-only GitHub App installation token."
type: reference
product: platform
summary: "Exchanges the caller's Access grant for a read-only GitHub App installation token."
updated: 2026-09-28
nav: false
---

Exchanges the caller's Access grant for a read-only GitHub App installation token. Requires the explicit `broker:exchange:read` scope on this policy, with the same subject, actor, Connection and repository checks as ExchangeToken. Every resolved permission must be read-only: omitting permissions inherits the policy and is refused if it has writes. The provider's returned permissions must confirm the requested ceiling. Writes one TokenExchange audit record; `broker:read` cannot issue tokens.

- **Path** `POST https://api.sylphx.com/v1/orgs/acme/trust_policies/trust-policy:exchangeReadToken`
- **Scope** `broker:exchange:read`
- **Effect** `write` — a successful call changes state.
- **Collection** [trust_policies](/docs/api/trust_policies)

## Request

| Field | Type | What it is |
| --- | --- | --- |
| `name` | `string` | The trust policy to exchange under. Required. |
| `permissions` | `map<string, string>` | The permissions this call needs, at most the policy's; empty means the policy's. Every resolved permission must be read-only. |
| `repositories` | `string[]` | The one repository this call needs, `owner/name`, one of the policy's. Required. |
| `ttl` | `duration` | How long the credential should live, at most the policy's `max_ttl`. A GitHub installation token always lives one hour: unset or `3600s`. |

## Response

| Field | Type | What it is |
| --- | --- | --- |
| `token` | `string` | The provider credential. Never logged, persisted, or cached by the caller beyond `expire_time`. Never returned again. |
| `credential_kind` | `CredentialKind` | What `token` is. One of `access_token`, `runner_registration`, `vapid_assertion`. |
| `expire_time` | `timestamp` | When the credential stops working. |
| `permissions` | `map<string, string>` | The permissions the credential carries. |
| `repositories` | `string[]` | The one repository the credential covers. |
| `token_exchange` | `string` | The record of this credential, `orgs/{org}/trust_policies/{trust_policy}/token_exchanges/{token_exchange}`: the name to revoke it by. |
| `connection` | `string` | The Connection the credential was issued on, the policy's. |
| `issuer` | `string` | The provider identity that signed the credential: for GitHub, `github-apps/{app_id}` of the installation it was minted against. |

## Errors

- [`UNAUTHENTICATED`](/docs/api/errors/UNAUTHENTICATED) — No valid key or token was presented.
- [`PERMISSION_DENIED`](/docs/api/errors/PERMISSION_DENIED) — The key lacks the method's permission.
- [`RESOURCE_NOT_FOUND`](/docs/api/errors/RESOURCE_NOT_FOUND) — The named Resource does not exist or is not visible.
- [`INVALID_FIELD`](/docs/api/errors/INVALID_FIELD) — A field failed validation.
- [`INVALID_STATE`](/docs/api/errors/INVALID_STATE) — The Resource is in a state that forbids the call.
- [`RATE_LIMITED`](/docs/api/errors/RATE_LIMITED) — The rate limit is reached; see Retry-After.
- [`UNAVAILABLE`](/docs/api/errors/UNAVAILABLE) — The Resource store, the owning service's backend, or the key verifier's snapshot is unavailable; retry after Retry-After.

Every error arrives in the body [Errors](/docs/platform/errors) describes.

## Examples

**cURL**

```curl
curl -X POST "https://api.sylphx.com/v1/orgs/acme/trust_policies/trust-policy:exchangeReadToken" \
  -H "Authorization: Bearer $SYLPHX_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"repositories":["…"]}'
```

**TypeScript**

```ts
const response = await sylphx.broker.trustPolicies.exchangeReadToken({ name: 'orgs/acme/trust_policies/trust-policy', repositories: ['…'] })
```

**Rust**

```rust
let mut req = sylphx::broker::ExchangeReadTokenRequest::default();
req.name = "orgs/acme/trust_policies/trust-policy".to_string();
req.repositories = vec!["…".to_string()];
let response = sx.broker().trust_policies().exchange_read_token(req).await?;
```

**CLI**

```bash
sylphx broker trust-policies exchange-read-token orgs/acme/trust_policies/trust-policy
```

**MCP**

```json
{ "method_id": "broker.trust_policies.exchange_read_token", "args": {"name":"orgs/acme/trust_policies/trust-policy","repositories":["…"]} }
```