PUT/api/apis/{api_server_id}/delegated-token-policyAuthenticated

Set an API server's delegated-token policy

Sets whether the API server accepts delegated access tokens, whose RFC 8693 actor (act) claim names someone acting on behalf of the token's user (e.g. a client app's agent; the token's subject is still the user). The auth server mints a delegated token only for a registered API server that accepts them; every API server starts without. Resource servers see the actor as actor on route guards and principals and as act in introspection responses, and decide per operation what an actor may do. Hardcoded API servers cannot be changed and never accept delegated tokens.

operationId put_api_apis_api_server_id_delegated_token_policyAPI servers

Authentication & permissionsAuthenticated

Any authenticated user

Accepted credentials
Who may call
Any authenticated user
Notes
Organization owners/admins of the owning organization, the owning user, or platform administrators.

Path parameters

NameTypeDescription
api_server_id*string

API server id

Request body

Required

application/json
ApiServerDelegatedTokenPolicyUpdate
PropertyTypeDescription
accept_delegated_tokens*boolean

Whether the API server accepts delegated access tokens: tokens whose RFC 8693 actor (act) claim names someone acting on behalf of the user, e.g. a client app's agent. Turn it on only once the resource server runs @schemavaults/auth-server-sdk 0.39.0 or later (@schemavaults/jwt 0.16.0+): older versions reject any token carrying act.

JSONExample
"accept_delegated_tokens"true

Responses

application/json
ApiServerResponse
PropertyTypeDescription
success*true
api_server*ApiServerDefinition

An API server (resource server) registration: identity, listing visibility, ownership (platform / organization / user), dynamic-client policy, organization membership visibility and delegated-token policy.

api_server_id*string

minLength: 2maxLength: 64pattern: ^[a-z0-9_-]*$

api_server_name*string

maxLength: 64

api_server_description*string

maxLength: 512

created_at*number

minimum: 0

public*boolean
hardcoded*boolean
owner_type"platform" | "organization" | "user" | "dynamic-client-registration"
owner_organization_idstring | null | null
owner_uidstring (uuid) | null (uuid) | null
created_bystring (uuid) | null (uuid) | null
allow_dynamic_clientsboolean
resource_url_match_mode"exact" | "prefix"
organization_membership_visibility"owning_organization" | "all_organizations"
accept_delegated_tokensboolean
JSONExample
"success"true
"api_server"
"api_server_id""string"
"api_server_name""string"
"api_server_description""string"
"created_at"1.5
"public"true
"hardcoded"true
"owner_type""platform"
"owner_organization_id""string"
"owner_uid""123e4567-e89b-12d3-a456-426614174000"
"created_by""123e4567-e89b-12d3-a456-426614174000"
"allow_dynamic_clients"true
"resource_url_match_mode""exact"
"organization_membership_visibility""owning_organization"
"accept_delegated_tokens"true

Example request

bashcurl
curl -X PUT 'https://auth.schemavaults.com/api/apis/<api_server_id>/delegated-token-policy' \
  -b 'refresh_token_<auth_server_app_id>=<value>' \
  -H 'Content-Type: application/json' \
  -d '{
  "accept_delegated_tokens": true
}'