You're viewing version 3.8 of the OpenSearch documentation. This version is no longer maintained. For the latest version, see the current documentation. For information about OpenSearch version maintenance, see Release Schedule and Maintenance Policy.
Generate On-Behalf-Of Token API
Introduced 2.12
Generates an On-Behalf-Of token for the current user.
On-Behalf-Of authentication must be configured before you call this API. Add an on_behalf_of section containing a signing_key to the config.dynamic section of the config.yml file and apply it with securityadmin.sh. For more information, see On-Behalf-Of authentication.
Endpoints
POST /_plugins/_security/api/generateonbehalfoftoken
Request body fields
The request body is required. It is a JSON object with the following fields.
| Property | Required | Data type | Description |
|---|---|---|---|
description | Required | String | The description supplied by the user to describe the token. |
duration | Optional | String | A duration in seconds. |
service | Optional | String | The name of the service when generating a token for that service. |
Example request
POST _plugins/_security/api/generateonbehalfoftoken
{
"description": "Reason for token",
"service": "self-issued",
"durationSeconds": "300"
}
Example response
{
"user": "admin",
"authenticationToken": "eyJhbGciOiJIUzUxMiJ9.eyJzdWIiOiJhZG1pbiIsImF1ZCI6InNlbGYtaXNzdWVkIiwibmJmIjoxNzg5MDUxOTQ1LCJpc3MiOiJvcGVuc2VhcmNoLWNsdXN0ZXIiLCJleHAiOjE3ODkwNTIyNDUsImlhdCI6MTc4OTA1MTk0NSwiZW5jcnlwdGVkX3JvbGVzIjoiZkE3blFnZW9hdmgrM1ZJWkZkRWNmUT09In0.1H6eSXlIsOfqZv7AeBPghgEC6tg4jrq5g-XiuNUYL3e705aP97c16xNXOnEUecOHsiqXskXqzH56Sw6ZLYSxSA",
"durationSeconds": 300
}
Response body fields
The response body is a JSON object with the following fields.
| Property | Data type | Description | Default |
|---|---|---|---|
authenticationToken | String | The generated OBO token. | N/A |
durationSeconds | String | The duration of the token. | 300s |
user | String | The name of the entity requesting token. | N/A |