Exchange a GitHub Actions OIDC token for a workspace service token

POST/v1/auth/github-actions/tokenExchange a GitHub Actions OIDC token for a workspace service token

⚠️ Experimental endpoint: this API is in active development and may change at any time without notice. ⚠️

Verifies the GitHub Actions OIDC token and mints a short-lived workspace service token. The caller must request the token with audience prisma-cloud. Any verification failure returns a generic 401 — the response never reveals whether a repository is connected.

Request body

application/json

object

expiresInSecondsinteger

Requested token lifetime in seconds. Defaults to 1800 (30 min); capped at 3600 (60 min).

default 1800 · maximum 3600 · minimum 60

tokenstringrequired

The GitHub Actions OIDC token with audience `prisma-cloud`.

minLength 1

Example request

{
  "expiresInSeconds": 1800,
  "token": "string"
}

Responses

object

dataobjectrequired

Show child attributes

expiresAtstring · date-timerequired

ISO 8601 instant after which the token is invalid.

idstringrequired

Prefixed integration token ID (`itgr_` prefix).

typestringrequired

const "serviceToken"

valuestringrequired

The minted integration token. Returned once — copy it immediately.

workspaceIdstringrequired

Prefixed workspace ID the token is scoped to.

Example response

{
  "data": {
    "expiresAt": "2026-06-09T00:00:00Z",
    "id": "string",
    "type": "serviceToken",
    "value": "string",
    "workspaceId": "string"
  }
}

object

errorstringrequired

const "unauthorized"

errorDescriptionstringrequired

Example response

{
  "error": "unauthorized",
  "errorDescription": "string"
}

object

errorobjectrequired

Show child attributes

codestringrequired

hintstring

messagestringrequired

Example response

{
  "error": {
    "code": "string",
    "hint": "string",
    "message": "string"
  }
}

Examples

curl -X POST 'https://api.prisma.io/v1/auth/github-actions/token' \
  -H 'Content-Type: application/json' \
  -d '{"expiresInSeconds":1800,"token":"string"}'

const response = await fetch('https://api.prisma.io/v1/auth/github-actions/token', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({"expiresInSeconds":1800,"token":"string"}),
});
const data = await response.json();

const response = await fetch('https://api.prisma.io/v1/auth/github-actions/token', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: "{\"expiresInSeconds\":1800,\"token\":\"string\"}" });
console.log(await response.json());

import requests

response = requests.request(
    "POST",
    "https://api.prisma.io/v1/auth/github-actions/token",
    headers={"Content-Type": "application/json"},
    data='{"expiresInSeconds":1800,"token":"string"}',
)
print(response.json())

package main

import (
	"context"
	"net/http"
	"strings"
)

func main() {
	ctx := context.Background()
	body := strings.NewReader(`{"expiresInSeconds":1800,"token":"string"}`)
	req, err := http.NewRequestWithContext(ctx, "POST", "https://api.prisma.io/v1/auth/github-actions/token", body)
	if err != nil {
		panic(err)
	}
	req.Header.Set("Content-Type", "application/json")
	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer resp.Body.Close()
}

<?php
$request = curl_init("https://api.prisma.io/v1/auth/github-actions/token");
curl_setopt($request, CURLOPT_CUSTOMREQUEST, "POST");
curl_setopt($request, CURLOPT_POSTFIELDS, "{\"expiresInSeconds\":1800,\"token\":\"string\"}");
curl_setopt($request, CURLOPT_HTTPHEADER, ['Content-Type: application/json']);
$response = curl_exec($request);
curl_close($request);

var request = HttpRequest.newBuilder(URI.create("https://api.prisma.io/v1/auth/github-actions/token"))
    .method("POST", HttpRequest.BodyPublishers.noBody())
    .header("Content-Type", "application/json")
    .method("POST", HttpRequest.BodyPublishers.ofString("{\"expiresInSeconds\":1800,\"token\":\"string\"}"))
    .build();
var response = HttpClient.newHttpClient().send(request, HttpResponse.BodyHandlers.ofString());

require 'net/http'

uri = URI("https://api.prisma.io/v1/auth/github-actions/token")
request = Net::HTTPGenericRequest.new("POST", true, true, uri)
request['Content-Type'] = 'application/json'
request.body = "{\"expiresInSeconds\":1800,\"token\":\"string\"}"
response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) { |http| http.request(request) }

using var client = new HttpClient();
using var request = new HttpRequestMessage(HttpMethod.Post, "https://api.prisma.io/v1/auth/github-actions/token");
request.Content = new StringContent("{\"expiresInSeconds\":1800,\"token\":\"string\"}", Encoding.UTF8, "application/json");
using var response = await client.SendAsync(request);

{
  "data": {
    "expiresAt": "2026-06-09T00:00:00Z",
    "id": "string",
    "type": "serviceToken",
    "value": "string",
    "workspaceId": "string"
  }
}

{
  "error": "unauthorized",
  "errorDescription": "string"
}

{
  "error": {
    "code": "string",
    "hint": "string",
    "message": "string"
  }
}

Search documentation

Projects

Databases

Databases Connections

Database Backups

Database Usage

Connections

Integrations

Service Tokens

Workspaces

Regions

Misc

[Experimental]

Agents

Buckets

Exchange a GitHub Actions OIDC token for a workspace service token

Request body

Responses

Projects

Databases

Databases Connections

Database Backups

Database Usage

Connections

Integrations

Service Tokens

Workspaces

Regions

Misc

[Experimental]

Agents

Buckets