Get an access token for a service account

GET https://api.ap1.datadoghq.com/api/v2/service_accounts/{service_account_id}/access_tokens/{token_id}https://api.ap2.datadoghq.com/api/v2/service_accounts/{service_account_id}/access_tokens/{token_id}https://api.datadoghq.eu/api/v2/service_accounts/{service_account_id}/access_tokens/{token_id}https://api.ddog-gov.com/api/v2/service_accounts/{service_account_id}/access_tokens/{token_id}https://api.us2.ddog-gov.com/api/v2/service_accounts/{service_account_id}/access_tokens/{token_id}https://api.datadoghq.com/api/v2/service_accounts/{service_account_id}/access_tokens/{token_id}https://api.us3.datadoghq.com/api/v2/service_accounts/{service_account_id}/access_tokens/{token_id}https://api.us5.datadoghq.com/api/v2/service_accounts/{service_account_id}/access_tokens/{token_id}

Overview

Get a specific access token for a service account by its ID. This endpoint requires the service_account_write permission.

Arguments

Path Parameters

Name

Type

Description

service_account_id [required]

string

The ID of the service account.

token_id [required]

string

The ID of the access token.

Response

OK

Response for retrieving an access token.

Expand All

Field

Type

Description

data

object

Datadog access token.

attributes

object

Attributes of an access token.

created_at

date-time

Creation date of the access token.

expires_at

date-time

Expiration date of the access token.

last_used_at

date-time

Date the access token was last used.

modified_at

date-time

Date of last modification of the access token.

name

string

Name of the access token.

public_portion

string

The public portion of the access token.

scopes

[string]

Array of scopes granted to the access token.

id

string

ID of the access token.

relationships

object

Resources related to the access token.

owned_by

object

Relationship to service account.

data [required]

object

Relationship to service account object.

id [required]

string

A unique identifier that represents the service account.

type [required]

enum

Service account resource type. Allowed enum values: service_account

type

enum

Service access tokens resource type. Allowed enum values: service_access_tokens

default: service_access_tokens

{
  "data": {
    "attributes": {
      "created_at": "2024-01-01T00:00:00+00:00",
      "expires_at": "2025-12-31T23:59:59+00:00",
      "last_used_at": "2025-06-15T12:30:00+00:00",
      "modified_at": "2024-06-01T00:00:00+00:00",
      "name": "My Access Token",
      "public_portion": "ddsat_abc123",
      "scopes": [
        "dashboards_read",
        "dashboards_write"
      ]
    },
    "id": "string",
    "relationships": {
      "owned_by": {
        "data": {
          "id": "00000000-0000-0000-2345-000000000000",
          "type": "service_account"
        }
      }
    },
    "type": "service_access_tokens"
  }
}

Forbidden

API error response.

Expand All

Field

Type

Description

errors [required]

[string]

A list of errors.

{
  "errors": [
    "Bad Request"
  ]
}

Not Found

API error response.

Expand All

Field

Type

Description

errors [required]

[string]

A list of errors.

{
  "errors": [
    "Bad Request"
  ]
}

Too many requests

API error response.

Expand All

Field

Type

Description

errors [required]

[string]

A list of errors.

{
  "errors": [
    "Bad Request"
  ]
}

Code Example

                  # Path parameters
export service_account_id="00000000-0000-1234-0000-000000000000"
export token_id="00000000-0000-1234-0000-000000000000"
# Curl command
curl -X GET "https://api.ap1.datadoghq.com"https://api.ap2.datadoghq.com"https://api.datadoghq.eu"https://api.ddog-gov.com"https://api.us2.ddog-gov.com"https://api.datadoghq.com"https://api.us3.datadoghq.com"https://api.us5.datadoghq.com/api/v2/service_accounts/${service_account_id}/access_tokens/${token_id}" \ -H "Accept: application/json" \ -H "DD-API-KEY: ${DD_API_KEY}" \ -H "DD-APPLICATION-KEY: ${DD_APP_KEY}"
"""
Get an access token for a service account returns "OK" response
"""

from os import environ
from datadog_api_client import ApiClient, Configuration
from datadog_api_client.v2.api.service_accounts_api import ServiceAccountsApi

# there is a valid "service_account_user" in the system
SERVICE_ACCOUNT_USER_DATA_ID = environ["SERVICE_ACCOUNT_USER_DATA_ID"]

# there is a valid "service_account_access_token" for "service_account_user"
SERVICE_ACCOUNT_ACCESS_TOKEN_DATA_ID = environ["SERVICE_ACCOUNT_ACCESS_TOKEN_DATA_ID"]

configuration = Configuration()
with ApiClient(configuration) as api_client:
    api_instance = ServiceAccountsApi(api_client)
    response = api_instance.get_service_account_access_token(
        service_account_id=SERVICE_ACCOUNT_USER_DATA_ID,
        pat_id=SERVICE_ACCOUNT_ACCESS_TOKEN_DATA_ID,
    )

    print(response)

Instructions

First install the library and its dependencies and then save the example to example.py and run following commands:

    
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com" DD_API_KEY="<API-KEY>" DD_APP_KEY="<APP-KEY>" python3 "example.py"
# Get an access token for a service account returns "OK" response

require "datadog_api_client"
api_instance = DatadogAPIClient::V2::ServiceAccountsAPI.new

# there is a valid "service_account_user" in the system
SERVICE_ACCOUNT_USER_DATA_ID = ENV["SERVICE_ACCOUNT_USER_DATA_ID"]

# there is a valid "service_account_access_token" for "service_account_user"
SERVICE_ACCOUNT_ACCESS_TOKEN_DATA_ID = ENV["SERVICE_ACCOUNT_ACCESS_TOKEN_DATA_ID"]
p api_instance.get_service_account_access_token(SERVICE_ACCOUNT_USER_DATA_ID, SERVICE_ACCOUNT_ACCESS_TOKEN_DATA_ID)

Instructions

First install the library and its dependencies and then save the example to example.rb and run following commands:

    
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com" DD_API_KEY="<API-KEY>" DD_APP_KEY="<APP-KEY>" rb "example.rb"
// Get an access token for a service account returns "OK" response

package main

import (
	"context"
	"encoding/json"
	"fmt"
	"os"

	"github.com/DataDog/datadog-api-client-go/v2/api/datadog"
	"github.com/DataDog/datadog-api-client-go/v2/api/datadogV2"
)

func main() {
	// there is a valid "service_account_user" in the system
	ServiceAccountUserDataID := os.Getenv("SERVICE_ACCOUNT_USER_DATA_ID")

	// there is a valid "service_account_access_token" for "service_account_user"
	ServiceAccountAccessTokenDataID := os.Getenv("SERVICE_ACCOUNT_ACCESS_TOKEN_DATA_ID")

	ctx := datadog.NewDefaultContext(context.Background())
	configuration := datadog.NewConfiguration()
	apiClient := datadog.NewAPIClient(configuration)
	api := datadogV2.NewServiceAccountsApi(apiClient)
	resp, r, err := api.GetServiceAccountAccessToken(ctx, ServiceAccountUserDataID, ServiceAccountAccessTokenDataID)

	if err != nil {
		fmt.Fprintf(os.Stderr, "Error when calling `ServiceAccountsApi.GetServiceAccountAccessToken`: %v\n", err)
		fmt.Fprintf(os.Stderr, "Full HTTP response: %v\n", r)
	}

	responseContent, _ := json.MarshalIndent(resp, "", "  ")
	fmt.Fprintf(os.Stdout, "Response from `ServiceAccountsApi.GetServiceAccountAccessToken`:\n%s\n", responseContent)
}

Instructions

First install the library and its dependencies and then save the example to main.go and run following commands:

    
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com" DD_API_KEY="<API-KEY>" DD_APP_KEY="<APP-KEY>" go run "main.go"
// Get an access token for a service account returns "OK" response

import com.datadog.api.client.ApiClient;
import com.datadog.api.client.ApiException;
import com.datadog.api.client.v2.api.ServiceAccountsApi;
import com.datadog.api.client.v2.model.PersonalAccessTokenResponse;

public class Example {
  public static void main(String[] args) {
    ApiClient defaultClient = ApiClient.getDefaultApiClient();
    ServiceAccountsApi apiInstance = new ServiceAccountsApi(defaultClient);

    // there is a valid "service_account_user" in the system
    String SERVICE_ACCOUNT_USER_DATA_ID = System.getenv("SERVICE_ACCOUNT_USER_DATA_ID");

    // there is a valid "service_account_access_token" for "service_account_user"
    String SERVICE_ACCOUNT_ACCESS_TOKEN_DATA_ID =
        System.getenv("SERVICE_ACCOUNT_ACCESS_TOKEN_DATA_ID");

    try {
      PersonalAccessTokenResponse result =
          apiInstance.getServiceAccountAccessToken(
              SERVICE_ACCOUNT_USER_DATA_ID, SERVICE_ACCOUNT_ACCESS_TOKEN_DATA_ID);
      System.out.println(result);
    } catch (ApiException e) {
      System.err.println("Exception when calling ServiceAccountsApi#getServiceAccountAccessToken");
      System.err.println("Status code: " + e.getCode());
      System.err.println("Reason: " + e.getResponseBody());
      System.err.println("Response headers: " + e.getResponseHeaders());
      e.printStackTrace();
    }
  }
}

Instructions

First install the library and its dependencies and then save the example to Example.java and run following commands:

    
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com" DD_API_KEY="<API-KEY>" DD_APP_KEY="<APP-KEY>" java "Example.java"
// Get an access token for a service account returns "OK" response
use datadog_api_client::datadog;
use datadog_api_client::datadogV2::api_service_accounts::ServiceAccountsAPI;

#[tokio::main]
async fn main() {
    // there is a valid "service_account_user" in the system
    let service_account_user_data_id = std::env::var("SERVICE_ACCOUNT_USER_DATA_ID").unwrap();

    // there is a valid "service_account_access_token" for "service_account_user"
    let service_account_access_token_data_id =
        std::env::var("SERVICE_ACCOUNT_ACCESS_TOKEN_DATA_ID").unwrap();
    let configuration = datadog::Configuration::new();
    let api = ServiceAccountsAPI::with_config(configuration);
    let resp = api
        .get_service_account_access_token(
            service_account_user_data_id.clone(),
            service_account_access_token_data_id.clone(),
        )
        .await;
    if let Ok(value) = resp {
        println!("{:#?}", value);
    } else {
        println!("{:#?}", resp.unwrap_err());
    }
}

Instructions

First install the library and its dependencies and then save the example to src/main.rs and run following commands:

    
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com" DD_API_KEY="<API-KEY>" DD_APP_KEY="<APP-KEY>" cargo run
/**
 * Get an access token for a service account returns "OK" response
 */

import { client, v2 } from "@datadog/datadog-api-client";

const configuration = client.createConfiguration();
const apiInstance = new v2.ServiceAccountsApi(configuration);

// there is a valid "service_account_user" in the system
const SERVICE_ACCOUNT_USER_DATA_ID = process.env
  .SERVICE_ACCOUNT_USER_DATA_ID as string;

// there is a valid "service_account_access_token" for "service_account_user"
const SERVICE_ACCOUNT_ACCESS_TOKEN_DATA_ID = process.env
  .SERVICE_ACCOUNT_ACCESS_TOKEN_DATA_ID as string;

const params: v2.ServiceAccountsApiGetServiceAccountAccessTokenRequest = {
  serviceAccountId: SERVICE_ACCOUNT_USER_DATA_ID,
  patId: SERVICE_ACCOUNT_ACCESS_TOKEN_DATA_ID,
};

apiInstance
  .getServiceAccountAccessToken(params)
  .then((data: v2.PersonalAccessTokenResponse) => {
    console.log(
      "API called successfully. Returned data: " + JSON.stringify(data)
    );
  })
  .catch((error: any) => console.error(error));

Instructions

First install the library and its dependencies and then save the example to example.ts and run following commands:

    
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com" DD_API_KEY="<API-KEY>" DD_APP_KEY="<APP-KEY>" tsc "example.ts"