For AI agents: A markdown version of this page is available at https://docs.datadoghq.com/api/latest/service-accounts/get-an-access-token-for-a-service-account.md. A documentation index is available at /llms.txt.

Get an access token for a service account

GET https://api.ap1.datadoghq.com/api/v2/service_accounts/{service_account_id}/access_tokens/{token_id}https://api.ap2.datadoghq.com/api/v2/service_accounts/{service_account_id}/access_tokens/{token_id}https://api.datadoghq.eu/api/v2/service_accounts/{service_account_id}/access_tokens/{token_id}https://api.ddog-gov.com/api/v2/service_accounts/{service_account_id}/access_tokens/{token_id}https://api.us2.ddog-gov.com/api/v2/service_accounts/{service_account_id}/access_tokens/{token_id}https://api.uk1.datadoghq.com/api/v2/service_accounts/{service_account_id}/access_tokens/{token_id}https://api.datadoghq.com/api/v2/service_accounts/{service_account_id}/access_tokens/{token_id}https://api.us3.datadoghq.com/api/v2/service_accounts/{service_account_id}/access_tokens/{token_id}https://api.us5.datadoghq.com/api/v2/service_accounts/{service_account_id}/access_tokens/{token_id}

Overview

Get a specific access token for a service account by its ID. This endpoint requires the service_account_write permission.

Arguments

Path Parameters

Name

Type

Description

service_account_id [required]

string

The ID of the service account.

token_id [required]

string

The ID of the access token.

Query Strings

Name

Type

Description

include

array

Comma-separated list of relationship objects that should be included in the response.

Response

OK

Response for retrieving an access token.

Expand All

Field

Type

Description

data

object

Datadog access token.

attributes

object

Attributes of an access token.

created_at

date-time

Creation date of the access token.

expires_at

date-time

Expiration date of the access token.

last_used_at

date-time

Date the access token was last used.

modified_at

date-time

Date of last modification of the access token.

name

string

Name of the access token.

public_portion

string

The public portion of the access token.

scopes

[string]

Array of scopes granted to the access token.

id

string

ID of the access token.

relationships

object

Resources related to the access token.

leak_information

object

Relationship to the leak the access token was found in. data is null when the access token has not been detected as leaked.

data [required]

object

Relationship to the leak the access token was found in.

id [required]

string

A unique identifier that represents the leak.

type [required]

enum

The definition of LeakedKeyType object. Allowed enum values: leaked_keys

default: leaked_keys

owned_by

object

Relationship to service account.

data [required]

object

Relationship to service account object.

id [required]

string

A unique identifier that represents the service account.

type [required]

enum

Service account resource type. Allowed enum values: service_account

type

enum

Service access tokens resource type. Allowed enum values: service_access_tokens

default: service_access_tokens

included

[ <oneOf>]

Array of objects related to the access tokens.

<type=leaked_keys>

object

The definition of LeakedKey object.

attributes [required]

object

The definition of LeakedKeyAttributes object.

date [required]

date-time

The LeakedKeyAttributes date.

leak_source

string

The LeakedKeyAttributes leak_source.

id [required]

string

The LeakedKey id.

type [required]

enum

The definition of LeakedKeyType object. Allowed enum values: leaked_keys

default: leaked_keys

{
  "data": {
    "attributes": {
      "created_at": "2024-01-01T00:00:00+00:00",
      "expires_at": "2025-12-31T23:59:59+00:00",
      "last_used_at": "2025-06-15T12:30:00+00:00",
      "modified_at": "2024-06-01T00:00:00+00:00",
      "name": "My Access Token",
      "public_portion": "ddsat_abc123",
      "scopes": [
        "dashboards_read",
        "dashboards_write"
      ]
    },
    "id": "string",
    "relationships": {
      "leak_information": {
        "data": {
          "id": "00000000-0000-1234-0000-000000000000",
          "type": "leaked_keys"
        }
      },
      "owned_by": {
        "data": {
          "id": "00000000-0000-0000-2345-000000000000",
          "type": "service_account"
        }
      }
    },
    "type": "service_access_tokens"
  },
  "included": [
    {
      "attributes": {
        "date": "2017-07-21T17:32:28Z",
        "leak_source": "string"
      },
      "id": "id",
      "type": "leaked_keys"
    }
  ]
}

Forbidden

API error response.

Expand All

Field

Type

Description

errors [required]

[string]

A list of errors.

{
  "errors": [
    "Bad Request"
  ]
}

Not Found

API error response.

Expand All

Field

Type

Description

errors [required]

[string]

A list of errors.

{
  "errors": [
    "Bad Request"
  ]
}

Too many requests

API error response.

Expand All

Field

Type

Description

errors [required]

[string]

A list of errors.

{
  "errors": [
    "Bad Request"
  ]
}

Code Example

                  # Path parameters
export service_account_id="00000000-0000-1234-0000-000000000000"
export token_id="00000000-0000-1234-0000-000000000000"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

# Curl command
curl -X GET "https://api.ap1.datadoghq.com"https://api.ap2.datadoghq.com"https://api.datadoghq.eu"https://api.ddog-gov.com"https://api.us2.ddog-gov.com"https://api.uk1.datadoghq.com"https://api.datadoghq.com"https://api.us3.datadoghq.com"https://api.us5.datadoghq.com/api/v2/service_accounts/${service_account_id}/access_tokens/${token_id}" \ -H "Accept: application/json" \ -H "Authorization: Bearer ${DD_BEARER_TOKEN}"
"""
Get an access token for a service account returns "OK" response
"""

from os import environ
from datadog_api_client import ApiClient, Configuration
from datadog_api_client.v2.api.service_accounts_api import ServiceAccountsApi

# there is a valid "service_account_user" in the system
SERVICE_ACCOUNT_USER_DATA_ID = environ["SERVICE_ACCOUNT_USER_DATA_ID"]

# there is a valid "service_account_access_token" for "service_account_user"
SERVICE_ACCOUNT_ACCESS_TOKEN_DATA_ID = environ["SERVICE_ACCOUNT_ACCESS_TOKEN_DATA_ID"]

configuration = Configuration()
configuration.access_token = environ["DD_BEARER_TOKEN"]
with ApiClient(configuration) as api_client:
    api_instance = ServiceAccountsApi(api_client)
    response = api_instance.get_service_account_access_token(
        service_account_id=SERVICE_ACCOUNT_USER_DATA_ID,
        token_id=SERVICE_ACCOUNT_ACCESS_TOKEN_DATA_ID,
    )

    print(response)

Instructions

First install the library and its dependencies and then save the example to example.py and run following commands:

    
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comuk1.datadoghq.comddog-gov.comus2.ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" python3 "example.py"
# Get an access token for a service account returns "OK" response

require "datadog_api_client"
DatadogAPIClient.configure do |config|
  config.access_token = ENV["DD_BEARER_TOKEN"]
end
api_instance = DatadogAPIClient::V2::ServiceAccountsAPI.new

# there is a valid "service_account_user" in the system
SERVICE_ACCOUNT_USER_DATA_ID = ENV["SERVICE_ACCOUNT_USER_DATA_ID"]

# there is a valid "service_account_access_token" for "service_account_user"
SERVICE_ACCOUNT_ACCESS_TOKEN_DATA_ID = ENV["SERVICE_ACCOUNT_ACCESS_TOKEN_DATA_ID"]
p api_instance.get_service_account_access_token(SERVICE_ACCOUNT_USER_DATA_ID, SERVICE_ACCOUNT_ACCESS_TOKEN_DATA_ID)

Instructions

First install the library and its dependencies and then save the example to example.rb and run following commands:

    
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comuk1.datadoghq.comddog-gov.comus2.ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" rb "example.rb"
// Get an access token for a service account returns "OK" response

package main

import (
	"context"
	"encoding/json"
	"fmt"
	"os"

	"github.com/DataDog/datadog-api-client-go/v2/api/datadog"
	"github.com/DataDog/datadog-api-client-go/v2/api/datadogV2"
)

func main() {
	// there is a valid "service_account_user" in the system
	ServiceAccountUserDataID := os.Getenv("SERVICE_ACCOUNT_USER_DATA_ID")

	// there is a valid "service_account_access_token" for "service_account_user"
	ServiceAccountAccessTokenDataID := os.Getenv("SERVICE_ACCOUNT_ACCESS_TOKEN_DATA_ID")

	ctx := datadog.NewDefaultContext(context.Background())
	ctx = context.WithValue(ctx, datadog.ContextAccessToken, os.Getenv("DD_BEARER_TOKEN"))
	configuration := datadog.NewConfiguration()
	apiClient := datadog.NewAPIClient(configuration)
	api := datadogV2.NewServiceAccountsApi(apiClient)
	resp, r, err := api.GetServiceAccountAccessToken(ctx, ServiceAccountUserDataID, ServiceAccountAccessTokenDataID)

	if err != nil {
		fmt.Fprintf(os.Stderr, "Error when calling `ServiceAccountsApi.GetServiceAccountAccessToken`: %v\n", err)
		fmt.Fprintf(os.Stderr, "Full HTTP response: %v\n", r)
	}

	responseContent, _ := json.MarshalIndent(resp, "", "  ")
	fmt.Fprintf(os.Stdout, "Response from `ServiceAccountsApi.GetServiceAccountAccessToken`:\n%s\n", responseContent)
}

Instructions

First install the library and its dependencies and then save the example to main.go and run following commands:

    
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comuk1.datadoghq.comddog-gov.comus2.ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" go run "main.go"
// Get an access token for a service account returns "OK" response

import com.datadog.api.client.ApiClient;
import com.datadog.api.client.ApiException;
import com.datadog.api.client.v2.api.ServiceAccountsApi;
import com.datadog.api.client.v2.model.ServiceAccessTokenResponse;

public class Example {
  public static void main(String[] args) {
    ApiClient defaultClient = ApiClient.getDefaultApiClient();
    defaultClient.setAccessToken(System.getenv("DD_BEARER_TOKEN"));
    ServiceAccountsApi apiInstance = new ServiceAccountsApi(defaultClient);

    // there is a valid "service_account_user" in the system
    String SERVICE_ACCOUNT_USER_DATA_ID = System.getenv("SERVICE_ACCOUNT_USER_DATA_ID");

    // there is a valid "service_account_access_token" for "service_account_user"
    String SERVICE_ACCOUNT_ACCESS_TOKEN_DATA_ID =
        System.getenv("SERVICE_ACCOUNT_ACCESS_TOKEN_DATA_ID");

    try {
      ServiceAccessTokenResponse result =
          apiInstance.getServiceAccountAccessToken(
              SERVICE_ACCOUNT_USER_DATA_ID, SERVICE_ACCOUNT_ACCESS_TOKEN_DATA_ID);
      System.out.println(result);
    } catch (ApiException e) {
      System.err.println("Exception when calling ServiceAccountsApi#getServiceAccountAccessToken");
      System.err.println("Status code: " + e.getCode());
      System.err.println("Reason: " + e.getResponseBody());
      System.err.println("Response headers: " + e.getResponseHeaders());
      e.printStackTrace();
    }
  }
}

Instructions

First install the library and its dependencies and then save the example to Example.java and run following commands:

    
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comuk1.datadoghq.comddog-gov.comus2.ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" java "Example.java"
// Get an access token for a service account returns "OK" response
use datadog_api_client::datadog;
use datadog_api_client::datadogV2::api_service_accounts::ServiceAccountsAPI;

#[tokio::main]
async fn main() {
    // there is a valid "service_account_user" in the system
    let service_account_user_data_id = std::env::var("SERVICE_ACCOUNT_USER_DATA_ID").unwrap();

    // there is a valid "service_account_access_token" for "service_account_user"
    let service_account_access_token_data_id =
        std::env::var("SERVICE_ACCOUNT_ACCESS_TOKEN_DATA_ID").unwrap();
    let configuration = datadog::Configuration::new();
    let api = ServiceAccountsAPI::with_config(configuration);
    let resp = api
        .get_service_account_access_token(
            service_account_user_data_id.clone(),
            service_account_access_token_data_id.clone(),
        )
        .await;
    if let Ok(value) = resp {
        println!("{:#?}", value);
    } else {
        println!("{:#?}", resp.unwrap_err());
    }
}

Instructions

First install the library and its dependencies and then save the example to src/main.rs and run following commands:

    
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comuk1.datadoghq.comddog-gov.comus2.ddog-gov.com" DD_API_KEY="<API-KEY>" DD_APP_KEY="<APP-KEY>" cargo run
/**
 * Get an access token for a service account returns "OK" response
 */

import { client, v2 } from "@datadog/datadog-api-client";

const configuration = client.createConfiguration({
  authMethods: {
    AuthZ: {
      accessToken: process.env.DD_BEARER_TOKEN as string,
    },
  },
});
const apiInstance = new v2.ServiceAccountsApi(configuration);

// there is a valid "service_account_user" in the system
const SERVICE_ACCOUNT_USER_DATA_ID = process.env
  .SERVICE_ACCOUNT_USER_DATA_ID as string;

// there is a valid "service_account_access_token" for "service_account_user"
const SERVICE_ACCOUNT_ACCESS_TOKEN_DATA_ID = process.env
  .SERVICE_ACCOUNT_ACCESS_TOKEN_DATA_ID as string;

const params: v2.ServiceAccountsApiGetServiceAccountAccessTokenRequest = {
  serviceAccountId: SERVICE_ACCOUNT_USER_DATA_ID,
  tokenId: SERVICE_ACCOUNT_ACCESS_TOKEN_DATA_ID,
};

apiInstance
  .getServiceAccountAccessToken(params)
  .then((data: v2.ServiceAccessTokenResponse) => {
    console.log(
      "API called successfully. Returned data: " + JSON.stringify(data)
    );
  })
  .catch((error: any) => console.error(error));

Instructions

First install the library and its dependencies and then save the example to example.ts and run following commands:

    
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comuk1.datadoghq.comddog-gov.comus2.ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" tsc "example.ts"