Postman serviceAccounts API

openapi: 3.2.0
info:
  title: Postman Service Accounts API
  version: 1.0.0
servers:
- url: https://api.postman.com
  description: https://api.postman.com
- url: https://api.eu.postman.com
  description: https://api.eu.postman.com
tags:
- name: serviceAccounts
paths:
  /service-account-tokens:
    post:
      operationId: generateServiceAccountToken
      summary: Generate a Service Account Token
      description: 'Exchanges a service account API key for a short-lived access token. On success, the response contains an access token that can be used to authenticate downstream service-to-service requests on behalf of the service account. The token is a JWT that encodes the service account''s identity and permissions, and is valid for 15 minutes.


        **Note:**


        - The API key must belong to a service account. API keys that belong to regular users aren''t supported.

        - This endpoint authorizes the service account API through the `x-api-key` passed as a header.

        - This endpoint has a rate limit of 10 requests per 10 second window per user.

        '
      tags:
      - serviceAccounts
      parameters:
      - name: x-api-key
        in: header
        required: true
        schema:
          type: string
      - name: x-api-key
        in: header
        description: The service account API key, in PMAK format.
        required: true
        schema:
          $ref: '#/components/schemas/serviceAccountApiKey'
      responses:
        '200':
          description: Token Created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/generateServiceAccountTokenResponse'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GenerateServiceAccountTokenRequestBadRequestError'
        '401':
          description: Invalid API Key
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/commonErrorTypeTitleDetailStatus'
        '429':
          description: Too Many Requests
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/commonErrorTypeTitleDetailStatusInstance'
        '500':
          description: Internal Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GenerateServiceAccountTokenRequestInternalServerError'
components:
  schemas:
    generateServiceAccountTokenResponse:
      type: object
      properties:
        access_token:
          type: string
          description: The JWT access token to use to authenticate downstream service-to-service requests.
      title: generateServiceAccountTokenResponse
    commonErrorTypeTitleDetailStatus:
      type: object
      properties:
        type:
          $ref: '#/components/schemas/CommonErrorTypeTitleDetailStatusType'
        title:
          type: string
          description: A short summary of the problem.
        detail:
          type: string
          description: Information about the error.
        status:
          type: integer
          description: The error's HTTP status code.
      title: commonErrorTypeTitleDetailStatus
    GenerateServiceAccountTokenRequestInternalServerError:
      oneOf:
      - $ref: '#/components/schemas/commonErrorTypeTitleDetail'
      - $ref: '#/components/schemas/commonErrorTypeTitleDetailStatus'
      - $ref: '#/components/schemas/commonErrorNameMessage'
      title: GenerateServiceAccountTokenRequestInternalServerError
    CommonErrorTypeTitleDetailDetail:
      oneOf:
      - type: string
      - type: object
        additionalProperties:
          description: Any type
      description: Information about the error.
      title: CommonErrorTypeTitleDetailDetail
    commonErrorNameMessage:
      type: object
      properties:
        error:
          $ref: '#/components/schemas/CommonErrorNameMessageError'
          description: Information about the error.
      title: commonErrorNameMessage
    commonErrorTypeTitleDetailStatusInstance:
      type: object
      properties:
        type:
          type: string
          format: uri-reference
          description: The [URI reference](https://www.rfc-editor.org/rfc/rfc3986) that identifies the type of problem.
        title:
          type: string
          description: A short summary of the problem.
        detail:
          type: string
          description: An explanation about the problem.
        status:
          type: integer
          description: The HTTP status code generated by the origin server.
        instance:
          type: string
          description: The URI reference that identifies the specific occurrence of the problem.
      title: commonErrorTypeTitleDetailStatusInstance
    CommonErrorNameMessageDetailsError:
      type: object
      properties:
        name:
          type: string
          description: The error name.
        message:
          type: string
          description: The error message.
        details:
          $ref: '#/components/schemas/CommonErrorNameMessageDetailsErrorDetails'
          description: Information about the error.
      title: CommonErrorNameMessageDetailsError
    CommonErrorNameMessageError:
      type: object
      properties:
        name:
          type: string
          description: The error name.
        message:
          type: string
          description: The error message.
      description: Information about the error.
      title: CommonErrorNameMessageError
    CommonErrorNameMessageDetailsErrorDetails:
      oneOf:
      - type: object
        additionalProperties:
          description: Any type
      - type: array
        items:
          type: string
      description: Information about the error.
      title: CommonErrorNameMessageDetailsErrorDetails
    commonErrorTypeTitleDetail:
      type: object
      properties:
        type:
          type: string
          description: The type of error.
        title:
          type: string
          description: A short summary of the problem.
        detail:
          $ref: '#/components/schemas/CommonErrorTypeTitleDetailDetail'
          description: Information about the error.
      title: commonErrorTypeTitleDetail
    CommonErrorTypeTitleDetailStatusType:
      oneOf:
      - type: string
        format: uri-reference
      - type: string
      title: CommonErrorTypeTitleDetailStatusType
    GenerateServiceAccountTokenRequestBadRequestError:
      oneOf:
      - $ref: '#/components/schemas/commonErrorTypeTitleDetail'
      - $ref: '#/components/schemas/commonErrorTypeTitleDetailStatus'
      - $ref: '#/components/schemas/commonErrorNameMessageDetails'
      title: GenerateServiceAccountTokenRequestBadRequestError
    serviceAccountApiKey:
      type: string
      title: serviceAccountApiKey
    commonErrorNameMessageDetails:
      type: object
      properties:
        error:
          $ref: '#/components/schemas/CommonErrorNameMessageDetailsError'
      title: commonErrorNameMessageDetails
  securitySchemes:
    PostmanApiKey:
      type: apiKey
      in: header
      name: x-api-key
    basicAuth:
      type: http
      scheme: basic
    scimApiKey:
      type: apiKey
      in: header
      name: Authorization
      description: A valid [SCIM API key](https://learning.postman.com/docs/administration/scim-provisioning/scim-provisioning-overview/#generating-scim-api-key) for calls to SCIM endpoints.
x-provenance:
  first_party: true
  method: harvested
  provider_published: true
  source: https://learning.postman.com/api-docs/openapi.json
  harvested: '2026-08-05'
  note: Postman's own OpenAPI 3.1 definition for the Postman API, served by its Fern-hosted API reference. 162 paths, 256 operations, servers api.postman.com and api.eu.postman.com.