Spyderbat

Spyderbat STS API

Security Token Service endpoints. Trusted services assume a role on a single org and receive a short-lived, org-locked JWT for downstream consumers. The caller's authority to assume is gated by the sts:AssumeRole action on srn:sts:::; the resulting token carries the assumed role on the assumed org only.

Documentation GitHub OpenAPI

Business capability

Identity & Access Management BC-620.20

Operations 1

POST /api/v1/sts/assumerole Assume a role on an org and receive a scoped JWT #

Documentation

📖

Documentation

https://docs.spyderbat.com/

📖

APIReference

https://api.spyderbat.com/openapi

📖

GettingStarted

https://docs.spyderbat.com/tutorials/integrations/how-to-set-up-your-spyderbat-api-key-and-use-the-spyderbat-api

Specifications

⚙

OpenAPI

https://raw.githubusercontent.com/api-evangelist/spyderbat/refs/heads/main/openapi/spyderbat-sts-api-openapi.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this

find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/spyderbat-sts-api"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

openapi: 3.2.0
info:
  title: Spyderbat API UI & Public STS API
  description: Restful APIs for use by UI & customers.
  termsOfService: https://www.spyderbat.com/terms-of-use/
  contact:
    name: API Support
    url: https://api.prod.spyderbat.com/openapi
    email: support@spyderbat.com
  license:
    name: MIT
    url: https://mit-license.org/
  version: 1.0.0
  x-logo:
    url: /static/sb-logo.svg
    backgroundColor: '#161A21'
    altText: Spyderbat Logo
servers:
- url: https://api.prod.spyderbat.com/
  description: Spyderbat API Server
security:
- apiToken: []
tags:
- name: STS
  description: Security Token Service endpoints. Trusted services assume a role on a single org and receive a short-lived, org-locked JWT for downstream consumers. The caller's authority to assume is gated by the sts:AssumeRole action on srn:sts:::; the resulting token carries the assumed role on the assumed org only.
paths:
  /api/v1/sts/assumerole:
    post:
      tags:
      - STS
      summary: Assume a role on an org and receive a scoped JWT
      description: 'Assumes a single Org/* role on a single org and returns a short-lived JWT bound to both.


        * Requires action *sts:AssumeRole* on resource *srn:sts:::*

        * role_uid must be an Org/* role UID; Global/* roles are not assumable

        * TTL default is 1200 seconds (20m); max is 3600 seconds (1h)

        * The resulting token carries the assumed role on the assumed org only; onward assumption is gated by whether that role grants sts:AssumeRole'
      operationId: StsAssumeRole
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/StsAssumeRoleInput'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiStsAssumeRoleOutput'
        '400':
          description: invalid input
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ValidationError'
        '403':
          description: permission denied
components:
  schemas:
    StsAssumeRoleInput:
      type: object
      properties:
        correlation_id:
          type: string
          description: Audit/tracing identifier for this assumption (alphanumeric, max 64 chars)
          maxLength: 64
        org_uid:
          type: string
          description: UID of the org the scoped token will be locked to
        role_uid:
          type: string
          description: UID of the Org/* role the scoped token will carry
          maxLength: 64
        ttl_seconds:
          type: integer
          description: Requested lifetime in seconds. Clamped to [60, 3600]; 0 or unset applies the default (1200)
          format: int32
          maximum: 3600
      required:
      - org_uid
      - role_uid
    ApiStsAssumeRoleOutput:
      type: object
      properties:
        expires_at:
          type: integer
          description: Unix timestamp (seconds) at which the token expires.
          format: int64
        token:
          type: string
          description: Signed scoped JWT. Present in the Authorization header as 'Bearer <token>' on subsequent requests.
    ValidationError:
      type: object
      properties:
        err_msg:
          type: string
          description: Message regarding the validation failure
        field:
          type: string
          description: Field name which failed validation
        property:
          type: string
          description: JSON property name of the field which failed validation
        tags:
          type: string
          description: Validation tag which failed
  securitySchemes:
    apiToken:
      type: http
      scheme: bearer
      bearerFormat: JWT