Spyderbat

Spyderbat STS API

Security Token Service endpoints. Trusted services assume a role on a single org and receive a short-lived, org-locked JWT for downstream consumers. The caller's authority to assume is gated by the sts:AssumeRole action on srn:sts:::; the resulting token carries the assumed role on the assumed org only.

Documentation GitHub OpenAPI

Operations 1

POST /api/v1/sts/assumerole Assume a role on an org and receive a scoped JWT #

Documentation

📖

Documentation

https://docs.spyderbat.com/

📖

APIReference

https://api.spyderbat.com/openapi

📖

GettingStarted

https://docs.spyderbat.com/tutorials/integrations/how-to-set-up-your-spyderbat-api-key-and-use-the-spyderbat-api

Specifications

⚙

OpenAPI

https://raw.githubusercontent.com/api-evangelist/spyderbat/refs/heads/main/openapi/spyderbat-sts-api-openapi.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this

find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/spyderbat-sts-api"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no email required.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

openapi: 3.2.0
info:
  title: Spyderbat STS API
  version: 1.0.0
  contact:
    name: API Support
    url: https://api.prod.spyderbat.com/openapi
    email: support@spyderbat.com
  license:
    name: MIT
    url: https://mit-license.org/
  termsOfService: https://www.spyderbat.com/terms-of-use/
  x-logo:
    url: /static/sb-logo.svg
    backgroundColor: '#161A21'
    altText: Spyderbat Logo
  description: 'Operations tagged STS across 2 of this provider''s published API definitions: spyderbat-openapi-original.json, spyderbat-openapi.json. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.prod.spyderbat.com/
  description: Spyderbat API Server
security:
- apiToken: []
tags:
- name: STS
  description: '

    Security Token Service endpoints. Trusted services assume a role on a single org and receive a short-lived, org-locked JWT for downstream consumers. The caller''s authority to assume is gated by the sts:AssumeRole action on srn:sts::<org>:<role_uid>; the resulting token carries the assumed role on the assumed org only.

    '
paths:
  /api/v1/sts/assumerole:
    post:
      tags:
      - STS
      summary: Assume a role on an org and receive a scoped JWT
      description: "\nAssumes a single Org/* role on a single org and returns a short-lived JWT bound to both.\n\n * Requires action *sts:AssumeRole* on resource *srn:sts::<org_uid>:<role_uid>*\n * role_uid must be an Org/* role UID; Global/* roles are not assumable\n * TTL default is 1200 seconds (20m); max is 3600 seconds (1h)\n * The resulting token carries the assumed role on the assumed org only; onward assumption is gated by whether that role grants sts:AssumeRole\n"
      operationId: StsAssumeRole
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/StsAssumeRoleInput'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiStsAssumeRoleOutput'
        '400':
          description: invalid input
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ValidationError'
        '403':
          description: permission denied
    servers:
    - url: https://api.prod.spyderbat.com/
      description: Spyderbat API Server
components:
  schemas:
    ApiStsAssumeRoleOutput:
      type: object
      properties:
        expires_at:
          type: integer
          description: Unix timestamp (seconds) at which the token expires.
          format: int64
        token:
          type: string
          description: Signed scoped JWT. Present in the Authorization header as 'Bearer <token>' on subsequent requests.
    StsAssumeRoleInput:
      type: object
      properties:
        correlation_id:
          type: string
          description: Audit/tracing identifier for this assumption (alphanumeric, max 64 chars)
          maxLength: 64
        org_uid:
          type: string
          description: UID of the org the scoped token will be locked to
        role_uid:
          type: string
          description: UID of the Org/* role the scoped token will carry
          maxLength: 64
        ttl_seconds:
          type: integer
          description: Requested lifetime in seconds. Clamped to [60, 3600]; 0 or unset applies the default (1200)
          format: int32
          maximum: 3600
      required:
      - org_uid
      - role_uid
    ValidationError:
      type: object
      properties:
        err_msg:
          type: string
          description: Message regarding the validation failure
        field:
          type: string
          description: Field name which failed validation
        property:
          type: string
          description: JSON property name of the field which failed validation
        tags:
          type: string
          description: Validation tag which failed
  securitySchemes:
    apiToken:
      type: http
      scheme: bearer
      bearerFormat: JWT
x-refined-from:
- spyderbat-openapi-original.json
- spyderbat-openapi.json