> ## Documentation Index
> Fetch the complete documentation index at: https://syteca.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Get Access Token

> Syteca ACB REST API endpoint to exchange a Refresh Token for a short-lived Access Token. The first call every API consumer makes.

Exchanges a Refresh Token for a short-lived Access Token. This is the **first** call every ACB API consumer makes — the returned Access Token authenticates subsequent calls to other endpoints. When the Access Token expires, call this endpoint again with the same Refresh Token.

<Warning>
  This is one of the two **old endpoints** (pre-v1.3). Authentication uses the Refresh Token in the request body — there's **no `Authorization` header** on this call. Subsequent endpoints use the returned Access Token in the `Authorization` header (new endpoints) or in the request body (the other old endpoint, [`get_secret_details`](/docs/api/acb/endpoints/get-secret-details)).
</Warning>

<Note>
  For ACB deployments updated from a version prior to 1.2, switch to the `https://{hostname}/EkranACB` server in the Playground.
</Note>

### Where to get the Refresh Token

The Refresh Token comes from the **Application Account Settings** section of a Management Tool user — see [Set up user account](/docs/api/acb/setup-user-account#configure-application-account-settings).

### Rate limit

**5 requests per minute per Refresh Token.** Consumers should cache the Access Token for its full `expires_in` lifetime rather than re-requesting on every call.

### Errors

See [Status codes](/docs/api/acb/api-reference#status-codes). Common errors:

* **401 Unauthorized** — invalid or expired Refresh Token. Verify the token, and check whether the user's [external-app toggle](/docs/api/acb/setup-user-account#what-happens-when-the-toggle-is-disabled) was disabled.
* **403 Forbidden** — the request originates from an IP not in the user's IP Address restriction.
* **429 Too Many Requests** — rate limit exceeded.

## Related

<CardGroup cols={2}>
  <Card title="Set up user account" icon="user-plus" href="/docs/api/acb/setup-user-account">Where to get the Refresh Token.</Card>
  <Card title="API reference" icon="square-code" href="/docs/api/acb/api-reference">Status codes, rate limiting, conventions.</Card>
  <Card title="Get secret details (old)" icon="key" href="/docs/api/acb/endpoints/get-secret-details">Old retrieval endpoint using Access Token in body.</Card>
  <Card title="Get secret credentials (new)" icon="key" href="/docs/api/acb/endpoints/get-secret-credentials">New retrieval endpoint using Authorization header.</Card>
</CardGroup>


## OpenAPI

````yaml POST /get_access_token
openapi: 3.0.3
info:
  title: Application Credentials Broker API
  description: >-
    API for managing secrets and folders in the Application Credentials Broker
    system
  version: 1.4.0
  contact:
    name: API Support
    email: support@example.com
servers:
  - url: https://your-syteca-host/SytecaACB
    description: On-premises Syteca ACB service (v1.2 or later)
    variables:
      hostname:
        default: your-syteca-host.example.com
        description: Your Syteca Application Server hostname
  - url: https://your-syteca-host/EkranACB
    description: Legacy URL prefix for ACB deployments updated from pre-v1.2
    variables:
      hostname:
        default: your-syteca-host.example.com
        description: Your Syteca Application Server hostname
security:
  - AccessTokenAuth: []
paths:
  /get_access_token:
    post:
      tags:
        - Old Endpoints
      summary: Exchange Refresh Token for Access Token
      description: >-
        Pre-v1.3 endpoint to exchange a Refresh Token for a short-lived Access
        Token. First call every ACB consumer makes.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/GetAccessTokenRequest'
      responses:
        '200':
          description: Access Token issued successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetAccessTokenResponse'
        '401':
          description: Invalid or expired Refresh Token
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '403':
          description: IP Address restriction blocks the request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '429':
          description: Rate limit exceeded (5/min per Refresh Token)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security: []
components:
  schemas:
    GetAccessTokenRequest:
      type: object
      required:
        - refreshToken
      properties:
        refreshToken:
          type: string
          description: >-
            Refresh Token from the user's Application Account Settings in the
            Management Tool.
    GetAccessTokenResponse:
      type: object
      properties:
        accessToken:
          type: string
          description: >-
            Access Token to use on subsequent API calls (Authorization header
            for new endpoints; in body for old endpoints).
        expires_in:
          type: integer
          format: int32
          description: >-
            Seconds until the Access Token expires. Default 600. 0 means never
            expires.
    ErrorResponse:
      type: object
      properties:
        status:
          type: integer
          description: HTTP status code
        message:
          type: string
          description: Error message
      required:
        - status
        - message
  securitySchemes:
    AccessTokenAuth:
      type: apiKey
      in: header
      name: Authorization
      description: Access token for authentication

````