Request a SAS token

Use this guide to request a short-lived Azure Storage SAS token from the SAS Token Service.

Prerequisites

To request SAS tokens from the SAS Token Service, you need a valid OAuth2 client-credentials token and the tenant-scoped SAS_TOKEN_CREATOR role.

  • The role must follow the tenant-matching URN pattern urn:macma-application-role:{TENANT_ID}:{CLIENT_ID}:SAS_TOKEN_CREATOR.

  • One deployment serves exactly one configured tenant and one storage policy.

  • A different tenant requires a different deployment.

Available default roles for the SAS Token Service:

Name Description Role key

SAS Token Creator

Required to request short-lived SAS tokens for the deployment’s configured tenant and storage scope.

SAS_TOKEN_CREATOR

The service accepts JSON requests only. It does not accept multipart payloads or resource content.

Send the request

  • Request a token by calling the tenant-specific endpoint:

curl.exe -X POST "http://api.boschsemanticstack/sas-token-service/v1/{tenantId}/sas-token" `
  -H "Authorization: Bearer <oauth2-token>" `
  -H "Content-Type: application/json" `
  -d '{ "requestedLifetimeMinutes": 5 }'

You can omit requestedLifetimeMinutes to use the deployment’s configured maximum lifetime.

  • Inspect the response, a successful one includes:

    • sasUrl — the full URL with SAS authorization

    • sasToken — the raw SAS token string

    • expiry — the token expiry timestamp

Common failure cases

  • 401 — The bearer token is missing, invalid, or expired.

  • 403 — The token is authenticated but not authorized for the deployment tenant or storage policy.

  • 429 — Repeated failed requests exceeded the configured rate limit.

  • 503 — Azure Storage or verification material is unavailable.