Mint a studio token for one asset
Mint a short-lived asset token for the service that edits an asset: a spreadsheet’s, a Word document’s or a deck’s, named in audience. The token names the caller, this asset and one access level, lasts 15 minutes and is good only on that service’s routes for this asset, so code (an SDK in a computer, for example) never sends the service a long-lived credential. The caller must be able to view the asset and be a member of its workspace; the token is read-write only when the caller can edit the asset and asked for edit. A computer’s or session’s credential mints tokens for assets of its own workspace only. With audience ‘pptx-studio-source’ it mints the read-only token the deck editing service reads a spreadsheet, figure or semantic model with for a linked table, OLE object or chart; a recording’s token is always that one. Any other asset (another type, a live provider file, or one outside every workspace) is refused with 422.
Authentication
Path parameters
Headers
Request
‘edit’ asks for a read-write token and gets one only when the caller can edit the asset (and it is not archived); ‘view’ always gets a read-only token. Omitted, the token carries the caller’s own access.
Omitted, the token is for the service that edits the asset. ‘pptx-studio-source’ asks for the read-only token the deck editing service reads a spreadsheet, figure or semantic model with for a linked table, OLE object or chart on a deck; send it beside the deck’s own token. A recording’s token is always that one: a deck placing a range of it is the one service that reads it. A token for this audience only reads, whatever ‘access’ asks.
Response
The access the token carries: r reads only (the service refuses its writes), rw reads and writes. The service still checks the caller’s live permission on every request.
The service the token is for, as the token’s audience identifier: the editing service of spreadsheets, of Word documents or of decks, or ‘pptx-studio-source’, the deck editing service reading this asset for a deck (a recording, or a source asked for with ‘audience’). Compare it with the service you call before sending the token.
The asset token (aat_…). Send it as Authorization: Bearer <token> to the editing service audience names, on its routes for this asset only: it names one user, this asset, one access level and that service, and every other route and service refuses it.
For a deck, the id the deck’s editing service names it by in its routes (an older deck’s own deck id, else its asset id); the token is good for that id. Null for any other asset.