create_o_auth2_token ¶

def create_o_auth2_token(
    self,
    token_input: "capo_signin.types.create_o_auth2_token_request_body.CreateOAuth2TokenRequestBody",
    *,
    config_overrides: Optional[SigninClientConfig] = None,
) -> "capo_signin.types.create_o_auth2_token_response.CreateOAuth2TokenResponse":
    """CreateOAuth2Token API Path: /v1/token Request Method: POST Content-Type: application/json or application/x-www-form-urlencoded This API implements OAuth 2.0 flows for AWS Sign-In CLI clients, supporting both: 1. Authorization code redemption (grant_type=authorization_code) - NOT idempotent 2. Token refresh (grant_type=refresh_token) - Idempotent within token validity window The operation behavior is determined by the grant_type parameter in the request body: **Authorization Code Flow (NOT Idempotent):** - JSON or form-encoded body with client_id, grant_type=authorization_code, code, redirect_uri, code_verifier - Returns access_token, token_type, expires_in, refresh_token, and id_token - Each authorization code can only be used ONCE for security (prevents replay attacks) **Token Refresh Flow (Idempotent):** - JSON or form-encoded body with client_id, grant_type=refresh_token, refresh_token - Returns access_token, token_type, expires_in, and refresh_token (no id_token) - Multiple calls with same refresh_token return consistent results within validity window Authentication and authorization: - Confidential clients: sigv4 signing required with signin:ExchangeToken permissions - CLI clients (public): authn/authz skipped based on client_id & grant_type Note: This operation cannot be marked as @idempotent because it handles both idempotent (token refresh) and non-idempotent (auth code redemption) flows in a single endpoint.

    Args:
        token_input: Flattened token operation inputs The specific operation is determined by grant_type in the request body

    Raises:
        capo_signin.errors.access_denied_exception.AccessDeniedException: Error thrown for access denied scenarios with flexible HTTP status mapping Runtime HTTP Status Code Mapping: - HTTP 401 (Unauthorized): TOKEN_EXPIRED, AUTHCODE_EXPIRED - HTTP 403 (Forbidden): USER_CREDENTIALS_CHANGED, INSUFFICIENT_PERMISSIONS The specific HTTP status code is determined at runtime based on the error enum value. Consumers should use the error field to determine the specific access denial reason.
        capo_signin.errors.internal_server_exception.InternalServerException: Error thrown when an internal server error occurs HTTP Status Code: 500 Internal Server Error Used for unexpected server-side errors that prevent request processing.
        capo_signin.errors.too_many_requests_error.TooManyRequestsError: Error thrown when rate limit is exceeded HTTP Status Code: 429 Too Many Requests Possible OAuth2ErrorCode values: - INVALID_REQUEST: Rate limiting, too many requests, abuse prevention Possible causes: - Too many token requests from the same client - Rate limiting based on client_id or IP address - Abuse prevention mechanisms triggered - Service protection against excessive token generation
        capo_signin.errors.validation_exception.ValidationException: Error thrown when request validation fails HTTP Status Code: 400 Bad Request Used for request validation errors such as malformed parameters, missing required fields, or invalid parameter values.
        capo_signin.errors.UnknownServiceError: The service returned an error code this client does not model.
    """

    def _handler(
        req: "OperationRequest[capo_signin.types.create_o_auth2_token_request.CreateOAuth2TokenRequest]",
    ) -> OperationResponse[
        "capo_signin.types.create_o_auth2_token_response.CreateOAuth2TokenResponse"
    ]:
        import capo_signin._operations.signin.create_o_auth2_token

        output, http_response = (
            capo_signin._operations.signin.create_o_auth2_token.create_o_auth2_token(
                req.options, req.input
            )
        )
        return OperationResponse(output=output, response=http_response)

    def _redact_input(
        input_: "capo_signin.types.create_o_auth2_token_request.CreateOAuth2TokenRequest",
    ) -> dict[str, Any]:
        import capo_signin.types.create_o_auth2_token_request

        return capo_signin.types.create_o_auth2_token_request.redact_sensitive(
            input_
        )

    def _redact_output(
        output: "capo_signin.types.create_o_auth2_token_response.CreateOAuth2TokenResponse",
    ) -> dict[str, Any]:
        import capo_signin.types.create_o_auth2_token_response

        return capo_signin.types.create_o_auth2_token_response.redact_sensitive(
            output
        )

    interceptors_, options_ = self.operation_options(
        config_overrides,
        OperationLogging(
            "CreateOAuth2Token",
            redact_input=_redact_input,
            redact_output=_redact_output,
        ),
    )
    input_: capo_signin.types.create_o_auth2_token_request.CreateOAuth2TokenRequest = {
        "token_input": token_input
    }

    response = execute_pipeline(
        OperationRequest(input=input_, options=options_),
        handler=_handler,
        interceptors=list(interceptors_),
    )
    response.response.close()
    return response.output