Get a token for an account

Overview

Issue a token that acts as the account's owner.

Use this before calling account-scoped endpoints on a customer's behalf. A token lasts 7 days. Repeat calls return the same token while it's still valid, for up to 6 days after it was issued; after that a new token is issued and the previous one is revoked (prior_tokens_revoked counts them).

You'll need the account's id.

Returns a token. Use it as the Authorization header for the account-scoped calls.

Prerequisites

• A Partner token. See Authentication.
• The account's id (account_id), from List accounts. The account must have an owner.

Base URL

Endpoint

POST /api/v1/partner/account-owner/token

Authentication

Partner token

• Any other token gets 403 Only partner users can mint brand-owner tokens.
• account_id must be an account inside your partner's tree; otherwise 403 Brand is not under your partner tree.
• The token acts as the account's owner: it can do anything the owner can, on that account only.

Rate limit

120 requests per minute, counted per user (the token’s user). See Rate limits.

Request parameters

None.

Request body

Request payload

{
  "account_id": 5994
}

Response body

The payload is inside data.

Response payload

{
  "data": {
    "status": "success",
    "token": "<access-token>",
    "account_owner": {
      "user_id": 3011,
      "account_id": 5994,
      "expires_at": "2026-10-08T00:00:00+10:00",
      "prior_tokens_revoked": 0
    }
  }
}

Examples

Success payload

The first token for this owner, or the same token again: see Response payload.

A new token, with the previous one revoked:

{
  "data": {
    "status": "success",
    "token": "<access-token>",
    "account_owner": {
      "user_id": 3011,
      "account_id": 5994,
      "expires_at": "2026-10-08T00:00:00+10:00",
      "prior_tokens_revoked": 1
    }
  }
}

Error payload

403 Not a Partner token

{
  "message": "Forbidden",
  "status": "error",
  "errors": "Only partner users can mint brand-owner tokens."
}

403 Account outside your tree

{
  "message": "Forbidden",
  "status": "error",
  "errors": "Brand is not under your partner tree."
}

404 Not an account

account_id is a partner or a location, not an account.

{
  "message": "Not Found",
  "status": "error",
  "errors": "Company is not a brand."
}

404 Account has no owner

{
  "message": "Not Found",
  "status": "error",
  "errors": "Brand has no owner user."
}

422 account_id missing

{
  "message": "The account id field is required.",
  "errors": {
    "account_id": [
      "The account id field is required."
    ]
  }
}

422 Account doesn't exist

{
  "message": "The selected account id is invalid.",
  "errors": {
    "account_id": [
      "The selected account id is invalid."
    ]
  }
}

Example request

curl --request POST \
  --url "https://production-api.shoutaboutus.com/api/v1/partner/account-owner/token" \
  --header 'Authorization: Bearer <bearer-token>' \
  --header 'Accept: application/json' \
  --header 'Content-Type: application/json' \
  --data '{"account_id": 5994}'