---
title: "Gets a project-scoped user access token"
method: POST
path: "/users/v2/tokenExchange"
tags: ["Users"]
---

# Gets a project-scoped user access token

`POST /users/v2/tokenExchange`

Takes user access token, requested scope and returns project-scoped user access token.

## Request body

- object — An object containing user access token and requested scope of the access token.
  - `accessToken` string, required — HERE Account user access token, obtained from login endpoint.
  - `scope` string, required — Requested scope of the access token. Must be an HRN identifying a project that the identified user has access to.

## Response `200`

Success

The exchange was successful and a valid scoped access token was returned.

- object
  - `accessToken` string — Project-scoped access token.
  - `expiresIn` integer — The lifetime in seconds of the access token. For example 86400 means the token will expire in 24 hours from the time the response was generated.
  - `issuedTokenType` string — The type of token issued when grantType is "urn:ietf:params:oauth:grant-type:token-exchange".
  - `scope` string — Requested scope of the access token. Must be an HRN identifying a project that the identified user has access to.
  - `tokenType` string — The token type is 'Bearer'.

## Other responses

- `400` — Bad request The request object is in an incorrect format or has values that are invalid or out of range. If available, further error details are provided in the response body.
- `401` — Unauthorized The request did not provide correct authentication details
- `403` — Forbidden The account does not have the correct privileges
- `404` — Not Found The specified resource was not found

---

[API](https://skmtc.net/here/apis/tracking.md) · [All operations](https://skmtc.net/here/apis/tracking/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/here/tracking/revisions/efa162f7023c/schema)