Method: projects.serviceAccounts.signBlob

Signs a blob using a service account's system-managed private key.

HTTP request

POST https://iamcredentials.googleapis.com/v1/{name=projects/*/serviceAccounts/*}:signBlob

The URL uses gRPC Transcoding syntax.

Path parameters

Parameters
name

string

The resource name of the service account for which the credentials are requested, in the following format: projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}.

Authorization requires the following Google IAM permission on the specified resource name:

  • iam.serviceAccounts.signBlob

Request body

The request body contains data with the following structure:

JSON representation
{
  "delegates": [
    string
  ],
  "payload": string
}
Fields
delegates[]

string

The sequence of service accounts in a delegation chain. Each service account must be granted the roles/iam.serviceAccountTokenCreator role on its next service account in the chain. The last service account in the chain must be granted the roles/iam.serviceAccountTokenCreator role on the service account that is specified in the name field of the request.

The delegates must have the following format: projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}

payload

string (bytes format)

The bytes to sign.

A base64-encoded string.

Response body

If successful, the response body contains data with the following structure:

JSON representation
{
  "keyId": string,
  "signedBlob": string
}
Fields
keyId

string

The ID of the key used to sign the blob.

signedBlob

string (bytes format)

The signed blob.

A base64-encoded string.

Authorization Scopes

Requires one of the following OAuth scopes:

  • https://www.googleapis.com/auth/iam
  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.

Try it!

Was this page helpful? Let us know how we did:

Send feedback about...

Cloud Identity and Access Management