# Generating a PAT through the API for another Identity **URL:** \ **Category:** SHF Discussion and Questions\ **Tags:** apis, authentication, identity-security-cloud\ **Created:** [July 11, 2023, 6:47pm UTC](https://developer.sailpoint.com/discuss/t/generating-a-pat-through-the-api-for-another-identity/14163 "2023-07-11T18:47:30Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![mcheek](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/mcheek/32/23705_2.png) [@mcheek](https://developer.sailpoint.com/discuss/u/mcheek)\ **Post date:** [July 11, 2023, 6:47pm UTC](https://developer.sailpoint.com/discuss/t/generating-a-pat-through-the-api-for-another-identity/14163/1 "2023-07-11T18:47:30Z")
I can’t seem to generate a PAT for a service account through the API because the /personal-access-tokens endpoint only wants to create tokens for the owner of the current token. Is there a way around this? Having to log in interactively as a service account is not the simplest thing to do. ---
**Author:** ![bostelmann](https://avatars.discourse-cdn.com/v4/letter/b/aca169/32.png) [@bostelmann](https://developer.sailpoint.com/discuss/u/bostelmann)\ **Post date:** [July 11, 2023, 7:15pm UTC](https://developer.sailpoint.com/discuss/t/generating-a-pat-through-the-api-for-another-identity/14163/2 "2023-07-11T19:15:29Z")
You should be able to create service account API Keys through: **Admin \> Global \> Security Settings \> API Management**. Refer to the [documentation](https://documentation.sailpoint.com/saas/help/common/api_keys.html) for more details. Let me know if that helps. ---
**Author:** ![mcheek](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/mcheek/32/23705_2.png) [@mcheek](https://developer.sailpoint.com/discuss/u/mcheek)\ **Post date:** [July 11, 2023, 8:18pm UTC](https://developer.sailpoint.com/discuss/t/generating-a-pat-through-the-api-for-another-identity/14163/3 "2023-07-11T20:18:38Z")
Yes, but that doesn’t create a token with the same permissions as a specific user. In this particular example, I want to create a token that will be able to create accounts in a specific CSV source, and the [documentation](https://developer.sailpoint.com/idn/api/v3/create-account) for that endpoint specifies a token with ORG\_ADMIN is required. I’m not sure you can generate a token through API Management with those permissions ---
**Author:** ![bostelmann](https://avatars.discourse-cdn.com/v4/letter/b/aca169/32.png) [@bostelmann](https://developer.sailpoint.com/discuss/u/bostelmann)\ **Post date:** [July 11, 2023, 11:06pm UTC](https://developer.sailpoint.com/discuss/t/generating-a-pat-through-the-api-for-another-identity/14163/4 "2023-07-11T23:06:55Z")
It indicates specifically in Step 5 of the documentation I referenced, that you can specify specific scopes. Please double check and let me know if that helps. ---
**Author:** ![mcheek](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/mcheek/32/23705_2.png) [@mcheek](https://developer.sailpoint.com/discuss/u/mcheek)\ **Post date:** [July 12, 2023, 12:29pm UTC](https://developer.sailpoint.com/discuss/t/generating-a-pat-through-the-api-for-another-identity/14163/5 "2023-07-12T12:29:37Z")
I generated a new app token and gave it sp:scopes:all, but I get a 403 when trying to hit the /access-request-status endpoint, which the docs say require a token with ORG\_ADMIN. I am, however, able to update an account using the same token, which also says requires ORG\_ADMIN, so I guess I’m a little confused as to why one works and one doesn’t ![image](https://global.discourse-cdn.com/sailpoint/original/2X/0/02a870b26de80145de52d0619eb82f80b5e2e783.png) ---
**Author:** ![bostelmann](https://avatars.discourse-cdn.com/v4/letter/b/aca169/32.png) [@bostelmann](https://developer.sailpoint.com/discuss/u/bostelmann)\ **Post date:** [July 12, 2023, 1:07pm UTC](https://developer.sailpoint.com/discuss/t/generating-a-pat-through-the-api-for-another-identity/14163/6 "2023-07-12T13:07:50Z")
hmm, that is interesting. Unfortunately, I don’t have a tenant to test this out in. I do know API Scopes were introduced recently, this year or late last year. Perhaps it’s some growing pains that need to be ironed out. I wonder if this is because you are hitting the access-request API, they may have bared it off because there is no identity associated with the request. It wouldn’t be good to be able to submit an access request anonymously, would it? I understand you are requesting the status, but I suspect it lies in the same family of endpoints. I would ask SailPoint directly if this is working as expected. If they believe it is, then they should be able to offer up another solution. I do feel we are headed down the right path as tying service account API keys to user identities would be bad practice. The only other option would be to create a service identity using the Identity Admins source. This isn’t a bad solution, just a bit more tedious. ---
**Author:** ![mcheek](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/mcheek/32/23705_2.png) [@mcheek](https://developer.sailpoint.com/discuss/u/mcheek)\ **Post date:** [July 12, 2023, 6:04pm UTC](https://developer.sailpoint.com/discuss/t/generating-a-pat-through-the-api-for-another-identity/14163/7 "2023-07-12T18:04:17Z")
We actually have identities for non-human accounts like AD service accounts or bots, so it was actually kinda straight-forward to provision it the correct access then generate a token for it. You’re right though, we don’t necessarily want anonymous access requests being created externally, which is why we generated a PAT for our ServiceNow service account in AD. I’ve had an issue [specifically with this API endpoint permission](https://developer.sailpoint.com/discuss/t/access-request-status-endpoint-why-is-org-admin-required-to-view-access-requests-for-others/5739) because I wanted a token generated for PowerBI to be able to read access requests for other users. Since it can’t, I had to re-use my ServiceNow ORG\_ADMIN credentials for Power BI ---
**Author:** ![mcheek](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/mcheek/32/23705_2.png) [@mcheek](https://developer.sailpoint.com/discuss/u/mcheek)\ **Post date:** [August 8, 2023, 4:34pm UTC](https://developer.sailpoint.com/discuss/t/generating-a-pat-through-the-api-for-another-identity/14163/8 "2023-08-08T16:34:03Z")
@bostelmann I know you’ve been losing sleep thinking about this, but I looked into the API docs and figured out how to see what scopes are required for a given API call, and notably missing are scopes for account activities and access requests… which are kind of a big deal @colin_mckibben is there any guidance on generating PATs for non-human identities vs doing it through API management for these use cases? ![image](https://global.discourse-cdn.com/sailpoint/original/2X/2/2b51f11344422218300d6925eb6323a9673355e8.png) ![image](https://global.discourse-cdn.com/sailpoint/original/2X/0/04cf6e34127435a5e566e569a5ec4e7d1015aac0.png) ---
**Author:** ![colin\_mckibben](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/colin_mckibben/32/37182_2.png) [@colin\_mckibben](https://developer.sailpoint.com/discuss/u/colin_mckibben)\ **Post date:** [August 8, 2023, 4:41pm UTC](https://developer.sailpoint.com/discuss/t/generating-a-pat-through-the-api-for-another-identity/14163/9 "2023-08-08T16:41:39Z")
It is preferable to create non-human identities for the purpose of creating access tokens for automations. I have documented a simple process for doing this here. > **[Service Accounts | SailPoint Developer Community](https://developer.sailpoint.com/idn/api/service-accounts)** > > Read this guide to learn how to create service accounts that can generate API tokens to be used in integrations. ---
**Author:** ![mcheek](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/mcheek/32/23705_2.png) [@mcheek](https://developer.sailpoint.com/discuss/u/mcheek)\ **Post date:** [August 8, 2023, 5:16pm UTC](https://developer.sailpoint.com/discuss/t/generating-a-pat-through-the-api-for-another-identity/14163/10 "2023-08-08T17:16:52Z")
Thanks for the info. Correct me if I am wrong, but as admins, we do not have the ability to generate a PAT for another identity, right? It requires us to be logged in as that identity, correct? ---
**Author:** ![colin\_mckibben](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/colin_mckibben/32/37182_2.png) [@colin\_mckibben](https://developer.sailpoint.com/discuss/u/colin_mckibben)\ **Post date:** [August 8, 2023, 5:30pm UTC](https://developer.sailpoint.com/discuss/t/generating-a-pat-through-the-api-for-another-identity/14163/11 "2023-08-08T17:30:27Z")
Correct. You have to be logged in as the user to generate a token as them. ---
**Author:** ![mcheek](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/mcheek/32/23705_2.png) [@mcheek](https://developer.sailpoint.com/discuss/u/mcheek)\ **Post date:** [August 8, 2023, 5:36pm UTC](https://developer.sailpoint.com/discuss/t/generating-a-pat-through-the-api-for-another-identity/14163/12 "2023-08-08T17:36:21Z")
I assumed that was the case… please allow me to provide a bit of feedback on the steps I must go through for this process. Note that we create identities for (AD) Service Accounts because we utilize ServiceNow and the IDN API to request and provision access for these accounts. How I generate PATs for these accounts depends on whether or not I want to bypass SSO. **If I am logging in using SSO** 1. If we are to log in using SSO for these accounts, we have to set up 2FA for that user in Okta. This is not ideal from our perspective because we don’t typically own these accounts. I mentioned [in another thread](https://developer.sailpoint.com/discuss/t/mfa-services-for-identitynow/98/22) how the deprecation of strong auth limits our ability to selectively deploy MFA to users, and this is such a case 2. If this is the first time this account is logged in, I’m required to set up security questions or alternate contact info for strong auth. Again, not ideal to do this for an account I do not own. 3. Once logged in, I can go and generate a PAT for that user **If I was to bypass SSO** 1. First, I need to reset the password for that identity. This would be much more difficult if we had emails going directly to the user, but thankfully in our case, we have them all going to a single support mailbox. This would not be possible if we had emails going directly to users and the Service Account didn’t have a mailbox. Mail-enabled service accounts are in the minority in my org. 2. Once a new password is set, I attempt to log in with the new credentials I’ve chosen. Last time I tried to do this, I could not log in and kept getting “Authentication Failed” error messages, leading to me becoming so frustrated I just generated application client creds. 3. If this is the first time this account is logged in, I’m required to set up security questions or alternate contact info for strong auth. Again, not ideal to do this for an account I do not own. 4. Once logged in, I can go and generate a PAT for that user In my opinion, this involves far more steps than it should, and I would hope that it’s possible to allow admins to generate PATs for another user. ---
**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\ **Post date:** [October 7, 2023, 5:36pm UTC](https://developer.sailpoint.com/discuss/t/generating-a-pat-through-the-api-for-another-identity/14163/13 "2023-10-07T17:36:37Z")
This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.