Token Operations | HashiCorp

Deliberately scoped: this resource covers what an automation credential should reasonably do — inspect, renew, and revoke tokens. There is no token/create for minting arbitrary new tokens with elevated policies; that's an admin operation, out of scope for a workflow-automation node.

lookupSelf

Returns the calling token's own TTL, policies, and renewable flag. No path parameter, mutates nothing — the natural credential-health-check candidate.

Field	Type	Required
None — uses whichever token `authMethod`/`credentialID` resolved.

Example response:

{
  "accessor": "8cLxNRJj...",
  "ttl": 2764800,
  "renewable": true,
  "policies": ["default", "myapp-readonly"],
  "displayName": "approle"
}

Use as a pre-flight check: call lookupSelf at the start of a workflow to confirm the resolved token is still valid and see its remaining TTL, before running the rest of the workflow's Secrets/Lease calls.

lookupByAccessor

Inspects a different token — e.g. a child token minted earlier — using only its accessor, without ever needing that token's raw value.

Field	Type	Required	Description
`accessor`	text	✓ Yes	The token's accessor (not the raw token value).

Response shape matches lookupSelf's.

renewSelf

Extends the calling token's own TTL before it expires mid-workflow.

Field	Type	Required	Description
`incrementSeconds`	number	No	Requested TTL extension. Vault may cap the returned TTL below what was requested.

Example response:

{ "accessor": "8cLxNRJj...", "leaseDuration": 3600 }

renewByAccessor

Extends a delegated/child token's TTL, identified by accessor.

Field	Type	Required	Description
`accessor`	text	✓ Yes	The token's accessor.
`incrementSeconds`	number	No	Requested TTL extension.

revokeByAccessor

Cleans up a short-lived child token, identified by accessor.

Field	Type	Required	Description
`accessor`	text	✓ Yes	The token's accessor.

Example response:

{ "accessor": "8cLxNRJj..." }

renewSelf / renewByAccessor error mapping is context-aware: a 403 from Vault on either renew operation maps to HASHICORP_TOKEN_EXPIRED if Vault's own error text mentions "expired," to HASHICORP_LEASE_NOT_RENEWABLE if the token simply isn't renewable, and to HASHICORP_PERMISSION_DENIED otherwise — see Error Codes.