Query Regarding Google Access Token in Service Callout

[debjitd18]

Hi @dchiesa1 

Hope you are doing well! 

Explanation of current process - In our enterprise we are deploying the proxies with a Service Account (Apigee SA) attached to it. These proxies are interacting with Authenticated cloud run services in the backend, which needs access tokens minted by Google IAM token service.
The Apigee SA has been provided the Service Account OpenID Connect Identity Token Creator role in the target project.
In order to make a call to Google IAM token service we are making a Service Callout to this API, and pass the Service Account (Target SA) and Cloud Run URL (Target URL) as show in the code excerpt. 

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<ServiceCallout continueOnError="false" enabled="true" name="SC-GCPCredentialsAPI">
  <DisplayName>SC-GCPCredentialsAPI</DisplayName>
  <Properties/>
  <Request clearPayload="true" variable="gcpTokenRequest">
    <Set>
      <Headers>
        <Header name="Accept">application/json</Header>
      </Headers>
      <Verb>POST</Verb>
      <Payload contentType="application/json">{"audience":"{Target URL}"}</Payload>
    </Set>
    <IgnoreUnresolvedVariables>false</IgnoreUnresolvedVariables>
  </Request>
  <Response>gcpTokenResponse</Response>
  <HTTPTargetConnection>
    <Properties/>
    <Authentication>
      <!-- IAM Credentials API requires GCP access token-->
      <GoogleAccessToken>
        <Scopes>
          <!-- required for minting GCP access token for iamcredentials API-->
          <Scope>https://www.googleapis.com/auth/cloud-platform</Scope>
        </Scopes>
      </GoogleAccessToken>
    </Authentication>
    <URL>https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/{Target SA}:generateIdToken</URL>
  </HTTPTargetConnection>
</ServiceCallout>

Question - Is there a way we can print/or know the steps how the Google Access Token is obtained at runtime and passed over to the IAM Credentials API?
Is there any REST/Management API which is available to obtain this token and if yes how would it work from a Postman?

Thanks,

Debjit