code: def _make_iam_token_request(request, principal, headers, body):
      
      iam_endpoint = _IAM_ENDPOINT.format(principal)
  
      body = json.dumps(body)
  
      response = request(
          url=iam_endpoint,
          method='POST',
          headers=headers,
          body=body)
  
      response_body = response.data.decode('utf-8')
  
      if response.status != http_client.OK:
          exceptions.RefreshError(_REFRESH_ERROR, response_body)
  
      try:
          token_response = json.loads(response.data.decode('utf-8'))
          token = token_response['accessToken']
          expiry = datetime.strptime(
              token_response['expireTime'], '%Y-%m-%dT%H:%M:%SZ')
  
          return token, expiry
  
      except (KeyError, ValueError) as caught_exc:
          new_exc = exceptions.RefreshError(
              '{}: No access token or invalid expiration in response.'.format(
                  _REFRESH_ERROR),
              response_body)
          six.raise_from(new_exc, caught_exc)
docs: Makes a request to the Google Cloud IAM service for an access token.
      Args:
          request (Request): The Request object to use.
          principal (str): The principal to request an access token for.
          headers (Mapping[str, str]): Map of headers to transmit.
          body (Mapping[str, str]): JSON Payload body for the iamcredentials
              API call.
  
      Raises:
          TransportError: Raised if there is an underlying HTTP connection
          Error
          DefaultCredentialsError: Raised if the impersonated credentials
          are not available.  Common reasons are
          `iamcredentials.googleapis.com` is not enabled or the
          `Service Account Token Creator` is not assigned