Service accounts

Non-human accounts that belong to a network

List a network's service accounts

Returns the non-human accounts that belong to this network, each carrying its network membership role and status alongside the account record. Requires read-only access to the network. Results are cursor-paginated: pass the returned cursor to fetch the next page.

Create a service account

Creates a non-human account in this network and, in the same operation, its network membership at the requested role (admin or viewer). Requires the administrator role, and you may only grant a membership role you yourself hold. The account starts active but owns no keys yet — mint one separately. If membership creation fails the new account is rolled back so no orphan identity is left behind.

Get a service account

Returns one service account in this network together with its membership role and status. Requires read-only access to the network.

Delete a service account

Permanently removes the service account. All of its active API keys are revoked first, then its network membership is removed, then the account record itself — so a partial failure can never leave live keys behind a deleted identity. Requires the administrator role.

Update a service account

Updates name, description, status, or membership role; at least one field must be supplied. Requires the administrator role, and raising the role is bounded by the role you hold. Status changes propagate to membership: setting status to disabled suspends the membership and immediately revokes all of the account's active keys, while re-activating restores the membership to active. Service accounts are exempt from the last-active-admin guard, which counts human members only.

List a service account's API keys

Lists the API keys owned by this service account, including revoked and expired ones; secret tokens are never returned. Requires read-only access to the network.

Mint an API key for a service account (token shown once)

Mints an API key owned by the service account and scoped to this network only. The plaintext token is returned in this response and only this response, so capture it right away. Requires the administrator role. The key's role defaults to the account's membership role and may be narrowed but never raised above it, and it can never exceed the minting admin's own role. Keys cannot be minted for a disabled account.

Revoke a service account's API key

Soft-revokes a single key belonging to this service account: it stops authenticating immediately but its record is retained. Requires the administrator role. A key id that does not belong to this account returns not found (404), and revoking an already-revoked key is a no-op that still succeeds.