latestOpenAPI 3.1.02026-07-26142186376.1 KB

5f6149d395d0

Service Accounts

Create Service Account

Mint a service account token. The plaintext token is returned exactly once.

post/service-accounts

Request body

namestring required

Machine identity name (lowercase slug), e.g. 'claude-code' or 'github-actions'

expires_in_daysinteger nullable

Days until the token expires (default: 90)

never_expiresboolean

Mint a non-expiring token. Must be set explicitly; overrides expires_in_days.

allow_privileged_scopesboolean

Required to grant privileged scopes: any write or delete action, the admin scope, or any service_accounts scope. Privileged tokens must be deliberate, never accidental.

Response

Successful Response

idstring required

namestring required

principalstring required

The user_id attached to runs made with this token, e.g. 'sa:claude-code'

user_idstring nullable

The user this account belongs to; None for workspace-level accounts. Distinct from created_by, which records who minted the token.

token_prefixstring required

First characters of the token, for display only

created_atinteger required

expires_atinteger nullable

last_used_atinteger nullable

revoked_atinteger nullable

created_bystring nullable

tokenstring required

The plaintext token. Shown exactly once - store it securely now.