---
title: "Create a service account"
method: POST
path: "/orgs/{orgId}/service-accounts"
tags: ["Service Account", "experimental"]
---

# Create a service account

`POST /orgs/{orgId}/service-accounts`

Creates a new service account for the specified organization. The service account is created with the given display name and optional description, then invited with the specified permission rules and optional additional group memberships.

#### Scopes
**[OAuth 2.0 scopes](/cloud/admin/scopes/) required:** `write:service-accounts:admin`

## Path parameters

- `orgId` string, required

## Request body

- CreateServiceAccountRequest
  - `displayName` string, required — The display name for the service account. Must be between 6 and 30 characters.
  - `description` string — An optional description for the service account.
  - `permissionRules` PermissionRule[], required — A list of permission rules to assign to the service account. Each rule specifies a resource and role.
    - `resource` string, required — The ARI (Atlassian Resource Identifier) of the resource to grant access to. e.g. `ari:cloud:jira::site/{siteId}`
    - `role` string, required — The role to assign on the resource. e.g. `atlassian/user`
  - `additionalGroups` AdditionalGroup[] — An optional list of additional groups to add the service account to.
    - `directoryId` string, required — The ID of the directory containing the group.
    - `groupId` string, required — The ID of the group to add the service account to.

## Response `201`

Returned if the service account is successfully created.

- CreateServiceAccountResponse
  - `atlassianId` string, required — The Atlassian account ID of the created service account.
  - `id` string, required — The unique identifier of the created service account. Same value as `atlassianId`.
  - `email` string — The email address assigned to the created service account.
  - `displayName` string, required — The display name of the created service account.
  - `container` string — The ARI of the organization the service account belongs to. e.g. `ari:cloud:platform::org/{orgId}`
  - `updatedAt` integer — The timestamp (in milliseconds since epoch) when the service account was last updated.
  - `status` string, required — The status of the service account.

## Other responses

- `400` — Returned if the request is not in the correct format (e.g. displayName is blank, too short, or too long).
- `403` — Returned if the user does not have permission to create service accounts.
- `500` — Internal Error

---

[API](https://skmtc.net/atlassian/apis/api-access.md) · [All operations](https://skmtc.net/atlassian/apis/api-access/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/atlassian/api-access/revisions/412d18f78d91/schema)