---
title: "POST /api/v1/config/service-accounts"
method: POST
path: "/api/v1/config/service-accounts"
tags: ["ServiceAccount"]
---

# POST /api/v1/config/service-accounts

`POST /api/v1/config/service-accounts`

## Request body

- Configv1CreateServiceAccountRequest
  - `service_account` Configv1ServiceAccount
    - `slug` string — Unique identifier of the ServiceAccount. If a `slug` isn't provided, one will be generated based of the `name` field. You can't modify this field after the ServiceAccount is created.
    - `name` string — Required. Name of the ServiceAccount. You can modify this value after the ServiceAccount is created.
    - `created_at` string, date-time — Timestamp of when the ServiceAccount was created. Cannot be set by clients.
    - `updated_at` string, date-time — Timestamp of when the ServiceAccount was last updated. Cannot be set by clients.
    - `token` string — token is the generated API token of the service account. Cannot be set by clients. token is only set once by the server in the CreateServiceAccount response. ReadServiceAccount will always return an empty token. Therefore, when creating a service account, clients are responsible for securely storing the response token on their end, as they will not be able to read it again.
    - `email` string — email is the generated email address of the service account. Cannot be set by clients.
    - `unrestricted` boolean — If set, grants the service account access to all Chronosphere APIs (including resource configuration and metric data) within the access controls defined by the service account's team membership. Exactly one of unrestricted or metrics_restriction must be set.
    - `metrics_restriction` ServiceAccountMetricsRestriction
      - `permission` 'READ' | 'WRITE' | 'READ_WRITE'
      - `labels` object — Optional labels which further restricts the service account to only read or write metrics with the given label names and values.
  - `dry_run` boolean — If true, the ServiceAccount isn't created, and no response ServiceAccount will be returned. The response will return an error if the given ServiceAccount is invalid.

## Response `200`

A successful response containing the created ServiceAccount.

- Configv1CreateServiceAccountResponse
  - `service_account` Configv1ServiceAccount
    - `slug` string — Unique identifier of the ServiceAccount. If a `slug` isn't provided, one will be generated based of the `name` field. You can't modify this field after the ServiceAccount is created.
    - `name` string — Required. Name of the ServiceAccount. You can modify this value after the ServiceAccount is created.
    - `created_at` string, date-time — Timestamp of when the ServiceAccount was created. Cannot be set by clients.
    - `updated_at` string, date-time — Timestamp of when the ServiceAccount was last updated. Cannot be set by clients.
    - `token` string — token is the generated API token of the service account. Cannot be set by clients. token is only set once by the server in the CreateServiceAccount response. ReadServiceAccount will always return an empty token. Therefore, when creating a service account, clients are responsible for securely storing the response token on their end, as they will not be able to read it again.
    - `email` string — email is the generated email address of the service account. Cannot be set by clients.
    - `unrestricted` boolean — If set, grants the service account access to all Chronosphere APIs (including resource configuration and metric data) within the access controls defined by the service account's team membership. Exactly one of unrestricted or metrics_restriction must be set.
    - `metrics_restriction` ServiceAccountMetricsRestriction
      - `permission` 'READ' | 'WRITE' | 'READ_WRITE'
      - `labels` object — Optional labels which further restricts the service account to only read or write metrics with the given label names and values.

## Other responses

- `400` — Cannot create the ServiceAccount because the request is invalid.
- `409` — Cannot create the ServiceAccount because there is a conflict with an existing ServiceAccount.
- `500` — An unexpected error response.
- `default` — An undefined error response.

---

[API](https://skmtc.net/chronosphere/apis/config-v1-api.md) · [All operations](https://skmtc.net/chronosphere/apis/config-v1-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/chronosphere/config-v1-api/revisions/530951bd2ccf/schema)