v57

latestOpenAPI 3.1.0Apache-2.0raw.githubusercontent.com2026-08-012143051018.3 KB

Service Account

Retrieve Service Account status for current org

API service must be configured for Service Account access at the time of deployment. It cannot be enabled or disabled via API.

get/v2/org/{org}/nico/service-account/current

Response

enabledboolean

Indicates whether the calling token is authenticated as a Service Account. This is determined per request from how the token's issuer is configured at deployment time (the issuer config in the nico-rest-api-config ConfigMap); it cannot be toggled via the API. Rules by issuer origin:

keycloak: true for a client-credentials (service-to-service) token — i.e. the token carries a client ID — when the issuer is deployed with keycloak.serviceAccount: true.
custom: true when the claimMapping matched for this org sets isServiceAccount: true. Only permitted when the API runs in disconnected mode.
kas-ssa / kas-legacy: always false; service accounts are not supported for these origins.

For details on issuer origins and configuration, see the NICo REST auth module README.

infrastructureProviderIdstring uuid nullable

ID of the Infrastructure Provider associated with Service Account

tenantIdstring uuid nullable

ID of the Tenant associated with Service Account

Example response

{
  "enabled": true,
  "infrastructureProviderId": "e94bcfda-f6cb-42e4-80ec-516811e5abbf",
  "tenantId": "f97df110-f4de-492e-8849-4a6af68026b0"
}

All 214 operations