---
title: "Make a service account. Its client secret is in this response only."
method: POST
path: "/v1/organizations/current/service-accounts"
tags: ["organizations"]
---

# Make a service account. Its client secret is in this response only.

`POST /v1/organizations/current/service-accounts`

## Request

- Base URL: `https://api.50heads.com`
- URL: `https://api.50heads.com/v1/organizations/current/service-accounts`
- Auth: HTTP bearer

Organization admins only (403 `organization_admin_required`), on a browser session with a fresh proof in the `x-50h-reauth` header (401 `reauth_required`). It needs a person: API keys, connected apps and service accounts get 403 `session_required`. Every change is written to the organization's audit. It acts in the workspace you choose (the organization's main workspace by default) with the admin role there, limited by its scopes, and spends up to its daily and per-question caps. Up to 50 (409 `too_many_service_accounts`). With `authMethod: private_key_jwt`, send your public keys in `jwks` and no secret is made. Behind the `machineIdentities` sub-flag: 404 `not_found` while it is off. A service account gets tokens from https://auth.50heads.com/token with `grant_type=client_credentials` and its client id and secret (HTTP Basic or the body) or a private_key_jwt assertion; no refresh token, ask again when it expires.

## Request body

- OrganizationServiceAccountCreateRequest
  - `name` string, required
  - `scopes` string[], required
  - `capDailyPence` integer, required
  - `capPerQuestionPence` integer, nullable
  - `workspaceId` string
  - `authMethod` 'client_secret' | 'private_key_jwt'
  - `jwks` object
    - `keys` object[], required
      - `kty` 'EC' | 'RSA', required
      - `kid` string
      - `alg` 'ES256' | 'RS256'
      - `use` 'sig'
      - `crv` string
      - `x` string
      - `y` string
      - `n` string
      - `e` string

## Response `201`

OK

- OrganizationServiceAccountCreateResponse
  - `serviceAccount` object, required
    - `id` string, required
    - `name` string, required
    - `organizationId` string, required
    - `workspaceId` string, required
    - `workspaceName` string, required
    - `status` 'active' | 'disabled', required
    - `scopes` string[], required
    - `capDailyPence` integer, required
    - `capPerQuestionPence` integer, nullable, required
    - `spentTodayPence` integer, required
    - `clientId` string, required
    - `authMethod` 'client_secret' | 'private_key_jwt', required
    - `secrets` object[], required
      - `id` string, required
      - `hint` string, required
      - `createdAt` string, required
      - `expiresAt` string, nullable, required
      - `lastUsedAt` string, nullable, required
    - `jwks` object, nullable, required
      - `keys` object[], required
        - `kty` 'EC' | 'RSA', required
        - `kid` string
        - `alg` 'ES256' | 'RS256'
        - `use` 'sig'
        - `crv` string
        - `x` string
        - `y` string
        - `n` string
        - `e` string
    - `createdAt` string, required
    - `createdBy` object, nullable, required
      - `id` string, required
      - `name` string, nullable, required
    - `lastUsedAt` string, nullable, required
    - `disabledAt` string, nullable, required
  - `clientSecret` string, nullable, required
  - `tokenEndpoint` string, required

## Other responses

- `400`: The request is not valid; `error.details.validation` lists the fixes.
- `401`: No key or token, or it expired or was revoked.
- `403`: The key or token lacks the scope (`insufficient_scope`), or the action is not allowed.
- `429`: Too many requests; wait for Retry-After.

---

[API](https://skmtc.dev/50heads/apis/50heads-api.md) · [All operations](https://skmtc.dev/50heads/apis/50heads-api/llms.txt) · [OpenAPI document](https://skmtc.dev/50heads/apis/50heads-api/revisions/edbfecb1e360?raw)