AGagno
Service Accounts

Create Service Account

Mint a service account token. The plaintext token is returned exactly once.

post/service-accounts

Request

Request body

namestring required

Machine identity name (lowercase slug), e.g. 'claude-code' or 'github-actions'

expires_in_daysinteger nullable

Days until the token expires (default: 90)

never_expiresboolean

Mint a non-expiring token. Must be set explicitly; overrides expires_in_days.

allow_privileged_scopesboolean

Required to grant privileged scopes: any write or delete action, the admin scope, or any service_accounts scope. Privileged tokens must be deliberate, never accidental.

Response

Successful Response

idstring required
namestring required
principalstring required

The user_id attached to runs made with this token, e.g. 'sa:claude-code'

user_idstring nullable

The user this account belongs to; None for workspace-level accounts. Distinct from created_by, which records who minted the token.

token_prefixstring required

First characters of the token, for display only

created_atinteger required
expires_atinteger nullable
last_used_atinteger nullable
revoked_atinteger nullable
created_bystring nullable
tokenstring required

The plaintext token. Shown exactly once - store it securely now.

Changes

No recorded changes to this operation across all 1 revision of this API.