service-accounts

Revoke a machine identity

Soft-deletes the whole identity: every live credential is revoked at the provider, then the row here is retired, its credential records are marked revoked, and every workspace seat it holds is dropped. Nothing is erased, and the identity provider's OIDC client is not archived — it is left holding no live credential.

The provider first, deliberately. Each credential is revoked before anything local changes; if the provider refuses, the row stays active and the caller sees why. The reverse would leave a retired row beside a working credential — the state nobody can discover. A credential the provider no longer has (expired and purged, or revoked out of band) is already in the end state and does not block the delete.

The row stays readable. status becomes revoked and revoked_at is stamped; the row is not removed, because every audit event this principal produced names it as the actor. Once revoked, the bind check rejects every token on next verify. Seats are dropped whatever their role (admin, builder, viewer). Returns the retired row (its credentials now empty) rather than 204.

Audited. The retire is a deleted service_principal event, each revoked credential a deleted service_principal_credential event, and each dropped seat a deleted workspace member event — all attributed to the caller.

Idempotent, and a retry finishes the job. If a step fails part-way (503), repeating the call revokes what is still live and drops the seats still held; a fully revoked identity answers its recorded state without calling the provider.

Who may revoke. The member who provisioned the identity, or an account admin (organization#clients_manage) over anyone's. Runs as the calling operator — the caller's bearer is forwarded to the provider.

delete/registry/v1/service-accounts/{principal_id}

Request

  • Base URL: https://api.atlan.com (the document declares no server; this is the origin it was published from)
  • URL: https://api.atlan.com/registry/v1/service-accounts/{principal_id}
  • Auth: HTTP bearer

Path parameters

principal_idstring required

The durable principal id

Response

The retired identity.

client_idstring required

Stable identifier of the related client resource.

created_atstring required

Value of the created_at field.

created_bystring nullable

Value of the created_by field.

display_namestring nullable

Human-readable name.

idstring required

Stable identifier of this resource.

principal_typestring required

Always service_account: this surface lists and serves no other identity.

redirect_urisstring[] required

The client's OAuth redirect URIs; empty for a machine-only client. Non-empty means the client may run the authorization-code flow (authorization_code and refresh_token beside client_credentials). Changed with PATCH.

revoked_atstring nullable

Value of the revoked_at field.

scopesstring[] required

The client's scopes: the ceiling over what its seats allow. A subset of contextplane:read, contextplane:write, contextplane:manage and oauth-clients:manage. Changed with PATCH. A client with redirect_uris additionally holds openid and profile at the identity provider; they are derived, not stored here.

statusstring required

Current lifecycle state.

updated_atstring nullable

RFC 3339, when the identity was last renamed or its redirect URIs or scopes changed. Absent if none of that has happened.

Changes

No recorded changes to this operation across all 1 revision of this API.