Update a service account

Changes the three editable fields, display_name, redirect_uris and scopes. An absent field is left as it is.

display_name. null clears it. Every change is made under the identity's row lock, so a rename while another change runs is 409. On an identity without redirect URIs a rename is the gateway's own record: nothing is sent to the identity provider, whose client name is a fixed operator label. On one with redirect URIs the name is also the label its consent screen shows, so a rename is sent to the provider under the same rules as a redirect change (runs as the calling operator). A cleared name labels the consent screen with the service account's opaque id.

redirect_uris replaces the list whole, validated as on create. null or [] clears it, and the client loses authorization_code, refresh_token, openid and profile with it; a first URI earns them. A list equal to the stored one is not sent to the provider. A change is converged at the identity provider first — the URIs, the grants and scopes they imply, and the client's registration metadata — and recorded here only once the provider accepts it, so a refusal changes nothing. The scopes sent never widen the client: they are the service account's scopes that the client still holds at the provider, unless the same request sets scopes. A non-empty list needs a live secret credential (409 otherwise: mint one first). One change to an identity runs at a time; a second while one is in flight, or while its secret is being revoked, is 409 — retry. Runs as the calling operator when the list changes — the caller's bearer is forwarded.

scopes replaces the set whole, validated as on create; null is 400. It may narrow or widen: the scopes are a ceiling over the identity's seats, so widening never grants beyond them. A changed set is converged at the identity provider first, as a redirect change is, and recorded here once the provider accepts it; an unchanged set makes no provider call. It takes effect on the next token a credential is exchanged for: a token already issued keeps its scopes until it expires. oauth-clients:manage cannot sit beside redirect_uris: 400 when the body sets both, 409 when the stored list is non-empty. Runs as the calling operator when the set changes.

client_id, principal_type and credentials are what the identity is, and any other field is 400. A revoked service account is 404.

Who may update. The member who provisioned the identity, or an account admin (organization#clients_manage) over anyone's. Audited as updated.