List service accounts

The account's service accounts — principal_type is always service_account. An agent's identity is listed on its agent, and the platform's own identities are not listed at all.

Active only by default. A revoked row is kept (the audit trail names it as an actor) and is listed when asked for with filter[principal_status][eq]=revoked.

Narrowed through the shared query grammar rather than bespoke parameters: filter[principal_status][eq], filter[client_id][eq], filter[principal_id][eq], filter[created_by][eq] (a member's own: the identities they provisioned), filter[display_name][contains], and q= for a case-insensitive substring over display_name. sort, limit/offset and count=false behave as they do on every other collection. Credential material is never returned — each row's credentials array carries only the kind, expiry and last use of the credentials the identity holds, never a secret or a handle.

Last use. Each credentials entry carries last_used_at, when the identity provider last saw that credential authenticate, whether through the gateway or presented to the provider directly, and is_last_use_known. The page reads the provider once per 100 rows that hold a credential, best-effort: when the provider cannot be read in time, the affected entries carry is_last_use_known: false and no last_used_at, and the list still succeeds. is_last_use_known: true with no last_used_at means the credential's current secret has not been used since it was issued or last rotated. A secret issued before the provider began recording use, or a credential the provider does not hold, is false: its disuse cannot be told from unrecorded use.

Fields: principal_id, principal_type, principal_status, client_id, created_by, created_at.