---
title: "POST /api/v1/config/service-accounts"
method: POST
path: "/api/v1/config/service-accounts"
tags: ["ServiceAccount"]
---

# POST /api/v1/config/service-accounts

`POST /api/v1/config/service-accounts`

## Request body

- Configv1CreateServiceAccountRequest
  - `dry_run` boolean — If `true`, validates the specified configuration without creating the ServiceAccount. If the specified configuration is valid, the endpoint returns a partial response without the ServiceAccount. If the specified configuration is invalid, the endpoint returns an error.
  - `service_account` Configv1ServiceAccount
    - `created_at` string, date-time — Timestamp of when the ServiceAccount was created. Cannot be set by clients.
    - `email` string — The unique email user for this service account. Cannot be set by clients.
    - `metrics_restriction` ServiceAccountMetricsRestriction
      - `labels` object — Optional. Specifies labels that further restrict the service account to only read or write metrics with the given label names and values.
      - `permission` 'READ' | 'WRITE' | 'READ_WRITE', required
    - `name` string, required — The name of the ServiceAccount. You can modify this value after the ServiceAccount is created.
    - `slug` string — The unique identifier of the ServiceAccount. If a `slug` isn't provided, one is generated based on the `name` field. You can't modify this field after the ServiceAccount is created.
    - `token` string — Generated API token of the service account. Cannot be set by clients. The token is set only once by the server in the `CreateServiceAccount` response. The `ReadServiceAccount` response always returns an empty token. Therefore, when creating a service account, ensure you securely store the response token. If you lose the token, you must delete and recreate the service account to generate a new token.
    - `unrestricted` boolean — If set, grants the service account access to all Chronosphere APIs, including resource configuration and metric data within the access controls defined by the service account's team membership. Only one of `unrestricted` or `metrics_restriction` must be set.
    - `updated_at` string, date-time — Timestamp of when the ServiceAccount was last updated. Cannot be set by clients.

## Response `200`

A successful response containing the created ServiceAccount.

- Configv1CreateServiceAccountResponse
  - `service_account` Configv1ServiceAccount
    - `created_at` string, date-time — Timestamp of when the ServiceAccount was created. Cannot be set by clients.
    - `email` string — The unique email user for this service account. Cannot be set by clients.
    - `metrics_restriction` ServiceAccountMetricsRestriction
      - `labels` object — Optional. Specifies labels that further restrict the service account to only read or write metrics with the given label names and values.
      - `permission` 'READ' | 'WRITE' | 'READ_WRITE', required
    - `name` string, required — The name of the ServiceAccount. You can modify this value after the ServiceAccount is created.
    - `slug` string — The unique identifier of the ServiceAccount. If a `slug` isn't provided, one is generated based on the `name` field. You can't modify this field after the ServiceAccount is created.
    - `token` string — Generated API token of the service account. Cannot be set by clients. The token is set only once by the server in the `CreateServiceAccount` response. The `ReadServiceAccount` response always returns an empty token. Therefore, when creating a service account, ensure you securely store the response token. If you lose the token, you must delete and recreate the service account to generate a new token.
    - `unrestricted` boolean — If set, grants the service account access to all Chronosphere APIs, including resource configuration and metric data within the access controls defined by the service account's team membership. Only one of `unrestricted` or `metrics_restriction` must be set.
    - `updated_at` string, date-time — Timestamp of when the ServiceAccount was last updated. Cannot be set by clients.

## Other responses

- `400` — Cannot create the ServiceAccount because the request is invalid.
- `409` — Cannot create the ServiceAccount because there is a conflict with an existing ServiceAccount.
- `500` — An unexpected error response.
- `default` — An undefined error response.

---

[API](https://skmtc.dev/chronosphere/apis/data-v1-api.md) · [All operations](https://skmtc.dev/chronosphere/apis/data-v1-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/chronosphere/data-v1-api/revisions/ee91fd539ced/schema)