---
title: "Create a service account"
method: POST
path: "/admin/service-accounts"
tags: ["Service Accounts"]
---

# Create a service account

`POST /admin/service-accounts`

Create a service account with optional initial role bindings; the client secret is returned only once.

## Headers

- `X-Pinecone-Api-Version` string, required

## Request body

- CreateServiceAccountRequest
  - `name` string, required — The human-readable name of the service account.
  - `role_bindings` RoleBindingInput[] — Optional initial role bindings. Omitting the field or passing an empty array creates the service account with no role bindings; roles can be added later via the role binding endpoints. A service account may be granted any organization- or project-scoped role. Not returned in the response.
    - `resource_type` string, required — The kind of resource scope a role binding applies to. Possible values: `organization`, `project`.
    - `resource_id` string — Project UUID. Required when `resource_type` is `project`; omit for `organization` scope.
    - `role` string, required — A role assigned to a principal at a resource scope.

## Response `201`

Service account created. Role bindings are not returned here; use `GET /admin/role-bindings` to list them.

- ServiceAccountWithSecret — A service account with a newly issued OAuth `client_secret`. The secret is returned only once and cannot be retrieved later.
  - `service_account` ServiceAccount, required — A service account. The OAuth `client_secret` is not included.
    - `id` string, uuid, required — The unique identifier for the service account. Use this as the path parameter on `/admin/service-accounts/{service_account_id}` endpoints and as the `principal_id` when querying or creating role bindings.
    - `name` string, required — A short human-readable label, set by the caller at creation time.
    - `client_id` string, required — The OAuth client ID used by the service account to obtain access tokens. Used only for OAuth token exchange.
    - `created_at` string, date-time, required — The date and time the service account was created.
    - `updated_at` string, date-time, required — The date and time of the service account's most recent metadata update.
  - `client_secret` string, required — The OAuth client secret. Returned exactly once. Treat this value as a credential — store it securely and never log it.

## Other responses

- `400` — Bad request. The request body included invalid request parameters.
- `401` — Unauthorized. Possible causes: Invalid API key.
- `403` — Forbidden
- `500` — Internal server error.
- `4XX` — Unexpected error on request.

---

[API](https://skmtc.dev/pinecone/apis/pinecone-admin-api.md) · [All operations](https://skmtc.dev/pinecone/apis/pinecone-admin-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/pinecone/pinecone-admin-api/revisions/8210e9d414c2/schema)