Skip to content
Axowl

Service accounts

A service account is a non-human ConnectedId (a machine identity in an org), backed by a generated user and its own role. Base path: /api/org/{slug}/service-accounts (authenticated).

Method · RoutePurposeSource
POST /Create a service account (Name, Scopes[], Description?)ServiceAccountEndpoints.cs:22
GET /List service accounts:122

What POST / does

Section titled “What POST / does”
  1. Creates a dedicated user ({name}@service.{orgSlug}) to satisfy the identity FK.
  2. Creates a ConnectedId (TriggeredBy="ServiceAccount", MembershipType=Member).
  3. Creates a dedicated role (svc-{name}-{id8}).
  4. Adds each requested scope to that role (creating the Permission catalog entry if new).
  5. Assigns the role to the service account (snapshotting permissions).

So a service account’s permissions flow through the same RBAC model as human members — see Roles & permissions and Permission scopes. Service accounts are excluded from the MembershipType derivation (they keep an explicit type — see Connected ID).