Skip to content
Axowl

Service accounts

A service account is a machine ConnectedId (Type=Service) in an org. It is not an org member: it has no linked user, takes no seat, and never appears in the member list or in SCIM /Users. Base path: /api/org/{slug}/service-accounts (authenticated; requires the org.role.create scope).

Method · RoutePurposeSource
POST /Create a service account (Name, Scopes[], Description?)ServiceAccountEndpoints.cs
GET /List service accounts (Type=Service)ServiceAccountEndpoints.cs

What POST / does

Section titled “What POST / does”
  1. Creates a ConnectedId with Type=Service, UserId=null, MembershipType=None — a machine badge, not a membership.
  2. Creates a dedicated role (svc-{name}-{id8}).
  3. Adds each requested scope to that role (creating the Permission catalog entry if new).
  4. Assigns the role to the service account (snapshotting permissions).

So a service account’s permissions flow through the same RBAC model as human members — see Roles & permissions and Permission scopes. Because the badge has no linked user, service accounts are excluded from seat counting, member listings, SCIM provisioning, and the MembershipType derivation — see Connected ID.