Archive a service account
⚠️
Preview — this feature is being built; the design below is the spec.
POST https://app.syntic.ai/v1/organizations/service_accounts/{service_account_id}/archiveStop a service account from authenticating. Its keys are disabled (not deleted) and its trust rules stop matching, effective within 60 seconds. Usage history is kept. Archiving is reversible with unarchive.
For how this fits into a full workflow, see Service accounts.
Headers
| Header | Required | Value |
|---|---|---|
Authorization | Yes | Bearer <admin key>: an Admin API key (sk_admin_...). Inference keys are refused with 403 admin_key_required. See Admin API keys. |
syntic-beta | Yes, while in preview | admin-2026-11-01. Without it the call fails with 400 beta_required. See Versioning. |
Idempotency-Key | No | Up to 255 characters. Retrying with the same key within 24 hours returns the first result instead of acting twice. See Idempotency. |
Path parameters
| Parameter | Type | Description |
|---|---|---|
service_account_id | string | The service account id, starting with svcacct_. |
Response
200 OK, Content-Type: application/json
{
"id": "svcacct_01JCH7K9M1P3R5T7V9X1",
"type": "service_account",
"name": "ci-billing",
"description": "Release pipeline for the billing service",
"workspace_id": "wrkspc_01JC0A2C4E6G8J0L2N4Q",
"permissions": [
"inference",
"files"
],
"status": "archived",
"api_key_count": 1,
"trust_rule_count": 2,
"created_by": "user_01J9Y0A2C4E6G8J0L2N4",
"created_at": "2026-10-20T09:00:00Z",
"last_used_at": "2026-11-05T09:58:12Z"
}| Field | Type | Description |
|---|---|---|
id | string | Starts with svcacct_. |
workspace_id | string | Service accounts belong to exactly one workspace; usage is billed there. |
permissions | array | Any of inference, agents, files. Service accounts never get Admin API access. |
status | string | active or archived. Archived accounts cannot authenticate. |
api_key_count | integer | Keys owned by the account. Keys are created in the Console. |
trust_rule_count | integer | Workload identity rules that let external tokens act as this account. |
last_used_at | string or null | Last request made with one of its keys or tokens. |
Examples
curl -sS -X POST "https://app.syntic.ai/v1/organizations/service_accounts/svcacct_01JCH7K9M1P3R5T7V9X1/archive" \
-H "Authorization: Bearer $SYNTIC_ADMIN_KEY" \
-H "syntic-beta: admin-2026-11-01" \
-H "Idempotency-Key: 8d6f0c1e-4b2a-4a57-9f0e-2f1d3c4b5a69"Errors
Errors use the error envelope and carry a request_id. Codes specific to this operation:
| Status | type | code | When |
|---|---|---|---|
| 400 | invalid_request_error | beta_required | The syntic-beta header is missing. |
| 404 | not_found_error | service_account_not_found | No service account with this id in the organization. |
| 401 | authentication_error | invalid_api_key | The admin key is missing, unknown, revoked or expired. |
| 403 | permission_error | admin_key_required | An inference key was used. |
| 429 | rate_limit_error | rate_limited | Too many requests; wait for Retry-After. See Rate-limit headers. |
Was this page helpful?