The service account object

⚠️

Preview — this feature is being built; the design below is the spec.

The service_account object as the API returns it. Every field below appears in every response that returns this object; fields with no value are null rather than missing.

Example

{
  "id": "svcacct_01JCH7K9M1P3R5T7V9X1",
  "type": "service_account",
  "name": "ci-billing",
  "description": "Release pipeline for the billing service",
  "workspace_id": "wrkspc_01JC0A2C4E6G8J0L2N4Q",
  "permissions": [
    "inference",
    "files"
  ],
  "status": "active",
  "api_key_count": 1,
  "trust_rule_count": 2,
  "created_by": "user_01J9Y0A2C4E6G8J0L2N4",
  "created_at": "2026-10-20T09:00:00Z",
  "last_used_at": "2026-11-05T09:58:12Z"
}

Fields

Field	Type	Description
`id`	string	Starts with `svcacct_`.
`type`	string	The object type, always `service_account`.
`name`	string	Name shown in the Console and in reports.
`description`	string	Free-text description.
`workspace_id`	string	Service accounts belong to exactly one workspace; usage is billed there.
`permissions`	array	Any of `inference`, `agents`, `files`. Service accounts never get Admin API access.
`status`	string	`active` or `archived`. Archived accounts cannot authenticate.
`api_key_count`	integer	Keys owned by the account. Keys are created in the Console.
`trust_rule_count`	integer	Workload identity rules that let external tokens act as this account.
`created_by`	string	Who created it.
`created_at`	string	When it was created, RFC 3339 UTC (some older objects use Unix seconds).
`last_used_at`	string or null	Last request made with one of its keys or tokens.

Returned by

runner session

Was this page helpful?