Create service account credential

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({expiresAt: '2023-11-07T05:31:56Z'})
};

fetch('https://api.k0rdent.ai/v1/regions/global/iam/service-accounts/{serviceAccountId}/credentials', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.k0rdent.ai/v1/regions/global/iam/service-accounts/{serviceAccountId}/credentials"

	payload := strings.NewReader("{\n  \"expiresAt\": \"2023-11-07T05:31:56Z\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

curl --request POST \
  --url https://api.k0rdent.ai/v1/regions/global/iam/service-accounts/{serviceAccountId}/credentials \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "expiresAt": "2023-11-07T05:31:56Z"
}
'

import requests

url = "https://api.k0rdent.ai/v1/regions/global/iam/service-accounts/{serviceAccountId}/credentials"

payload = { "expiresAt": "2023-11-07T05:31:56Z" }
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

{
  "uid": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "id": "cred-001",
  "serviceAccountId": "sa-pipeline-prod",
  "status": "active",
  "createdBy": "user-admin-001",
  "createdAt": "2023-11-07T05:31:56Z",
  "clientSecret": "plt_cs_cred-001_x9y8z7w6v5u4...",
  "selfLink": "/v1/iam/service-accounts/sa-pipeline-prod/credentials/cred-001",
  "expiresAt": "2023-11-07T05:31:56Z",
  "lastUsedAt": "2023-11-07T05:31:56Z",
  "lastUsedIp": "203.0.113.42"
}

{
  "error": {
    "code": 123,
    "message": "<string>",
    "details": [
      {}
    ]
  }
}

{
  "error": {
    "code": 123,
    "message": "<string>",
    "details": [
      {}
    ]
  }
}

{
  "error": {
    "code": 123,
    "message": "<string>",
    "details": [
      {}
    ]
  }
}

{
  "error": {
    "code": 123,
    "message": "<string>",
    "details": [
      {}
    ]
  }
}

{
  "error": {
    "code": 123,
    "message": "<string>",
    "details": [
      {}
    ]
  }
}

{
  "error": {
    "code": 123,
    "message": "<string>",
    "details": [
      {}
    ]
  }
}

{
  "error": {
    "code": 123,
    "message": "<string>",
    "details": [
      {}
    ]
  }
}

serviceaccounts

Create service account credential

Visibility: public · internal ( OpenAPI Custom Extension: x-visibility )

Generate a new client_secret for a service account. The secret is returned only in this response and cannot be retrieved again. Store it securely.

Only tenant administrators can create credentials.

A maximum of 5 active credentials are allowed per service account. This limit supports zero-downtime rotation: create a new credential, deploy it to your systems, then delete the old one.

If expiresAt is omitted, the organization’s default credential lifetime is applied. The value cannot exceed the org-level maximum.

POST

regions

global

iam

service-accounts

{serviceAccountId}

credentials

Create service account credential

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({expiresAt: '2023-11-07T05:31:56Z'})
};

fetch('https://api.k0rdent.ai/v1/regions/global/iam/service-accounts/{serviceAccountId}/credentials', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.k0rdent.ai/v1/regions/global/iam/service-accounts/{serviceAccountId}/credentials"

	payload := strings.NewReader("{\n  \"expiresAt\": \"2023-11-07T05:31:56Z\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

curl --request POST \
  --url https://api.k0rdent.ai/v1/regions/global/iam/service-accounts/{serviceAccountId}/credentials \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "expiresAt": "2023-11-07T05:31:56Z"
}
'

import requests

url = "https://api.k0rdent.ai/v1/regions/global/iam/service-accounts/{serviceAccountId}/credentials"

payload = { "expiresAt": "2023-11-07T05:31:56Z" }
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

{
  "uid": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "id": "cred-001",
  "serviceAccountId": "sa-pipeline-prod",
  "status": "active",
  "createdBy": "user-admin-001",
  "createdAt": "2023-11-07T05:31:56Z",
  "clientSecret": "plt_cs_cred-001_x9y8z7w6v5u4...",
  "selfLink": "/v1/iam/service-accounts/sa-pipeline-prod/credentials/cred-001",
  "expiresAt": "2023-11-07T05:31:56Z",
  "lastUsedAt": "2023-11-07T05:31:56Z",
  "lastUsedIp": "203.0.113.42"
}

{
  "error": {
    "code": 123,
    "message": "<string>",
    "details": [
      {}
    ]
  }
}

{
  "error": {
    "code": 123,
    "message": "<string>",
    "details": [
      {}
    ]
  }
}

{
  "error": {
    "code": 123,
    "message": "<string>",
    "details": [
      {}
    ]
  }
}

{
  "error": {
    "code": 123,
    "message": "<string>",
    "details": [
      {}
    ]
  }
}

{
  "error": {
    "code": 123,
    "message": "<string>",
    "details": [
      {}
    ]
  }
}

{
  "error": {
    "code": 123,
    "message": "<string>",
    "details": [
      {}
    ]
  }
}

{
  "error": {
    "code": 123,
    "message": "<string>",
    "details": [
      {}
    ]
  }
}

Authorizations

Authorization

string

header

required

Bearer token authentication using OAuth2/OIDC tokens

Path Parameters

serviceAccountId

string

required

Service account resource identifier.

Body

application/json

expiresAt

string<date-time>

Requested expiration timestamp. Cannot exceed the org-level maximum credential lifetime. Defaults to org default if omitted.

Response

Credential created. The client_secret is included in this response only and cannot be retrieved again.

Credential metadata plus the client_secret. The secret is only returned at creation time.

uid

string<uuid>

required

read-only

Server-generated UUID. Immutable.

string

required

read-only

Credential identifier. Server-generated, immutable.

Example:

"cred-001"

serviceAccountId

string

required

read-only

The parent service account this credential belongs to.

Example:

"sa-pipeline-prod"

status

enum<string>

required

read-only

Current credential status.

active: can be used to authenticate.
expired: past expiresAt. Terminal; cannot be re-enabled.

Note: if the parent service account is disabled, all its credentials are effectively unusable regardless of their individual status.

Available options:

active,

expired

Example:

"active"

createdBy

string

required

read-only

User ID of the administrator who created this credential.

Example:

"user-admin-001"

createdAt

string<date-time>

required

read-only

Timestamp when the credential was created.

clientSecret

string

required

The client secret value. Store securely — this value cannot be retrieved again.

Example:

"plt_cs_cred-001_x9y8z7w6v5u4..."

selfLink

string<uri>

read-only

Server-defined URL for this resource.

Example:

"/v1/iam/service-accounts/sa-pipeline-prod/credentials/cred-001"

expiresAt

string<date-time>

Credential expiration timestamp. If not set at creation, defaults to the organization's configured maximum credential lifetime. Cannot exceed the org-level maximum.

lastUsedAt

string<date-time>

read-only

Timestamp of the last successful token mint using this credential. Null if never used.

lastUsedIp

string

read-only

IP address from which this credential was last used.

Example:

"203.0.113.42"

Platform APIs

Shared API Spec

Apps Team APIs Dev

Draft APIs

Archived APIs

Create service account credential

Authorizations

Path Parameters

Body

Response