> ## Documentation Index
> Fetch the complete documentation index at: https://team.k0labs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Permanently delete service account

> **Visibility:** `public` · `internal` ( OpenAPI Custom Extension: x-visibility )

Hard-delete a service account and all its credentials. This
action is irreversible. All credentials are immediately
unusable.

Only tenant administrators can delete service accounts.
Non-admin callers receive 404 to prevent resource enumeration.

Recommended workflow: disable the service account via PATCH
first, confirm no active workloads are affected, then delete.




## OpenAPI

````yaml api-docs/k0rdent-api.json delete /v1/regions/global/iam/service-accounts/{id}
openapi: 3.1.0
info:
  title: K0rdent AI API
  version: 0.2.0-draft
  description: >
    OpenAPI specification for the K0rdent AI GPU-as-a-Service platform.

    **Custom Extensions:**

    - `x-visibility`: Endpoint visibility — `internal` (Atlas only), `public`
    (Arc only), `[internal, public]` (common)

    - `x-status`: Implementation status — `mvp`, `tbd`, `blocked`, `stretch`

    - `x-source`: Source document reference or `TBD` for fields pending
    confirmation

    **Error Model:** Standard `{ error: { code, message, details[] } }`
    envelope.

    **Pagination:** All list endpoints support two modes:

    - **Cursor** (`pageToken` + `pageSize`): Use for frequently updated
    resources. Prevents skipped or duplicated items across pages.
    `nextPageToken` is returned; `total` is not.

    - **Offset** (`offset` + `pageSize`): Use for stable resources. Returns
    `total` for page-count UIs. `nextPageToken` is not returned.

    `pageToken` and `offset` are mutually exclusive. Default `pageSize` is 50,
    maximum is 500.
servers:
  - url: https://api.k0rdent.ai
    description: K0rdent AI API Gateway
security:
  - bearerAuth: []
tags:
  - name: clusters
    description: Kubernetes cluster management
  - name: kubeconfigs
    description: Kubeconfig issuance and management
  - name: instances
    description: VM and baremetal instance lifecycle
  - name: networks
    description: Network configuration and topology
  - name: addresses
    description: IP address management
  - name: servers
    description: Bare metal server lifecycle management
  - name: organizations
    description: Organization (tenant) management
  - name: projects
    description: Project resource grouping
  - name: authentication
    description: Authentication and session management
  - name: users
    description: User management
  - name: groups
    description: User group management
  - name: roles
    description: RBAC role definitions
  - name: policies
    description: IAM policy bindings
  - name: providers
    description: Identity provider configuration
  - name: token
    description: >
      Generate access token via multiple grant types (authorization_code,
      api_key, client_credentials).
  - name: check
    description: >
      Evaluate permissions for a principal against actions and resources.
      Supports single and bulk checks (up to 100).
  - name: introspect
    description: >
      Token introspection per RFC 7662. Validate token activity and retrieve
      full decoded claims.
  - name: revoke
    description: >
      Token revocation per RFC 7009. Explicitly invalidate access tokens before
      natural expiration.
  - name: sessions
    description: >
      Manage user browser sessions. Supports listing active sessions, creating a
      new session (login), and ending the current session (logout).
  - name: apikeys
    description: >
      Manage API keys for programmatic access. API keys are bound to a user and
      inherit a dynamic subset of the user's privileges, evaluated at token-mint
      time.

      Keys are scoped to a level in the resource hierarchy (organization, or
      project).
  - name: serviceaccounts
    description: |
      Manage service accounts for machine-to-machine and infrastructure
      access. Service accounts are independent principals with their own
      identity, role bindings, and credentials. They survive user
      off-boarding and are managed exclusively by tenant administrators.
paths:
  /v1/regions/global/iam/service-accounts/{id}:
    parameters:
      - name: id
        in: path
        required: true
        description: Service account resource identifier.
        schema:
          type: string
    delete:
      tags:
        - serviceaccounts
      summary: Permanently delete service account
      description: >
        **Visibility:** `public` · `internal` ( OpenAPI Custom Extension:
        x-visibility )


        Hard-delete a service account and all its credentials. This

        action is irreversible. All credentials are immediately

        unusable.


        Only tenant administrators can delete service accounts.

        Non-admin callers receive 404 to prevent resource enumeration.


        Recommended workflow: disable the service account via PATCH

        first, confirm no active workloads are affected, then delete.
      operationId: deleteServiceAccount
      responses:
        '204':
          description: Service account permanently deleted.
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
components:
  responses:
    Unauthorized:
      description: Unauthorized
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    Forbidden:
      description: Forbidden
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    NotFound:
      description: Not found
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    InternalServerError:
      description: Internal server error
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
  schemas:
    Error:
      type: object
      description: Standard error response
      properties:
        error:
          type: object
          properties:
            code:
              type: integer
              description: HTTP status code
            message:
              type: string
              description: Error message
            details:
              type: array
              items:
                type: object
              description: Additional error details
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: Bearer token authentication using OAuth2/OIDC tokens

````