Skip to main content
GET
Retrieve credential details

Authorizations

Authorization
string
header
required

Bearer token authentication using OAuth2/OIDC tokens

Path Parameters

serviceAccountId
string
required

Service account resource identifier.

id
string
required

Credential resource identifier.

Response

Credential metadata.

A credential (client_secret) belonging to a service account. Multiple credentials can exist simultaneously for a single service account, enabling zero-downtime secret rotation: create a new credential, deploy it, then delete the old one.

The client_secret value is returned only at creation time and cannot be retrieved again.

Maximum of 5 active credentials per service account.

uid
string<uuid>
required
read-only

Server-generated UUID. Immutable.

id
string
required
read-only

Credential identifier. Server-generated, immutable.

Example:

"cred-001"

serviceAccountId
string
required
read-only

The parent service account this credential belongs to.

Example:

"sa-pipeline-prod"

status
enum<string>
required
read-only

Current credential status.

  • active: can be used to authenticate.
  • expired: past expiresAt. Terminal; cannot be re-enabled.

Note: if the parent service account is disabled, all its credentials are effectively unusable regardless of their individual status.

Available options:
active,
expired
Example:

"active"

createdBy
string
required
read-only

User ID of the administrator who created this credential.

Example:

"user-admin-001"

createdAt
string<date-time>
required
read-only

Timestamp when the credential was created.

Server-defined URL for this resource.

Example:

"/v1/iam/service-accounts/sa-pipeline-prod/credentials/cred-001"

expiresAt
string<date-time>

Credential expiration timestamp. If not set at creation, defaults to the organization's configured maximum credential lifetime. Cannot exceed the org-level maximum.

lastUsedAt
string<date-time>
read-only

Timestamp of the last successful token mint using this credential. Null if never used.

lastUsedIp
string
read-only

IP address from which this credential was last used.

Example:

"203.0.113.42"