client.service_accounts

client.service_accounts — the serviceAccounts operations.

On AsyncKindgi every method is the same, awaited.

`client.service_accounts.list()`

list(
    *,
    cursor: str | None = None,
    limit: int | None = None,
    include_unregistered: Literal['true', 'false'] | None = None,
    timeout: float | None = None,
) -> ServiceAccountPage

List service accounts. GET /v1/service-accounts

Oldest first; active only unless ?includeUnregistered=true. Tenant admins only.

`client.service_accounts.create()`

create(
    body: CreateServiceAccountBody | Mapping[str, Any] | None = None,
    /,
    *,
    idempotency_key: str | None = None,
    timeout: float | None = None,
    **fields: Any,
) -> ServiceAccount

Create a service account. POST /v1/service-accounts

A named, non-human principal with its first grants, written before it is returned. It isn't a tenant member unless a grant makes it one ({kind: 'tenant-member'}: read the tenant's settings); give it only what its job needs. Mint its keys at POST /v1/tokens with for. Tenant admins only. Mounted when the deployment supplies a ServiceAccountBinding.

`client.service_accounts.get()`

get(
    service_account_id: str | UUID,
    /,
    *,
    timeout: float | None = None,
) -> ServiceAccount

Read a service account. GET /v1/service-accounts/{serviceAccountId}

Unregistered ones too. Tenant admins only.

`client.service_accounts.grant()`

grant(
    service_account_id: str | UUID,
    body: ServiceAccountGrantBody | Mapping[str, Any] | None = None,
    /,
    *,
    idempotency_key: str | None = None,
    timeout: float | None = None,
    **fields: Any,
) -> ServiceAccount

Grant a service account. POST /v1/service-accounts/{serviceAccountId}/grant

Tenant admin, or a role on a project (replacing the account's role there). Written before the call answers. Tenant admins only.

`client.service_accounts.ungrant()`

ungrant(
    service_account_id: str | UUID,
    body: ServiceAccountUngrantBody | Mapping[str, Any] | None = None,
    /,
    *,
    idempotency_key: str | None = None,
    timeout: float | None = None,
    **fields: Any,
) -> ServiceAccount

Remove a grant from a service account. POST /v1/service-accounts/{serviceAccountId}/ungrant

A no-op when the account does not hold it. Tenant admins only.

`client.service_accounts.unregister()`

unregister(
    service_account_id: str | UUID,
    /,
    *,
    idempotency_key: str | None = None,
    timeout: float | None = None,
) -> ServiceAccount

Unregister a service account. POST /v1/service-accounts/{serviceAccountId}/unregister

A tombstone: its grants go and its keys stop working; it stays readable. Idempotent. Tenant admins only.