# client.service_accounts

> client.service_accounts — the serviceAccounts operations.

`client.service_accounts` — the `serviceAccounts` operations.

On `AsyncKindgi` every method is the same, awaited.

## `client.service_accounts.list()`

```python signature
list(
    *,
    cursor: str | None = None,
    limit: int | None = None,
    include_unregistered: Literal['true', 'false'] | None = None,
    timeout: float | None = None,
) -> ServiceAccountPage
```

List service accounts. `GET /v1/service-accounts`

Oldest first; active only unless `?includeUnregistered=true`. Tenant admins only.

## `client.service_accounts.create()`

```python signature
create(
    body: CreateServiceAccountBody | Mapping[str, Any] | None = None,
    /,
    *,
    idempotency_key: str | None = None,
    timeout: float | None = None,
    **fields: Any,
) -> ServiceAccount
```

Create a service account. `POST /v1/service-accounts`

A named, non-human principal with its first grants, written before it is returned. It isn't a tenant member unless a grant makes it one (`{kind: 'tenant-member'}`: read the tenant's settings); give it only what its job needs. Mint its keys at `POST /v1/tokens` with `for`. Tenant admins only. Mounted when the deployment supplies a `ServiceAccountBinding`.

## `client.service_accounts.get()`

```python signature
get(
    service_account_id: str | UUID,
    /,
    *,
    timeout: float | None = None,
) -> ServiceAccount
```

Read a service account. `GET /v1/service-accounts/{serviceAccountId}`

Unregistered ones too. Tenant admins only.

## `client.service_accounts.grant()`

```python signature
grant(
    service_account_id: str | UUID,
    body: ServiceAccountGrantBody | Mapping[str, Any] | None = None,
    /,
    *,
    idempotency_key: str | None = None,
    timeout: float | None = None,
    **fields: Any,
) -> ServiceAccount
```

Grant a service account. `POST /v1/service-accounts/{serviceAccountId}/grant`

Tenant admin, or a role on a project (replacing the account's role there). Written before the call answers. Tenant admins only.

## `client.service_accounts.ungrant()`

```python signature
ungrant(
    service_account_id: str | UUID,
    body: ServiceAccountUngrantBody | Mapping[str, Any] | None = None,
    /,
    *,
    idempotency_key: str | None = None,
    timeout: float | None = None,
    **fields: Any,
) -> ServiceAccount
```

Remove a grant from a service account. `POST /v1/service-accounts/{serviceAccountId}/ungrant`

A no-op when the account does not hold it. Tenant admins only.

## `client.service_accounts.unregister()`

```python signature
unregister(
    service_account_id: str | UUID,
    /,
    *,
    idempotency_key: str | None = None,
    timeout: float | None = None,
) -> ServiceAccount
```

Unregister a service account. `POST /v1/service-accounts/{serviceAccountId}/unregister`

A tombstone: its grants go and its keys stop working; it stays readable. Idempotent. Tenant admins only.