# kindgi service-accounts

> Service accounts: non-human principals with their own grants, acting through API keys (create / list / get / grant / ungrant / unregister)

## `kindgi service-accounts`

**Synopsis**

```sh signature
kindgi service-accounts <command>
```

Service accounts: non-human principals with their own grants, acting through API keys (create / list / get / grant / ungrant / unregister).

**Commands**

| Command                                                                                                                                     | Description                                                                                                                          |
| ------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ |
| [`kindgi service-accounts create`](https://docs.kindgi.com/v0.1.8/reference/cli/service-accounts.md#kindgi-service-accounts-create)         | Create a service account with its first grants, written before it answers: a key minted for it works at once.                        |
| [`kindgi service-accounts list`](https://docs.kindgi.com/v0.1.8/reference/cli/service-accounts.md#kindgi-service-accounts-list)             | List service accounts, oldest first; `--all` includes unregistered ones.                                                             |
| [`kindgi service-accounts get`](https://docs.kindgi.com/v0.1.8/reference/cli/service-accounts.md#kindgi-service-accounts-get)               | One service account, with its grants.                                                                                                |
| [`kindgi service-accounts grant`](https://docs.kindgi.com/v0.1.8/reference/cli/service-accounts.md#kindgi-service-accounts-grant)           | Grant a service account tenant admin, tenant member (read the tenant's settings), or a role on a project (replacing its role there). |
| [`kindgi service-accounts ungrant`](https://docs.kindgi.com/v0.1.8/reference/cli/service-accounts.md#kindgi-service-accounts-ungrant)       | Remove tenant admin, tenant member, or the role on a project, from a service account.                                                |
| [`kindgi service-accounts unregister`](https://docs.kindgi.com/v0.1.8/reference/cli/service-accounts.md#kindgi-service-accounts-unregister) | Unregister a service account: its grants go and its keys are revoked.                                                                |

**See also**

- [People, API keys and service accounts](https://docs.kindgi.com/v0.1.8/deploy/people-and-keys.md)

### `kindgi service-accounts create`

**Synopsis**

```sh signature
kindgi service-accounts create <name> [--description=<text>] [--tenant-admin] [--tenant-member] [--project=<project-id>:<role>]…
```

Create a service account with its first grants, written before it answers: a key minted for it works at once. It reads the tenant's settings only with --tenant-member.

**Options**

| Option                  | Default | Description                                                                                                                                                                                  |
| ----------------------- | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `--description <value>` | none    | What it is for.                                                                                                                                                                              |
| `--project <value>`     | none    | A role on a project, `<project-id>:<role>` (repeatable); roles: viewer, editor, owner, admin. Repeatable.                                                                                    |
| `--tenant-admin`        | off     | Make it a tenant admin.                                                                                                                                                                      |
| `--tenant-member`       | off     | Tenant member: read the tenant's settings (providers, policies, adapters, signing keys, deployments), not its projects. Not given by default; give it only to an account whose job needs it. |

Every command also takes the [global flags](https://docs.kindgi.com/v0.1.8/reference/cli.md#global-flags).

**Examples**

From [People, API keys and service accounts](https://docs.kindgi.com/v0.1.8/deploy/people-and-keys.md):

```sh
npx --yes @kindgi/cli@0.1 service-accounts create acme-deploy --description="Deploys" --tenant-admin
npx --yes @kindgi/cli@0.1 service-accounts create acme-ci --description="Deploys from CI" --project=<project-id>:editor
```

**See also**

- [People, API keys and service accounts](https://docs.kindgi.com/v0.1.8/deploy/people-and-keys.md)
- [`kindgi service-accounts`](https://docs.kindgi.com/v0.1.8/reference/cli/service-accounts.md#kindgi-service-accounts)

### `kindgi service-accounts list`

**Synopsis**

```sh signature
kindgi service-accounts list [--all] [--limit=<n>] [--cursor=<c>] [--table]
```

List service accounts, oldest first; `--all` includes unregistered ones.

**Options**

| Option             | Default              | Description                       |
| ------------------ | -------------------- | --------------------------------- |
| `--all`            | off                  | Unregistered accounts too.        |
| `--cursor <value>` | none                 | The next page, from `nextCursor`. |
| `--limit <value>`  | `25` (at most `100`) | Page size.                        |

Every command also takes the [global flags](https://docs.kindgi.com/v0.1.8/reference/cli.md#global-flags).

**Examples**

List every service account, including unregistered ones, as a table.

```sh
kindgi service-accounts list --all --table
```

Read the next page of 20.

```sh
kindgi service-accounts list --limit=20 --cursor=<cursor>
```

**See also**

- [People, API keys and service accounts](https://docs.kindgi.com/v0.1.8/deploy/people-and-keys.md)
- [`kindgi service-accounts`](https://docs.kindgi.com/v0.1.8/reference/cli/service-accounts.md#kindgi-service-accounts)

### `kindgi service-accounts get`

**Synopsis**

```sh signature
kindgi service-accounts get <service-account-id>
```

One service account, with its grants.

**Options**

Every command also takes the [global flags](https://docs.kindgi.com/v0.1.8/reference/cli.md#global-flags).

**Examples**

Show one service account with its grants.

```sh
kindgi service-accounts get <service-account-id>
```

**See also**

- [People, API keys and service accounts](https://docs.kindgi.com/v0.1.8/deploy/people-and-keys.md)
- [`kindgi service-accounts`](https://docs.kindgi.com/v0.1.8/reference/cli/service-accounts.md#kindgi-service-accounts)

### `kindgi service-accounts grant`

**Synopsis**

```sh signature
kindgi service-accounts grant <service-account-id> (--tenant-admin | --tenant-member | --project=<project-id> --role=<role>)
```

Grant a service account tenant admin, tenant member (read the tenant's settings), or a role on a project (replacing its role there). Written before it answers.

**Options**

| Option              | Default                   | Description                                                                                                                                                                                  |
| ------------------- | ------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `--project <value>` | none                      | A project, by id.                                                                                                                                                                            |
| `--role <value>`    | required with `--project` | Its role there: viewer, editor, owner, admin.                                                                                                                                                |
| `--tenant-admin`    | off                       | Tenant admin.                                                                                                                                                                                |
| `--tenant-member`   | off                       | Tenant member: read the tenant's settings (providers, policies, adapters, signing keys, deployments), not its projects. Not given by default; give it only to an account whose job needs it. |

Every command also takes the [global flags](https://docs.kindgi.com/v0.1.8/reference/cli.md#global-flags).

**Examples**

Give a service account the editor role on a project.

```sh
kindgi service-accounts grant <service-account-id> --project=<project-id> --role=editor
```

Let a service account read the tenant's settings.

```sh
kindgi service-accounts grant <service-account-id> --tenant-member
```

**See also**

- [People, API keys and service accounts](https://docs.kindgi.com/v0.1.8/deploy/people-and-keys.md)
- [`kindgi service-accounts`](https://docs.kindgi.com/v0.1.8/reference/cli/service-accounts.md#kindgi-service-accounts)

### `kindgi service-accounts ungrant`

**Synopsis**

```sh signature
kindgi service-accounts ungrant <service-account-id> (--tenant-admin | --tenant-member | --project=<project-id>)
```

Remove tenant admin, tenant member, or the role on a project, from a service account.

**Options**

| Option              | Default | Description       |
| ------------------- | ------- | ----------------- |
| `--project <value>` | none    | A project, by id. |
| `--tenant-admin`    | off     | Tenant admin.     |
| `--tenant-member`   | off     | Tenant member.    |

Every command also takes the [global flags](https://docs.kindgi.com/v0.1.8/reference/cli.md#global-flags).

**Examples**

Remove a service account's role on a project.

```sh
kindgi service-accounts ungrant <service-account-id> --project=<project-id>
```

Take tenant member away from a service account.

```sh
kindgi service-accounts ungrant <service-account-id> --tenant-member
```

**See also**

- [People, API keys and service accounts](https://docs.kindgi.com/v0.1.8/deploy/people-and-keys.md)
- [`kindgi service-accounts`](https://docs.kindgi.com/v0.1.8/reference/cli/service-accounts.md#kindgi-service-accounts)

### `kindgi service-accounts unregister`

**Synopsis**

```sh signature
kindgi service-accounts unregister <service-account-id>
```

Unregister a service account: its grants go and its keys are revoked. It stays readable.

**Options**

Every command also takes the [global flags](https://docs.kindgi.com/v0.1.8/reference/cli.md#global-flags).

**Examples**

Unregister a service account and revoke its keys.

```sh
kindgi service-accounts unregister <service-account-id>
```

**See also**

- [People, API keys and service accounts](https://docs.kindgi.com/v0.1.8/deploy/people-and-keys.md)
- [`kindgi service-accounts`](https://docs.kindgi.com/v0.1.8/reference/cli/service-accounts.md#kindgi-service-accounts)