openapi: 3.1.0
info:
  title: Confluent Cloud REST API (selected) API Keys Service Accounts API
  description: 'A best-effort subset of the Confluent Cloud control-plane REST APIs:

    Organizations and Environments (org/v2), Service Accounts and Cloud

    API Keys (iam/v2), and Kafka Clusters (cmk/v2). Confluent Cloud

    additionally publishes data-plane APIs (Kafka REST v3, Schema Registry,

    Connect, ksqlDB, Flink) on per-cluster endpoints that are not modeled

    here. Authentication uses HTTP Basic with a Cloud API Key/Secret pair,

    or OAuth 2.0 (Confluent STS / external IdP).

    '
  version: 2.0.0
  contact:
    name: Confluent Cloud API Reference
    url: https://docs.confluent.io/cloud/current/api.html
servers:
- url: https://api.confluent.cloud
  description: Confluent Cloud control plane
security:
- basicAuth: []
- bearerAuth: []
tags:
- name: Service Accounts
paths:
  /iam/v2/service-accounts:
    get:
      tags:
      - Service Accounts
      summary: List service accounts
      parameters:
      - in: query
        name: page_size
        schema:
          type: integer
          default: 10
      - in: query
        name: page_token
        schema:
          type: string
      responses:
        '200':
          description: A page of service accounts
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceAccountList'
    post:
      tags:
      - Service Accounts
      summary: Create a service account
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ServiceAccount'
      responses:
        '201':
          description: Service account created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceAccount'
  /iam/v2/service-accounts/{id}:
    get:
      tags:
      - Service Accounts
      summary: Get a service account
      parameters:
      - in: path
        name: id
        required: true
        schema:
          type: string
      responses:
        '200':
          description: A service account
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceAccount'
    delete:
      tags:
      - Service Accounts
      summary: Delete a service account
      parameters:
      - in: path
        name: id
        required: true
        schema:
          type: string
      responses:
        '204':
          description: Service account deleted
components:
  schemas:
    ServiceAccountList:
      type: object
      properties:
        data:
          type: array
          items:
            $ref: '#/components/schemas/ServiceAccount'
        metadata:
          $ref: '#/components/schemas/ListMetadata'
    ResourceMetadata:
      type: object
      properties:
        self:
          type: string
          format: uri
        resource_name:
          type: string
        created_at:
          type: string
          format: date-time
        updated_at:
          type: string
          format: date-time
        deleted_at:
          type: string
          format: date-time
    ServiceAccount:
      type: object
      properties:
        api_version:
          type: string
          example: iam/v2
        kind:
          type: string
          example: ServiceAccount
        id:
          type: string
        metadata:
          $ref: '#/components/schemas/ResourceMetadata'
        display_name:
          type: string
        description:
          type: string
    ListMetadata:
      type: object
      properties:
        first:
          type: string
          format: uri
        last:
          type: string
          format: uri
        prev:
          type: string
          format: uri
        next:
          type: string
          format: uri
        total_size:
          type: integer
  securitySchemes:
    basicAuth:
      type: http
      scheme: basic
      description: Cloud API Key (key) and Secret (password)
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: Confluent STS or external OAuth access token