openapi: 3.0.3
info:
  title: Snyk AccessRequests ServiceAccounts API
  version: REST
servers:
- description: Snyk REST API
  url: https://api.snyk.io/rest
security:
- APIToken: []
- BearerAuth: []
tags:
- name: ServiceAccounts
paths:
  /groups/{group_id}/service_accounts:
    get:
      description: 'Get all service accounts for a group.


        #### Required permissions


        - `View service accounts (group.service_account.read)`'
      operationId: getManyGroupServiceAccount
      parameters:
      - description: The ID of the Snyk Group that owns the service accounts.
        in: path
        name: group_id
        required: true
        schema:
          format: uuid
          type: string
      - $ref: '#/components/parameters/StartingAfter'
      - $ref: '#/components/parameters/EndingBefore'
      - $ref: '#/components/parameters/Limit'
      - $ref: '#/components/parameters/Version'
      responses:
        '200':
          content:
            application/vnd.api+json:
              schema:
                additionalProperties: false
                properties:
                  data:
                    items:
                      $ref: '#/components/schemas/ServiceAccount'
                    type: array
                  jsonapi:
                    $ref: '#/components/schemas/JsonApi'
                  links:
                    $ref: '#/components/schemas/Links'
                  meta:
                    properties:
                      access_tokens:
                        properties:
                          max_active_tokens:
                            type: integer
                          max_expiry_days:
                            type: integer
                        required:
                        - max_active_tokens
                        - max_expiry_days
                        type: object
                    type: object
                required:
                - jsonapi
                - data
                - links
                type: object
          description: A list of service accounts is returned.
          headers:
            deprecation:
              $ref: '#/components/headers/DeprecationHeader'
            location:
              $ref: '#/components/headers/LocationHeader'
            snyk-request-id:
              $ref: '#/components/headers/RequestIdResponseHeader'
            snyk-version-lifecycle-stage:
              $ref: '#/components/headers/VersionStageResponseHeader'
            snyk-version-requested:
              $ref: '#/components/headers/VersionRequestedResponseHeader'
            snyk-version-served:
              $ref: '#/components/headers/VersionServedResponseHeader'
            sunset:
              $ref: '#/components/headers/SunsetHeader'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
        '500':
          $ref: '#/components/responses/500'
      summary: Get a list of group service accounts.
      tags:
      - ServiceAccounts
      x-snyk-api-lifecycle: released
      x-snyk-api-releases:
      - '2023-09-07'
      x-snyk-api-resource: service_accounts
      x-snyk-api-stability: ga
      x-snyk-api-version: '2023-09-07'
      x-stability-level: stable
    post:
      description: 'Create a service account for a group. The service account can be used to access the Snyk API.


        #### Required permissions


        - `Create service accounts (group.service_account.create)`'
      operationId: createGroupServiceAccount
      parameters:
      - description: The ID of the Snyk Group that is creating and owns the service account
        in: path
        name: group_id
        required: true
        schema:
          format: uuid
          type: string
      - $ref: '#/components/parameters/Version'
      requestBody:
        content:
          application/vnd.api+json:
            schema:
              additionalProperties: false
              properties:
                data:
                  additionalProperties: false
                  properties:
                    attributes:
                      additionalProperties: false
                      properties:
                        access_token_expires_at:
                          description: The expiry date of the access token. Required only when auth_type is access_token.
                          example: '2025-08-16T00:00:00Z'
                          format: date-time
                          type: string
                        access_token_ttl_seconds:
                          description: The time, in seconds, that a generated oauth access token will be valid for. Defaults to 1 hour if unset. Only used when auth_type is one of the oauth_* variants.
                          maximum: 86400
                          minimum: 3600
                          type: number
                        auth_type:
                          description: "The authentication strategy for the service account:\n  * api_key - Regular Snyk API Key.\n  * oauth_client_secret - OAuth2 client_credentials grant, which returns a client secret that can be used to retrieve an oauth access token.\n  * oauth_private_key_jwt - OAuth2 client_credentials grant, using private_key_jwt client_assertion as laid out in OIDC Connect Core 1.0, section 9.\n  * access_token - Access tokens are long-lived, can be used more than once for increased flexibility, and have expiries for enhanced security."
                          enum:
                          - api_key
                          - oauth_client_secret
                          - oauth_private_key_jwt
                          - access_token
                          type: string
                        jwks_url:
                          description: A JWKs URL hosting your public keys, used to verify signed JWT requests. Must be https. Required only when auth_type is oauth_private_key_jwt.
                          type: string
                        name:
                          description: A human-friendly name for the service account.
                          type: string
                        role_id:
                          description: The ID of the role which the created service account should use. Obtained in the Snyk UI, via "Group Page" -> "Settings" -> "Member Roles" -> "Create new Role". Can be shared among multiple accounts.
                          format: uuid
                          type: string
                      required:
                      - name
                      - role_id
                      - auth_type
                      type: object
                    type:
                      description: The Resource type.
                      enum:
                      - service_account
                      type: string
                  required:
                  - type
                  - attributes
                  type: object
              required:
              - data
              type: object
        required: true
      responses:
        '201':
          content:
            application/vnd.api+json:
              schema:
                additionalProperties: false
                properties:
                  data:
                    $ref: '#/components/schemas/ServiceAccount'
                  jsonapi:
                    $ref: '#/components/schemas/JsonApi'
                  links:
                    $ref: '#/components/schemas/Links'
                required:
                - jsonapi
                - data
                type: object
          description: A new service account has been created
          headers:
            deprecation:
              $ref: '#/components/headers/DeprecationHeader'
            location:
              $ref: '#/components/headers/LocationHeader'
            snyk-request-id:
              $ref: '#/components/headers/RequestIdResponseHeader'
            snyk-version-lifecycle-stage:
              $ref: '#/components/headers/VersionStageResponseHeader'
            snyk-version-requested:
              $ref: '#/components/headers/VersionRequestedResponseHeader'
            snyk-version-served:
              $ref: '#/components/headers/VersionServedResponseHeader'
            sunset:
              $ref: '#/components/headers/SunsetHeader'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '404':
          $ref: '#/components/responses/404'
        '500':
          $ref: '#/components/responses/500'
      summary: Create a service account for a group.
      tags:
      - ServiceAccounts
      x-snyk-api-lifecycle: released
      x-snyk-api-releases:
      - '2023-09-07'
      x-snyk-api-resource: service_accounts
      x-snyk-api-stability: ga
      x-snyk-api-version: '2023-09-07'
      x-stability-level: stable
  /groups/{group_id}/service_accounts/{serviceaccount_id}:
    delete:
      description: 'Permanently delete a group-level service account by its ID.


        #### Required permissions


        - `Delete service accounts (group.service_account.delete)`'
      operationId: deleteOneGroupServiceAccount
      parameters:
      - description: The ID of the Snyk Group that owns the service account.
        in: path
        name: group_id
        required: true
        schema:
          format: uuid
          type: string
      - description: The ID of the service account.
        in: path
        name: serviceaccount_id
        required: true
        schema:
          format: uuid
          type: string
      - $ref: '#/components/parameters/Version'
      responses:
        '204':
          description: Service account was successfully deleted.
          headers:
            deprecation:
              $ref: '#/components/headers/DeprecationHeader'
            location:
              $ref: '#/components/headers/LocationHeader'
            snyk-request-id:
              $ref: '#/components/headers/RequestIdResponseHeader'
            snyk-version-lifecycle-stage:
              $ref: '#/components/headers/VersionStageResponseHeader'
            snyk-version-requested:
              $ref: '#/components/headers/VersionRequestedResponseHeader'
            snyk-version-served:
              $ref: '#/components/headers/VersionServedResponseHeader'
            sunset:
              $ref: '#/components/headers/SunsetHeader'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
        '500':
          $ref: '#/components/responses/500'
      summary: Delete a group service account.
      tags:
      - ServiceAccounts
      x-snyk-api-lifecycle: released
      x-snyk-api-releases:
      - '2023-09-07'
      x-snyk-api-resource: service_accounts
      x-snyk-api-stability: ga
      x-snyk-api-version: '2023-09-07'
      x-stability-level: stable
    get:
      description: 'Get a group-level service account by its ID.


        #### Required permissions


        - `View service accounts (group.service_account.read)`'
      operationId: getOneGroupServiceAccount
      parameters:
      - description: The ID of the Snyk Group that owns the service account.
        in: path
        name: group_id
        required: true
        schema:
          format: uuid
          type: string
      - description: The ID of the service account.
        in: path
        name: serviceaccount_id
        required: true
        schema:
          format: uuid
          type: string
      - $ref: '#/components/parameters/Version'
      responses:
        '200':
          content:
            application/vnd.api+json:
              schema:
                additionalProperties: false
                properties:
                  data:
                    $ref: '#/components/schemas/ServiceAccount'
                  jsonapi:
                    $ref: '#/components/schemas/JsonApi'
                  links:
                    $ref: '#/components/schemas/Links'
                required:
                - jsonapi
                - data
                - links
                type: object
          description: Service account is returned.
          headers:
            deprecation:
              $ref: '#/components/headers/DeprecationHeader'
            location:
              $ref: '#/components/headers/LocationHeader'
            snyk-request-id:
              $ref: '#/components/headers/RequestIdResponseHeader'
            snyk-version-lifecycle-stage:
              $ref: '#/components/headers/VersionStageResponseHeader'
            snyk-version-requested:
              $ref: '#/components/headers/VersionRequestedResponseHeader'
            snyk-version-served:
              $ref: '#/components/headers/VersionServedResponseHeader'
            sunset:
              $ref: '#/components/headers/SunsetHeader'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
        '500':
          $ref: '#/components/responses/500'
      summary: Get a group service account.
      tags:
      - ServiceAccounts
      x-snyk-api-lifecycle: released
      x-snyk-api-releases:
      - '2023-09-07'
      x-snyk-api-resource: service_accounts
      x-snyk-api-stability: ga
      x-snyk-api-version: '2023-09-07'
      x-stability-level: stable
    patch:
      description: 'Update the name of a group''s service account by its ID.


        #### Required permissions


        - `Edit service accounts (group.service_account.edit)`'
      operationId: updateGroupServiceAccount
      parameters:
      - description: The ID of the Snyk Group that owns the service account.
        in: path
        name: group_id
        required: true
        schema:
          format: uuid
          type: string
      - description: The ID of the service account.
        in: path
        name: serviceaccount_id
        required: true
        schema:
          format: uuid
          type: string
      - $ref: '#/components/parameters/Version'
      requestBody:
        content:
          application/vnd.api+json:
            schema:
              additionalProperties: false
              properties:
                data:
                  additionalProperties: false
                  properties:
                    attributes:
                      additionalProperties: false
                      properties:
                        name:
                          description: A human-friendly name for the service account. Must be unique within the group.
                          type: string
                      required:
                      - name
                      type: object
                    id:
                      description: The ID of the service account. Must match the id in the url path.
                      format: uuid
                      type: string
                    type:
                      description: The Resource type.
                      enum:
                      - service_account
                      type: string
                  required:
                  - type
                  - id
                  - attributes
                  type: object
              required:
              - data
              type: object
        required: true
      responses:
        '200':
          content:
            application/vnd.api+json:
              schema:
                additionalProperties: false
                properties:
                  data:
                    $ref: '#/components/schemas/ServiceAccount'
                  jsonapi:
                    $ref: '#/components/schemas/JsonApi'
                  links:
                    $ref: '#/components/schemas/Links'
                required:
                - jsonapi
                - data
                - links
                type: object
          description: Service account is returned.
          headers:
            deprecation:
              $ref: '#/components/headers/DeprecationHeader'
            location:
              $ref: '#/components/headers/LocationHeader'
            snyk-request-id:
              $ref: '#/components/headers/RequestIdResponseHeader'
            snyk-version-lifecycle-stage:
              $ref: '#/components/headers/VersionStageResponseHeader'
            snyk-version-requested:
              $ref: '#/components/headers/VersionRequestedResponseHeader'
            snyk-version-served:
              $ref: '#/components/headers/VersionServedResponseHeader'
            sunset:
              $ref: '#/components/headers/SunsetHeader'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
        '500':
          $ref: '#/components/responses/500'
      summary: Update a group service account.
      tags:
      - ServiceAccounts
      x-snyk-api-lifecycle: released
      x-snyk-api-releases:
      - '2023-09-07'
      x-snyk-api-resource: service_accounts
      x-snyk-api-stability: ga
      x-snyk-api-version: '2023-09-07'
      x-stability-level: stable
  /groups/{group_id}/service_accounts/{serviceaccount_id}/secrets:
    post:
      description: 'Manage the client secret of a group service account by the service account ID.


        #### Required permissions


        - `Edit service accounts (group.service_account.edit)`'
      operationId: updateServiceAccountSecret
      parameters:
      - description: The ID of the Snyk Group that owns the service account.
        in: path
        name: group_id
        required: true
        schema:
          format: uuid
          type: string
      - description: The ID of the service account.
        in: path
        name: serviceaccount_id
        required: true
        schema:
          format: uuid
          type: string
      - $ref: '#/components/parameters/Version'
      requestBody:
        content:
          application/vnd.api+json:
            schema:
              additionalProperties: false
              properties:
                data:
                  additionalProperties: false
                  properties:
                    attributes:
                      additionalProperties: false
                      properties:
                        mode:
                          description: "Operation to perform:\n  * `replace` - Replace existing secrets with a new generated secret.\n  * `create` - Add a new secret, preserving existing secrets. A maximum of to two secrets can exist at a time.\n  * `delete` - Remove an existing secret by value. At least one secret must remain per service account.\n"
                          enum:
                          - replace
                          - create
                          - delete
                          type: string
                        secret:
                          description: Secret to delete when using `delete` mode
                          type: string
                      required:
                      - mode
                      type: object
                    type:
                      description: The Resource type.
                      enum:
                      - service_account
                      type: string
                  required:
                  - attributes
                  - type
                  type: object
              required:
              - data
              type: object
        required: true
      responses:
        '200':
          content:
            application/vnd.api+json:
              schema:
                additionalProperties: false
                properties:
                  data:
                    $ref: '#/components/schemas/ServiceAccount'
                  jsonapi:
                    $ref: '#/components/schemas/JsonApi'
                  links:
                    $ref: '#/components/schemas/Links'
                required:
                - jsonapi
                - data
                type: object
          description: Service account client secret has been updated.
          headers:
            deprecation:
              $ref: '#/components/headers/DeprecationHeader'
            location:
              $ref: '#/components/headers/LocationHeader'
            snyk-request-id:
              $ref: '#/components/headers/RequestIdResponseHeader'
            snyk-version-lifecycle-stage:
              $ref: '#/components/headers/VersionStageResponseHeader'
            snyk-version-requested:
              $ref: '#/components/headers/VersionRequestedResponseHeader'
            snyk-version-served:
              $ref: '#/components/headers/VersionServedResponseHeader'
            sunset:
              $ref: '#/components/headers/SunsetHeader'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
        '500':
          $ref: '#/components/responses/500'
      summary: Manage a group service account's client secret.
      tags:
      - ServiceAccounts
      x-snyk-api-lifecycle: released
      x-snyk-api-releases:
      - '2023-09-07'
      x-snyk-api-resource: service_accounts
      x-snyk-api-stability: ga
      x-snyk-api-version: '2023-09-07'
      x-stability-level: stable
  /orgs/{org_id}/service_accounts:
    get:
      description: 'Get all service accounts for an organization.


        #### Required permissions


        - `View service accounts (org.service_account.read)`'
      operationId: getManyOrgServiceAccounts
      parameters:
      - description: The ID of the Snyk Organization that owns the service accounts.
        in: path
        name: org_id
        required: true
        schema:
          format: uuid
          type: string
      - $ref: '#/components/parameters/StartingAfter'
      - $ref: '#/components/parameters/EndingBefore'
      - $ref: '#/components/parameters/Limit'
      - $ref: '#/components/parameters/Version'
      responses:
        '200':
          content:
            application/vnd.api+json:
              schema:
                additionalProperties: false
                properties:
                  data:
                    items:
                      $ref: '#/components/schemas/ServiceAccount'
                    type: array
                  jsonapi:
                    $ref: '#/components/schemas/JsonApi'
                  links:
                    $ref: '#/components/schemas/Links'
                required:
                - jsonapi
                - data
                - links
                type: object
          description: A list of service accounts is returned.
          headers:
            deprecation:
              $ref: '#/components/headers/DeprecationHeader'
            location:
              $ref: '#/components/headers/LocationHeader'
            snyk-request-id:
              $ref: '#/components/headers/RequestIdResponseHeader'
            snyk-version-lifecycle-stage:
              $ref: '#/components/headers/VersionStageResponseHeader'
            snyk-version-requested:
              $ref: '#/components/headers/VersionRequestedResponseHeader'
            snyk-version-served:
              $ref: '#/components/headers/VersionServedResponseHeader'
            sunset:
              $ref: '#/components/headers/SunsetHeader'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
        '500':
          $ref: '#/components/responses/500'
      summary: Get a list of organization service accounts.
      tags:
      - ServiceAccounts
      x-snyk-api-lifecycle: released
      x-snyk-api-releases:
      - '2023-09-07'
      x-snyk-api-resource: service_accounts
      x-snyk-api-stability: ga
      x-snyk-api-version: '2023-09-07'
      x-stability-level: stable
    post:
      description: 'Create a service account for an organization. The service account can be used to access the Snyk API.


        #### Required permissions


        - `Create service accounts (org.service_account.create)`'
      operationId: createOrgServiceAccount
      parameters:
      - description: The ID of the Snyk Organization that is creating and will own the service account.
        in: path
        name: org_id
        required: true
        schema:
          format: uuid
          type: string
      - $ref: '#/components/parameters/Version'
      requestBody:
        content:
          application/vnd.api+json:
            schema:
              additionalProperties: false
              properties:
                data:
                  additionalProperties: false
                  properties:
                    attributes:
                      additionalProperties: false
                      properties:
                        access_token_expires_at:
                          description: The expiry date of the access token. Required only when auth_type is access_token.
                          example: '2025-08-16T00:00:00Z'
                          format: date-time
                          type: string
                        access_token_ttl_seconds:
                          description: The time, in seconds, that a generated oauth access token will be valid for. Defaults to 1 hour if unset. Only used when auth_type is one of the oauth_* variants.
                          maximum: 86400
                          minimum: 3600
                          type: number
                        auth_type:
                          description: "The authentication strategy for the service account:\n  * api_key - Regular Snyk API Key.\n  * oauth_client_secret - OAuth2 client_credentials grant, which returns a client secret that can be used to retrieve an oauth access token.\n  * oauth_private_key_jwt - OAuth2 client_credentials grant, using private_key_jwt client_assertion as laid out in OIDC Connect Core 1.0, section 9.\n  * access_token - Access tokens are long-lived, can be used more than once for increased flexibility, and have expiries for enhanced security."
                          enum:
                          - api_key
                          - oauth_client_secret
                          - oauth_private_key_jwt
                          - access_token
                          type: string
                        jwks_url:
                          description: A JWKs URL hosting your public keys, used to verify signed JWT requests. Must be https. Required only when auth_type is oauth_private_key_jwt.
                          type: string
                        name:
                          description: A human-friendly name for the service account.
                          type: string
                        role_id:
                          description: The ID of the role which the created service account should use. Obtained in the Snyk UI, via "Group Page" -> "Settings" -> "Member Roles" -> "Create new Role". Can be shared among multiple accounts.
                          format: uuid
                          type: string
                      required:
                      - name
                      - role_id
                      - auth_type
                      type: object
                    type:
                      description: The Resource type.
                      enum:
                      - service_account
                      type: string
                  required:
                  - attributes
                  type: object
              required:
              - data
              type: object
        required: true
      responses:
        '201':
          content:
            application/vnd.api+json:
              schema:
                additionalProperties: false
                properties:
                  data:
                    $ref: '#/components/schemas/ServiceAccount'
                  jsonapi:
                    $ref: '#/components/schemas/JsonApi'
                  links:
                    $ref: '#/components/schemas/Links'
                required:
                - jsonapi
                - data
                - links
                type: object
          description: A new service account has been created
          headers:
            deprecation:
              $ref: '#/components/headers/DeprecationHeader'
            location:
              $ref: '#/components/headers/LocationHeader'
            snyk-request-id:
              $ref: '#/components/headers/RequestIdResponseHeader'
            snyk-version-lifecycle-stage:
              $ref: '#/components/headers/VersionStageResponseHeader'
            snyk-version-requested:
              $ref: '#/components/headers/VersionRequestedResponseHeader'
            snyk-version-served:
              $ref: '#/components/headers/VersionServedResponseHeader'
            sunset:
              $ref: '#/components/headers/SunsetHeader'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '404':
          $ref: '#/components/responses/404'
        '500':
          $ref: '#/components/responses/500'
      summary: Create a service account for an organization.
      tags:
      - ServiceAccounts
      x-snyk-api-lifecycle: released
      x-snyk-api-releases:
      - '2023-09-07'
      x-snyk-api-resource: service_accounts
      x-snyk-api-stability: ga
      x-snyk-api-version: '2023-09-07'
      x-stability-level: stable
  /orgs/{org_id}/service_accounts/{serviceaccount_id}:
    delete:
      description: 'Delete a service account in an organization.


        #### Required permissions


        - `Remove service accounts (org.service_account.delete)`'
      operationId: deleteServiceAccount
      parameters:
      - description: The ID of org to which the service account belongs.
        in: path
        name: org_id
        required: true
        schema:
          format: uuid
          type: string
      - description: The ID of the service account.
        in: path
        name: serviceaccount_id
        required: true
        schema:
          format: uuid
          type: string
      - $ref: '#/components/parameters/Version'
      responses:
        '204':
          description: The service account has been deleted.
          headers:
            deprecation:
              $ref: '#/components/headers/DeprecationHeader'
            snyk-request-id:
              $ref: '#/components/headers/RequestIdResponseHeader'
            snyk-version-lifecycle-stage:
              $ref: '#/components/headers/VersionStageResponseHeader'
            snyk-version-requested:
              $ref: '#/components/headers/VersionRequestedResponseHeader'
            snyk-version-served:
              $ref: '#/components/headers/VersionServedResponseHeader'
            sunset:
              $ref: '#/components/headers/SunsetHeader'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
        '500':
          $ref: '#/components/responses/500'
      summary: Delete a service account in an organization.
      tags:
      - ServiceAccounts
      x-snyk-api-lifecycle: released
      x-snyk-api-releases:
      - '2023-09-07'
      x-snyk-api-resource: service_accounts
      x-snyk-api-stability: ga
      x-snyk-api-version: '2023-09-07'
      x-stability-level: stable
    get:
      description: 'Get an organization-level service account by its ID.


        #### Required permissions


        - `View service accounts (org.service_account.read)`'
      operationId: getOneOrgServiceAccount
      parameters:
      - description: The ID of the Snyk Organization that owns the service account.
        in: path
        name: org_id
        required: true
        schema:
          format: uuid
          type: string
      - description: The ID of the service account.
        in: path
        name: serviceaccount_id
        required: true
        schema:
          format: uuid
          type: string
      - $ref: '#/components/parameters/Version'
      responses:
        '200':
          content:
            application/vnd.api+json:
              schema:
                additionalProperties: false
                properties:
                  data:
                    $ref: '#/components/schemas/ServiceAccount'
                  jsonapi:
                    $ref: '#/components/schemas/JsonApi'
                  links:
                    $ref: '#/components/schemas/Links'
                required:
                - jsonapi
                - data
                - links
                type: object
          description: Service account is returned.
          headers:
            deprecation:
              $ref: '#/components/headers/DeprecationHeader'
            location:
              $ref: '#/components/headers/LocationHeader'
            snyk-request-id:
              $ref: '#/components/headers/RequestIdResponseHeader'
            snyk-version-lifecycle-stage:
              $ref: '#/components/headers/VersionStageResponseHeader'
            snyk-version-requested:
              $ref: '#/components/headers/VersionRequestedResponseHeader'
            snyk-version-served:
              $ref: '#/components/headers/VersionServedResponseHeader'
            sunset:
              $ref: '#/components/headers/SunsetHeader'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
        '500':
          $ref: '#/components/responses/500'
      summary: Get an organization service account.
      tags:
      - ServiceAccounts
      x-snyk-api-lifecycle: released
      x-snyk-api-releases:
      - '2023-09-07'
      x-snyk-api-resource: service_accounts
      x-snyk-api-stability: ga
      x-snyk-api-version: '2023-09-07'
      x-stability-level: stable
    patch:
      description: 'Update the name of an organization-level service account by its ID.


        #### Required permissions


        - `Edit service accounts (org.service_account.edit)`'
      operationId: updateOrgServiceAccount
      parameters:
      - description: The ID of the Snyk Organization that owns the service account.
        in: path
        name: org_id
        required: true
        schema:
          format: uuid
          type: string
      - description: The ID of the service account.
        in: path
        name: serviceaccount_id
        required: true
        schema:
          format: uuid
          type: string
      - $ref: '#/components/parameters/Version'
      requestBody:
        content:
          application/vnd.api+json:
            schema:
              additionalProperties: false
              properties:
                data:
                  additionalProperties: false
                  properties:
                    attributes:
                      additionalProperties: false
                      properties:
                        name:
                          description: A human-friendly name for the service account. Must be unique within the organization.
                          type: string
                      required:
                      - name
                      type: object
                    id:
                      description: The ID of the service account. Must match the id in the url path.
                      format: uuid
                      type: string
                    type:
                      description: The Resource type.
                      enum:
                      - service_account
                      type: string
                  required:
                  - type
                  - id
                  - attributes
                  type: object
              required:
              - data
              type: object
        required: true
      responses:
        '200':
          content:
            application/vnd.api+json:
              schema:
                additionalProperties: false
                properties:
                  data:
                    $ref: '#/components/schemas/ServiceAccount'
                  jsonapi:
                    $ref: '#/components/schemas/JsonApi'
                  links:
                    $ref: '#/components/schemas/Links'
                required:
                - jsonapi
                - data
                - links
                type: object
          description: Service account is returned.
          headers:
            deprecation:
              $ref: '#/components/headers/DeprecationHeader'
            location:
              $ref: '#/components/headers/LocationHeader'
            snyk-request-id:
              $ref: '#/components/headers/RequestIdResponseHeader'
            snyk-version-lifecycle-stage:
              $ref: '#/components/headers/VersionStageResponseHeader'
            snyk-version-requested:
              $ref: '#/components/headers/VersionRequestedResponseHeader'
            snyk-version-served:
              $ref: '#/components/headers/VersionServedResponseHeader'
            sunset:
              $ref: '#/components/headers/SunsetHeader'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
        '500':
          $ref: '#/components/responses/500'
      summary: Update an organization service account.
      tags:
      - ServiceAccounts
      x-snyk-api-lifecycle: released
      x-snyk-api-releases:
      - '2023-09-07'
      x-snyk-api-resource: service_accounts
      x-snyk-api-stability: ga
      x-snyk-api-version: '2023-09-07'
      x-stability-level: stable
  /orgs/{org_id}/service_accounts/{serviceaccount_id}/secrets:
    post:
      description: 'Manage the client secret of an organization service account by the service account ID.


        #### Required permissions


        - `Edit service accounts (org.service_account.edit)`'
      operationId: updateOrgServiceAccountSecret
      parameters:
      - description: The ID of the Snyk Organization that owns the service account.
        in: path
        name: org_id
        required: true
        schema:
          format: uuid
          type: string
      - description: The ID of the service account.
        in: path
        name: serviceaccount_id
        required: true
        schema:
          format: uuid
          type: string
      - $ref: '#/components/parameters/Version'
      requestBody:
        content:
          application/vnd.api+json:
            schema:
              additionalProperties: false
              properties:
                data:
                  additionalProperties: false
                  properties:
                    attributes:
                      additionalProperties: false
                      properties:
                        mode:
                          description: "Operation to perform:\n  * `replace` - Replace existing secrets with a new generated secret.\n  * `create` - Add a new secret, preserving existing secrets. A maximum of to two secrets can exist at a time.\n  * `delete` - Remove an existing secret by value. At least one secret must remain per service account.\n"
                          enum:
                          - replace
                          - create
                          - delete
                          type: string
                        secret:
                          description: Secret to delete when using `delete` mode
                          type: string
                      required:
                      - mode
                      type: object
                    type:
                      description: The Resource type.
                      enum:
                      - service_account
                      type: string
                  required:
                  - attributes
                  - type
                  type: object
              required:
              - data
              type: object
        required: true
      responses:
        '200':
          content:
            application/vnd.api+json:
              schema:
                additionalProperties: false
                properties:
                  data:
                    $ref: '#/components/schemas/ServiceAccount'
                  jsonapi:
                    $ref: '#/components/schemas/JsonApi'
                  links:
                    $ref: '#/components/schemas/Links'
                required:
                - jsonapi
                - data
                type: object
          description: Service account client secret has been updated.
          headers:
            deprecation:
              $ref: '#/components/headers/DeprecationHeader'
            location:
              $ref: '#/components/headers/LocationHeader'
            snyk-request-id:
              $ref: '#/components/headers/RequestIdResponseHeader'
            snyk-version-lifecycle-stage:
              $ref: '#/components/headers/VersionStageResponseHeader'
            snyk-version-requested:
              $ref: '#/components/headers/VersionRequestedResponseHeader'
            snyk-version-served:
              $ref: '#/components/headers/VersionServedResponseHeader'
            sunset:
              $ref: '#/components/headers/SunsetHeader'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
        '500':
          $ref: '#/components/responses/500'
      summary: Manage an organization service account's client secret.
      tags:
      - ServiceAccounts
      x-snyk-api-lifecycle: released
      x-snyk-api-releases:
      - '2023-09-07'
      x-snyk-api-resource: service_accounts
      x-snyk-api-stability: ga
      x-snyk-api-version: '2023-09-07'
      x-stability-level: stable
components:
  parameters:
    EndingBefore:
      description: Return the page of results immediately before this cursor
      example: v1.eyJpZCI6IjExMDAifQo=
      in: query
      name: ending_before
      schema:
        type: string
    StartingAfter:
      description: Return the page of results immediately after this cursor
      example: v1.eyJpZCI6IjEwMDAifQo=
      in: query
      name: starting_after
      schema:
        type: string
    Version:
      description: The requested version of the endpoint to process the request
      example: '2026-03-25'
      in: query
      name: version
      required: true
      schema:
        $ref: '#/components/schemas/QueryVersion'
    Limit:
      description: Number of results to return per page
      example: 10
      in: query
      name: limit
      schema:
        default: 10
        format: int32
        maximum: 100
        minimum: 10
        multipleOf: 10
        type: integer
  headers:
    SunsetHeader:
      description: 'A header containing the date of when the underlying endpoint will be removed. This header is only present if the endpoint has been deprecated. For information purposes only. Returned as a date in the format: YYYY-MM-DD'
      example: '2021-08-02'
      schema:
        format: date
        type: string
    VersionRequestedResponseHeader:
      description: A header containing the version of the endpoint requested by the caller.
      example: '2026-03-25'
      schema:
        $ref: '#/components/schemas/QueryVersion'
    VersionServedResponseHeader:
      description: A header containing the version of the endpoint that was served by the API.
      example: '2026-03-25'
      schema:
        $ref: '#/components/schemas/ActualVersion'
    VersionStageResponseHeader:
      description: 'A header containing the version stage of the endpoint. This stage describes the guarantees snyk provides surrounding stability of the endpoint.

        '
      schema:
        enum:
        - wip
        - experimental
        - beta
        - ga
        - deprecated
        - sunset
        example: ga
        type: string
    RequestIdResponseHeader:
      description: 'A header containing a unique id used for tracking this request. If you are reporting an issue to Snyk it''s very helpful to provide this ID.

        '
      example: 4b58e274-ec62-4fab-917b-1d2c48d6bdef
      schema:
        format: uuid
        type: string
    LocationHeader:
      description: 'A header providing a URL for the location of a resource

        '
      example: https://example.com/resource/4
      schema:
        format: url
        type: string
    DeprecationHeader:
      description: 'A header containing the deprecation date of the underlying endpoint. For more information, please refer to the deprecation header RFC:

        https://tools.ietf.org/id/draft-dalal-deprecation-header-01.html

        '
      example: '2021-07-01T00:00:00Z'
      schema:
        format: date-time
        type: string
  schemas:
    ActualVersion:
      description: Resolved API version
      example: '2026-03-25'
      pattern: ^((([0-9]{4})-([0-1][0-9]))-((3[01])|(0[1-9])|([12][0-9]))(~(wip|work-in-progress|experimental|beta))?)$
      type: string
    JsonApi:
      additionalProperties: false
      example:
        version: '1.0'
      properties:
        version:
          description: Version of the JSON API specification this server supports.
          example: '1.0'
          pattern: ^(0|[1-9]\d*)\.(0|[1-9]\d*)$
          type: string
      required:
      - version
      type: object
    QueryVersion:
      description: Requested API version
      example: '2026-03-25'
      pattern: ^(wip|work-in-progress|experimental|beta|((([0-9]{4})-([0-1][0-9]))-((3[01])|(0[1-9])|([12][0-9]))(~(wip|work-in-progress|experimental|beta))?))$
      type: string
    ErrorDocument:
      additionalProperties: false
      example:
        errors:
        - detail: Permission denied for this resource
          status: '403'
        jsonapi:
          version: '1.0'
      properties:
        errors:
          example:
          - detail: Permission denied for this resource
            status: '403'
          items:
            additionalProperties: false
            example:
              detail: Not Found
              status: '404'
            properties:
              code:
                description: An application-specific error code, expressed as a string value.
                example: entity-not-found
                type: string
              detail:
                description: A human-readable explanation specific to this occurrence of the problem.
                example: 'The request was missing these required fields: ...'
                type: string
              id:
                description: A unique identifier for this particular occurrence of the problem.
                example: f16c31b5-6129-4571-add8-d589da9be524
                format: uuid
                type: string
              links:
                additionalProperties: false
                description: A link that leads to further details about this particular occurrance of the problem.
                example:
                  about: https://example.com/about_this_error
                properties:
                  about:
                    example: https://example.com/api/resource
                    oneOf:
                    - description: A string containing the link’s URL.
                      example: https://example.com/api/resource
                      type: string
                    - additionalProperties: false
                      example:
                        href: https://example.com/api/resource
                      properties:
                        href:
                          description: A string containing the link’s URL.
                          example: https://example.com/api/resource
                          type: string
                        meta:
                          additionalProperties: true
                          description: Free-form object that may contain non-standard information.
                          example:
                            key1: value1
                            key2:
                              sub_key: sub_value
                            key3:
                            - array_value1
                            - array_value2
                          type: object
                      required:
                      - href
                      type: object
                type: object
              meta:
                additionalProperties: true
                example:
                  key: value
                type: object
              source:
                additionalProperties: false
                example:
                  pointer: /data/attributes
                properties:
                  parameter:
                    description: A string indicating which URI query parameter caused the error.
                    example: param1
                    type: string
                  pointer:
                    description: A JSON Pointer [RFC6901] to the associated entity in the request document.
                    example: /data/attributes
                    type: string
                type: object
              status:
                description: The HTTP status code applicable to this problem, expressed as a string value.
                example: '400'
                pattern: ^[45]\d\d$
                type: string
              title:
                description: A short, human-readable summary of the problem that SHOULD NOT change from occurrence to occurrence of the problem, except for purposes of localization.
                example: Bad request
                type: string
            required:
            - status
            - detail
            type: object
          minItems: 1
          type: array
        jsonapi:
          additionalProperties: false
          example:
            version: '1.0'
          properties:
            version:
              description: Version of the JSON API specification this server supports.
              example: '1.0'
              pattern: ^(0|[1-9]\d*)\.(0|[1-9]\d*)$
              type: string
          required:
          - version
          type: object
      required:
      - jsonapi
      - errors
      type: object
    Links:
      additionalProperties: false
      properties:
        first:
          $ref: '#/components/schemas/LinkProperty'
        last:
          $ref: '#/components/schemas/LinkProperty'
        next:
          $ref: '#/components/schemas/LinkProperty'
        prev:
          $ref: '#/components/schemas/LinkProperty'
        related:
          $ref: '#/components/schemas/LinkProperty'
        self:
          $ref: '#/components/schemas/LinkProperty'
      type: object
    ServiceAccount:
      additionalProperties: false
      properties:
        attributes:
          additionalProperties: false
          properties:
            access_token:
              description: The Snyk access token for this service account. Only returned on creation, and only when auth_type is access_token..
              type: string
            access_token_expires_at:
              description: The expiry date of the access token. Only provided when auth_type is access_token.
              example: '2025-08-16T00:00:00Z'
              format: date-time
              type: string
            access_token_ttl_seconds:
              description: The time, in seconds, that an oauth access token will be valid for. Defaults to 1hr if unset. Only provided when auth_type is oauth_client_secret or oauth_private_key_jwt.
              type: number
            api_key:
              description: The Snyk API Key for this service account. Only returned on creation, and only when auth_type is api_key.
              type: string
            auth_type:
              description: "The authentication strategy for the service account:\n  * api_key - Regular Snyk API Key.\n  * oauth_client_secret - OAuth2 client_credentials grant, which returns a client secret that can be used to retrieve an oauth access token.\n  * oauth_private_key_jwt - OAuth2 client_credentials grant, using private_key_jwt client_assertion as laid out in OIDC Connect Core 1.0, section 9.\n  * access_token - Access tokens are long-lived, can be used more than once for increased flexibility, and have expiries for enhanced security."
              enum:
              - api_key
              - oauth_client_secret
              - oauth_private_key_jwt
              - access_token
              type: string
            client_id:
              description: The service account's attached client-id. Used to request an access-token. Only provided when auth_type is oauth_client_secret or oauth_private_key_jwt.
              type: string
            client_secret:
              description: The client secret used for obtaining oauth access tokens. Only sent on creation of new service accounts and cannot be retrieved thereafter. Only provided when auth_type is oauth_client_secret.
              type: string
            created_at:
              description: The time at which the service account was created.
              example: '2025-08-16T00:00:00Z'
              format: date-time
              type: string
            jwks_url:
              description: A JWKs URL used to verify signed JWT requests against. Must be https. Only provided when auth_type is oauth_private_key_jwt.
              type: string
            level:
              description: "The level of access for the service account:\n  * Group - the service account was created at the Group level.\n  * Org - the service account was created at the Org level."
              enum:
              - Group
              - Org
              type: string
            name:
              description: A human-friendly name of the service account.
              type: string
            role_id:
              description: The ID of the role which the Service Account is associated with.
              format: uuid
              type: string
          required:
          - name
          - auth_type
          - role_id
          type: object
        id:
          format: uuid
          type: string
        links:
          $ref: '#/components/schemas/Links'
        type:
          type: string
      required:
      - type
      - id
      - attributes
      type: object
    LinkProperty:
      example: https://example.com/api/resource
      oneOf:
      - description: A string containing the link’s URL.
        example: https://example.com/api/resource
        type: string
      - additionalProperties: false
        example:
          href: https://example.com/api/resource
        properties:
          href:
            description: A string containing the link’s URL.
            example: https://example.com/api/resource
            type: string
          meta:
            additionalProperties: true
            description: Free-form object that may contain non-standard information.
            example:
              key1: value1
              key2:
                sub_key: sub_value
              key3:
              - array_value1
              - array_value2
            type: object
        required:
        - href
        type: object
  responses:
    '400':
      content:
        application/vnd.api+json:
          schema:
            $ref: '#/components/schemas/ErrorDocument'
      description: 'Bad Request: A parameter provided as a part of the request was invalid.'
      headers:
        deprecation:
          $ref: '#/components/headers/DeprecationHeader'
        snyk-request-id:
          $ref: '#/components/headers/RequestIdResponseHeader'
        snyk-version-lifecycle-stage:
          $ref: '#/components/headers/VersionStageResponseHeader'
        snyk-version-requested:
          $ref: '#/components/headers/VersionRequestedResponseHeader'
        snyk-version-served:
          $ref: '#/components/headers/VersionServedResponseHeader'
        sunset:
          $ref: '#/components/headers/SunsetHeader'
    '500':
      content:
        application/vnd.api+json:
          schema:
            $ref: '#/components/schemas/ErrorDocument'
      description: 'Internal Server Error: An error was encountered while attempting to process the request.'
      headers:
        deprecation:
          $ref: '#/components/headers/DeprecationHeader'
        snyk-request-id:
          $ref: '#/components/headers/RequestIdResponseHeader'
        snyk-version-lifecycle-stage:
          $ref: '#/components/headers/VersionStageResponseHeader'
        snyk-version-requested:
          $ref: '#/components/headers/VersionRequestedResponseHeader'
        snyk-version-served:
          $ref: '#/components/headers/VersionServedResponseHeader'
        sunset:
          $ref: '#/components/headers/SunsetHeader'
    '403':
      content:
        application/vnd.api+json:
          schema:
            $ref: '#/components/schemas/ErrorDocument'
      description: 'Forbidden: the request requires an authentication token with more or different permissions.'
      headers:
        deprecation:
          $ref: '#/components/headers/DeprecationHeader'
        snyk-request-id:
          $ref: '#/components/headers/RequestIdResponseHeader'
        snyk-version-lifecycle-stage:
          $ref: '#/components/headers/VersionStageResponseHeader'
        snyk-version-requested:
          $ref: '#/components/headers/VersionRequestedResponseHeader'
        snyk-version-served:
          $ref: '#/components/headers/VersionServedResponseHeader'
        sunset:
          $ref: '#/components/headers/SunsetHeader'
    '404':
      content:
        application/vnd.api+json:
          schema:
            $ref: '#/components/schemas/ErrorDocument'
      description: 'Not Found: The resource being operated on could not be found.'
      headers:
        deprecation:
          $ref: '#/components/headers/DeprecationHeader'
        snyk-request-id:
          $ref: '#/components/headers/RequestIdResponseHeader'
        snyk-version-lifecycle-stage:
          $ref: '#/components/headers/VersionStageResponseHeader'
        snyk-version-requested:
          $ref: '#/components/headers/VersionRequestedResponseHeader'
        snyk-version-served:
          $ref: '#/components/headers/VersionServedResponseHeader'
        sunset:
          $ref: '#/components/headers/SunsetHeader'
    '401':
      content:
        application/vnd.api+json:
          schema:
            $ref: '#/components/schemas/ErrorDocument'
      description: 'Unauthorized: the request requires an authentication token.'
      headers:
        deprecation:
          $ref: '#/components/headers/DeprecationHeader'
        snyk-request-id:
          $ref: '#/components/headers/RequestIdResponseHeader'
        snyk-version-lifecycle-stage:
          $ref: '#/components/headers/VersionStageResponseHeader'
        snyk-version-requested:
          $ref: '#/components/headers/VersionRequestedResponseHeader'
        snyk-version-served:
          $ref: '#/components/headers/VersionServedResponseHeader'
        sunset:
          $ref: '#/components/headers/SunsetHeader'
  securitySchemes:
    APIToken:
      description: API key value must be prefixed with \"Token \".
      in: header
      name: Authorization
      type: apiKey
    BearerAuth:
      scheme: bearer
      type: http
x-snyk-api-version: '2024-10-15'