Skip to content
adversarial

Create a service account

POST
/v1/oauth/clients
curl --request POST \
  --url https://api.adversarial.com/api/v1/oauth/clients \
  --header 'Content-Type: application/json' \
  --cookie arm-session=<arm-session> \
  --data '{ "allowed_ips": [ "example" ], "client_name": "example", "expires_at": "2026-04-15T12:00:00Z", "roles": [ "example" ] }'

Creates a service account and issues its client_id and client_secret for the client credentials grant. The secret is returned in this response only and cannot be retrieved afterwards — store it before discarding the response. Any member may create one; its roles must be a subset of the caller’s own permissions and may not include admin. One member may hold up to 50 active service accounts; revoking one frees a slot.

Authorizations

Section titled “Authorizations”

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json
object
allowed_ips

IP/CIDR allowlist; null or empty = unrestricted

Array<string> | null
client_name
required

User-friendly name for the service account

string
expires_at

Optional expiration

string | null format: date-time
roles
required

Role names to assign to the service-account user. Case-insensitive; must be non-empty.

Array<string>
Examplegenerated
{
  "allowed_ips": [
    "example"
  ],
  "client_name": "example",
  "expires_at": "2026-04-15T12:00:00Z",
  "roles": [
    "example"
  ]
}

Responses

Section titled “Responses”

201

Section titled “201”

OAuth client created successfully

Media typeapplication/json
object
allowed_ips
Array<string> | null
client_id

Omitted, along with allowed_ips and expires_at, unless the caller owns the service account or is an administrator.

string | null
client_name
required
string
client_secret
string | null
created_by
string | null format: uuid
created_date
required
string format: date-time
expires_at
string | null format: date-time
id
required
string format: uuid
last_used
string | null format: date-time
org_id
required
string format: uuid
revoked_at
string | null format: date-time
roles
required
Array<string>
user
required

The service-account user this key authenticates as — one user per key.

object
email
required
string
first_name
required
string
icon

Relative path to the user’s avatar endpoint, e.g. "users/{id}/avatar?v={hash}". None when the user has no avatar.

string | null
id
required
string format: uuid
last_name
required
string
user_id
required
string format: uuid
Examplegenerated
{
  "allowed_ips": [
    "example"
  ],
  "client_id": "example",
  "client_name": "example",
  "client_secret": "example",
  "created_by": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
  "created_date": "2026-04-15T12:00:00Z",
  "expires_at": "2026-04-15T12:00:00Z",
  "id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
  "last_used": "2026-04-15T12:00:00Z",
  "org_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
  "revoked_at": "2026-04-15T12:00:00Z",
  "roles": [
    "example"
  ],
  "user": {
    "email": "example",
    "first_name": "example",
    "icon": "example",
    "id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
    "last_name": "example"
  },
  "user_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0"
}

400

Section titled “400”

Invalid request

401

Section titled “401”

Unauthorized

403

Section titled “403”

Forbidden

409

Section titled “409”

Active service account quota reached