List service accounts (integration + API-key) in the organization.

GET

/v1/service-accounts

const url = 'https://api.adversarial.com/api/v1/service-accounts?page_size=25&page=1&created_after=2026-01-01&created_before=2026-12-31';
const options = {method: 'GET'};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url 'https://api.adversarial.com/api/v1/service-accounts?page_size=25&page=1&created_after=2026-01-01&created_before=2026-12-31'

Parameters

Query Parameters

page_size

integer format: int64

default: 25 >= 1 <= 100

Rows per page. Defaults to 25, max 100; zero is rejected.

page

integer format: int64

default: 1 >= 1 <= 1000000

1-indexed page number. Defaults to 1; zero is rejected.

query

string | null

Freetext ILIKE across first_name, last_name, and email.

active

boolean | null

true returns only active service accounts (deactivated_date IS NULL); false only deactivated; absent returns both.

kind

Array<string> | null

Restrict to integration SAs, credential SAs, or both (default).

roles

Array<string> | null

Role UUIDs — matches SAs holding any of the listed roles.

created_after

One of:

string
null

One side of a date range: an RFC 3339 timestamp in any UTC offset, used as given, or a bare YYYY-MM-DD naming a whole UTC day.

string

Service accounts added to the organization at or after this bound (inclusive, >=). An RFC 3339 timestamp in any UTC offset (Z, -05:00) is used as given; a bare YYYY-MM-DD names a whole UTC day, so created_after=2026-04-01 includes April 1.

Example

2026-01-01

created_before

One of:

string
null

One side of a date range: an RFC 3339 timestamp in any UTC offset, used as given, or a bare YYYY-MM-DD naming a whole UTC day.

string

Service accounts added to the organization at or before this bound (inclusive, <=). An RFC 3339 timestamp in any UTC offset (Z, -05:00) is used as given; a bare YYYY-MM-DD names a whole UTC day, so created_before=2026-04-30 includes April 30.

Example

2026-12-31

created_by

string | null format: uuid

Only credential SAs created by this user.

Responses

200

List service accounts in the organization

application/json

Paginated list envelope: { "results": [...], "pagination": {...} }.

object

pagination

required

Pagination metadata describing the slice.

object

page

required

1-indexed page number of this result slice.

integer format: int64

page_size

required

Number of items requested per page.

integer format: int64

total_items

required

Total number of matching items across all pages.

integer format: int64

total_pages

required

Total number of pages at this page size.

integer format: int64

results

required

The items on this page.

Array

A non-human account belonging to the organization. Covers both integration service accounts, created automatically when an integration is configured, and credential service accounts created through POST /v1/oauth/clients.

Unlike a member, a service account has no last_login.

object

email

required

string

first_name

required

string

icon

Relative path to the user’s avatar endpoint, e.g. "users/{id}/avatar?v={hash}". None when the user has no avatar.

string | null

required

string format: uuid

last_name

required

string

allowed_ips

IP allowlist enforced on token exchange. Populated only for credential SAs.

Array<string> | null

can_manage

required

Whether the caller may edit, rotate or delete this service account.

boolean

client_id

Public OAuth client ID (arm_sa_…). Populated only for credential SAs.

string | null

created_by_user

One of:

object
null

The administrator who created this credential. Present only for credential service accounts whose creator is still a member of the organization.

object

email

required

string

first_name

required

string

icon

Relative path to the user’s avatar endpoint, e.g. "users/{id}/avatar?v={hash}". None when the user has no avatar.

string | null

required

string format: uuid

last_name

required

string

created_date

required

string format: date-time

deactivated_date

Soft-deactivation timestamp from organization_user.deactivated_date. None means the SA is currently active. The unified Service Accounts page uses this to render disabled rows alongside active ones.

string | null format: date-time

expires_at

Hard expiry on the credential. Populated only for credential SAs.

string | null format: date-time

integration_provider

The integration this account acts for, as the provider’s identifier in the integrations API (for example wiz). Present only for integration service accounts whose connection still exists.

string | null

kind

required

Primary discriminator on a service account.

Wire format is SCREAMING_SNAKE_CASE (INTEGRATION, CREDENTIAL) so the values read as constants.

string

Allowed values: INTEGRATION CREDENTIAL

last_used

Most-recent successful token exchange. Populated only for credential SAs.

string | null format: date-time

oauth_client_id

The id used to address this credential at /v1/oauth/clients/{id}, for updating or deleting it. Present only for credential service accounts. Distinct from client_id, the public arm_sa_… string presented at token exchange.

string | null format: uuid

revoked_at

When the credential was administratively revoked. Populated only for credential SAs; mirrors deactivated_date once revoked.

string | null format: date-time

roles

required

Roles held by this SA. Empty for integration SAs; populated from role_user_org for credential SAs.

Array<string>

Example

{
  "results": [
    {
      "kind": "INTEGRATION"
    }
  ]
}

401

Unauthorized

500

Internal server error