GET/api/apps/{app_id}/service-accountAuthenticated

Get an app's service account

Returns the client application's service account (the machine identity grant_type=client_credentials tokens are minted for), if any, whether the app is currently a confidential client, i.e. eligible for that grant, and whether the service account is a member of the organization that owns the app (see PUT /api/apps/{app_id}/service-account/organization-membership). Requires management access; hardcoded apps cannot be configured.

operationId get_api_apps_app_id_service_accountClient applications

Authentication & permissionsAuthenticated

Any authenticated user

Accepted credentials: Auth server session (refresh token cookie)cookie "refresh_token_<auth_server_app_id>"
Access token (cookie)cookie "access_token_<auth_server_app_id>"
Access token (Bearer)Authorization: Bearer <JWT>
Who may call: Any authenticated user

Path parameters

Name	Type	Description
app_id*	string	Client application id

Responses

application/json

AppServiceAccountResponse

Property	Type	Description
success*	true
service_account*	AppServiceAccountSummary \| null	Null until the first client_credentials grant (or explicit creation)
uid*	string	The service account's user id (`sub` / `uid` of its tokens)
email*	string	Synthetic, undeliverable address under the reserved `.invalid` TLD
created_at*	number	Unix epoch milliseconds
disabled*	boolean	A disabled service account is refused the client_credentials grant
has_client_secret*	boolean	Whether the app can use the client_credentials grant right now (has a client secret)
organization_membership*	AppServiceAccountOrganizationMembership
available*	boolean	Whether the app is owned by an organization. Only the service account of an organization-owned app can be a member of an organization (its owner)
organization_id*	string \| null \| null	The organization that owns the app, which the service account joins; null when the app is not organization-owned
role*	"member" \| "owner" \| null \| null	The service account's role in that organization, as reported to resource servers' organization membership checks; null when it is not a member

JSONExample

"success"true

"service_account"

"uid""string"

"email""string"

"created_at"1.5

"disabled"true

"has_client_secret"true

"organization_membership"

"available"true

"organization_id""acme"

"role""member"

Example request

bashcurl

curl -X GET 'https://auth.schemavaults.com/api/apps/<app_id>/service-account' \
  -b 'refresh_token_<auth_server_app_id>=<value>'

Authentication & permissionsAuthenticated

Path parameters

Responses

200The service account (or null), the app's client secret status and the service account's organization membership

400The request failed validation (issues lists the offending fields) or was refused by the handler

401No valid session cookie, access token cookie or bearer access token was presented, or the token was revoked

403The app is hardcoded, or the caller may not manage it (platform administrators, owners / admins of the owning organization, or the owning user only)

404No such app

500Failed to load the app or verify authorization

Example request

Other methods on this path