POST/api/apps/{app_id}/service-accountAuthenticated

Create an app's service account

Creates the client application's service account ahead of its first client_credentials grant, so its uid can be granted permissions on resource servers up front. Idempotent: an existing service account is returned with created: false and status 200. Requires management access; hardcoded apps cannot be configured.

operationId post_api_apps_app_id_service_accountClient applications

Authentication & permissionsAuthenticated

Any authenticated user

Accepted credentials: Auth server session (refresh token cookie)cookie "refresh_token_<auth_server_app_id>"
Access token (cookie)cookie "access_token_<auth_server_app_id>"
Access token (Bearer)Authorization: Bearer <JWT>
Who may call: Any authenticated user

Path parameters

Name	Type	Description
app_id*	string	Client application id

Responses

application/json

AppServiceAccountCreationResponse

Property	Type	Description
success*	true
message*	string
service_account*	AppServiceAccountSummary \| null	Null until the first client_credentials grant (or explicit creation)
uid*	string	The service account's user id (`sub` / `uid` of its tokens)
email*	string	Synthetic, undeliverable address under the reserved `.invalid` TLD
created_at*	number	Unix epoch milliseconds
disabled*	boolean	A disabled service account is refused the client_credentials grant
created*	boolean	False when the service account already existed

JSONExample

"success"true

"message""string"

"service_account"

"uid""string"

"email""string"

"created_at"1.5

"disabled"true

"created"true

application/json

AppServiceAccountCreationResponse

Property	Type	Description
success*	true
message*	string
service_account*	AppServiceAccountSummary \| null	Null until the first client_credentials grant (or explicit creation)
uid*	string	The service account's user id (`sub` / `uid` of its tokens)
email*	string	Synthetic, undeliverable address under the reserved `.invalid` TLD
created_at*	number	Unix epoch milliseconds
disabled*	boolean	A disabled service account is refused the client_credentials grant
created*	boolean	False when the service account already existed

JSONExample

"success"true

"message""string"

"service_account"

"uid""string"

"email""string"

"created_at"1.5

"disabled"true

"created"true

Example request

bashcurl

curl -X POST 'https://auth.schemavaults.com/api/apps/<app_id>/service-account' \
  -b 'refresh_token_<auth_server_app_id>=<value>'

Authentication & permissionsAuthenticated

Path parameters

Responses

200The app already had a service account

201The service account was created

400The request failed validation (issues lists the offending fields) or was refused by the handler

401No valid session cookie, access token cookie or bearer access token was presented, or the token was revoked

403The app is hardcoded, or the caller may not manage it (platform administrators, owners / admins of the owning organization, or the owning user only)

404No such app

500Failed to load the app or verify authorization

Example request

Other methods on this path