Skip to main content
Workspace service-account operations include list, create, issue token, register/revoke assertion keys, revoke access tokens, and decide periodic access reviews. Organisation service accounts can carry 1–100 workspace assignments.

​
Create and issue

Creation requires an interactive human with service_accounts.manage in every assigned workspace. Credential issue/revocation requires api_credentials.manage for every workspace included by the token. Requests also require a fresh X-Sandbox-Request-Time. The creation response is metadata. The token-issue response contains credential.token exactly once.

​
Client assertion exchange

Register a workspace-bound Ed25519 SPKI public key. Sign a compact JWT with alg=EdDSA, the registered kid, and:
  • identical service-account UUID values for iss and sub;
  • audience equal to the public control-plane URL plus /v1/service-account-assertions/token;
  • iat, exp, and a unique 16–200 character jti;
  • at most a five-minute assertion lifetime; and
  • sandbox_scopes, sandbox_workspace_ids, and sandbox_environment_ids arrays.
The exchanged bearer credential lasts 15 minutes and cannot exceed the account/key/resource policy. Replayed jti values are rejected. See Service accounts and tokens for lifecycle and API reference for request bodies.