> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sndbox.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Service-account API

> Issue bounded credentials or exchange a signed client assertion for a 15-minute bearer token.

Workspace service-account operations include list, create, issue token, register/revoke assertion keys, revoke access tokens, and decide periodic access reviews. Organisation service accounts can carry 1–100 workspace assignments.

## Create and issue

Creation requires an interactive human with `service_accounts.manage` in every assigned workspace. Credential issue/revocation requires `api_credentials.manage` for every workspace included by the token. Requests also require a fresh `X-Sandbox-Request-Time`.

The creation response is metadata. The token-issue response contains `credential.token` exactly once.

## Client assertion exchange

Register a workspace-bound Ed25519 SPKI public key. Sign a compact JWT with `alg=EdDSA`, the registered `kid`, and:

* identical service-account UUID values for `iss` and `sub`;
* audience equal to the public control-plane URL plus `/v1/service-account-assertions/token`;
* `iat`, `exp`, and a unique 16–200 character `jti`;
* at most a five-minute assertion lifetime; and
* `sandbox_scopes`, `sandbox_workspace_ids`, and `sandbox_environment_ids` arrays.

The exchanged bearer credential lasts 15 minutes and cannot exceed the account/key/resource policy. Replayed `jti` values are rejected.

See [Service accounts and tokens](/cloud/service-accounts) for lifecycle and [API reference](/api-reference) for request bodies.