​

service-accounts

orc service-accounts creates machine-authentication principals bound to a Workspace, inspects and updates their roles and status, and issues API keys. Suspending an account disables its existing keys; you can activate it again later.

The CLI manages only Workspace-bound service accounts. Creating, updating, and issuing keys requires project:update permission. Before issuing a key, prepare a new output file outside source control.

List service accounts.

Lists IDs, roles, status, and Workspace IDs. Use --limit and --cursor for pagination.

Creates a Workspace-scoped service account with a name. The CLI supports only --scope workspace and rejects --scope organization.

Retry identity for operations that support idempotency. Use a unique key for each new operation, and reuse it only when retrying the same HTTP method, path, query values and exact request body. JSON whitespace changes can count as a different body. Keys contain 1–255 characters after trimming and expire after 24 hours. A completed JSON response is replayed without repeating the operation. A different request using the same key returns 409 idempotency_error. An in-progress request returns 409 idempotency_in_progress with Retry-After: 2. Whether this header is required depends on the operation.

Type: string. Optional.

(required) Display name for the service account.

Type: string. Optional.

Credential binding scope. Organization scope creates a service account without a Workspace binding.; enum: workspace|organization

Type: string. Optional.

Optional explicit Workspace binding. Omit for the current Workspace; use null with organization scope.; (use "null" or "reset" to clear)

Type: string. Optional.

Retrieves current information for a service account ID. Run it with the target Workspace selected.

Updates the name or status. status is active, suspended, or deleted. suspended disables existing keys until the account returns to active. deleted is permanent.

Updated display name.

Type: string. Optional.

active — normal operation.
suspended — all keys disabled, can be reactivated.
deleted — permanent removal, all keys revoked.; enum: active|suspended|deleted

Type: string. Optional.

Issues a key using the service account ID, key name, permissions, and a new --output destination. The key is returned once and saved to an owner-only file. Existing files are not overwritten.

Retry identity for operations that support idempotency. Use a unique key for each new operation, and reuse it only when retrying the same HTTP method, path, query values and exact request body. JSON whitespace changes can count as a different body. Keys contain 1–255 characters after trimming and expire after 24 hours. A completed JSON response is replayed without repeating the operation. A different request using the same key returns 409 idempotency_error. An in-progress request returns 409 idempotency_in_progress with Retry-After: 2. Whether this header is required depends on the operation.

Type: string. Optional.

(required) Required display name for the key.

Type: string. Optional.

Endpoint-group permission map. Each key is an endpoint group name,
value is the access level. Unspecified groups default to none.; (JSON object, e.g. '{"custom_id":"x"}')

Type: string. Optional.

Create a Workspace service account.

Suspend a service account.

Save a read key to a private file.

Revoke an unused key.

The CLI does not print the key to standard output or standard error. Do not paste the secret into logs, chat, Issues, or source code. Use the key ID in normal output and service_account_id in orc api-keys list to identify the key, then revoke unused keys with orc api-keys delete.

The following global options can be used with orc service-accounts:

For details and examples, see global options.