> ## Documentation Index > Fetch the complete documentation index at: https://docs.baseten.co/llms.txt > Use this file to discover all available pages before exploring further. # Create a service account > Creates a service account for workload identity federation tokens. ## OpenAPI ````yaml post /v1/service_accounts openapi: 3.1.0 info: description: REST API for management of Baseten resources title: Baseten management API version: 1.0.0 servers: - url: https://api.baseten.co security: - BearerAuth: [] paths: /v1/service_accounts: post: summary: Creates a service account description: >- Creates a service account that workload identity federation tokens act as. It's enabled at once. Omit `team_id` for an organization account, which only an organization admin can create. A team admin can create accounts for their own team. requestBody: content: application/json: schema: $ref: '#/components/schemas/CreateServiceAccountRequestV1' required: true responses: '200': description: '' content: application/json: schema: $ref: '#/components/schemas/ServiceAccountV1' x-codeSamples: - lang: bash source: |- curl --request POST \ --url https://api.baseten.co/v1/service_accounts \ --header "Authorization: Bearer $BASETEN_API_KEY" \ --data '{ "name": "ci-deployer", "description": "GitHub Actions deploys from acme/models", "team_id": "abcd1234", "preset_permissions": { "type": "WORKSPACE_MANAGE_ALL" } }' - lang: python source: |- import requests import os API_KEY = os.environ.get("BASETEN_API_KEY", "") url = "https://api.baseten.co/v1/service_accounts" headers = {"Authorization": f"Bearer {API_KEY}"} response = requests.request( "POST", url, headers=headers, json={'name': 'ci-deployer', 'description': 'GitHub Actions deploys from acme/models', 'team_id': 'abcd1234', 'preset_permissions': {'type': 'WORKSPACE_MANAGE_ALL'}} ) print(response.text) components: schemas: CreateServiceAccountRequestV1: additionalProperties: false description: Request to create a service account. properties: name: description: Name, unique in the organization. Can be changed later. examples: - ci-deployer maxLength: 255 minLength: 1 title: Name type: string description: anyOf: - maxLength: 1024 type: string - type: 'null' default: null description: Optional description, up to 1,024 characters title: Description team_id: anyOf: - minLength: 1 type: string - type: 'null' default: null description: >- The team that owns the account. Omit for an organization account. Can't be changed. title: Team Id preset_permissions: $ref: '#/components/schemas/ServiceAccountPresetPermissionsRequestV1' description: >- What the service account may do. Can be changed later. Temporary; may be removed once fine-grained access control is available. required: - name - preset_permissions title: CreateServiceAccountRequestV1 type: object ServiceAccountV1: description: A named service account that workload identity federation tokens act as. properties: id: description: Service account ID title: Id type: string name: description: Name, unique in the organization title: Name type: string description: anyOf: - type: string - type: 'null' default: null description: Description title: Description team_id: anyOf: - type: string - type: 'null' default: null description: The team that owns the account. Null for an organization account. title: Team Id preset_permissions: $ref: '#/components/schemas/ServiceAccountPresetPermissionsV1' description: >- What the service account may do. Temporary; may be removed once fine-grained access control is available. disabled: description: Whether the account is disabled. A disabled account can't be used. title: Disabled type: boolean last_used_at: anyOf: - format: date-time type: string - type: 'null' default: null description: >- Last time a token was exchanged for this account. Null until the first. title: Last Used At created_at: description: Time the account was created format: date-time title: Created At type: string updated_at: description: Time the account was last updated format: date-time title: Updated At type: string required: - id - name - preset_permissions - disabled - created_at - updated_at title: ServiceAccountV1 type: object ServiceAccountPresetPermissionsRequestV1: additionalProperties: false description: >- A service account's access, as sent. Omit a list for no restriction; never send it empty. properties: type: $ref: '#/components/schemas/ServiceAccountPresetTypeV1' description: >- What the service account may do. WORKSPACE_MANAGE_API_KEYS is for organization-level accounts only; every other type needs a team. examples: - WORKSPACE_MANAGE_ALL model_ids: anyOf: - items: type: string type: array - type: 'null' default: null description: >- WORKSPACE_INVOKE and WORKSPACE_EXPORT_METRICS only. Models the account covers. Omit for every model in the team, including models added later. examples: - - abcd1234 title: Model Ids environment_names: anyOf: - items: type: string type: array - type: 'null' default: null description: >- WORKSPACE_INVOKE: environments the account may call; omit for all. With model_ids, each model must have each environment. WORKSPACE_MANAGE_ALL: restricted environments the account may also manage. examples: - - production title: Environment Names model_api_slugs: anyOf: - items: type: string type: array - type: 'null' default: null description: >- WORKSPACE_INVOKE_MODEL_APIS only. Model APIs the account may call; omit for all. examples: - - my-model-api title: Model Api Slugs required: - type title: ServiceAccountPresetPermissionsRequestV1 type: object ServiceAccountPresetPermissionsV1: description: >- A service account's access: one of the access types API keys have. Temporary: mirrors API key access until fine-grained access control is available, and may be removed. properties: type: $ref: '#/components/schemas/ServiceAccountPresetTypeV1' description: >- What the service account may do. WORKSPACE_MANAGE_API_KEYS is for organization-level accounts only; every other type needs a team. examples: - WORKSPACE_MANAGE_ALL model_ids: anyOf: - items: type: string type: array - type: 'null' default: null description: >- WORKSPACE_INVOKE and WORKSPACE_EXPORT_METRICS only. Models the account covers. Omit for every model in the team, including models added later. examples: - - abcd1234 title: Model Ids environment_names: anyOf: - items: type: string type: array - type: 'null' default: null description: >- WORKSPACE_INVOKE: environments the account may call; omit for all. With model_ids, each model must have each environment. WORKSPACE_MANAGE_ALL: restricted environments the account may also manage. examples: - - production title: Environment Names model_api_slugs: anyOf: - items: type: string type: array - type: 'null' default: null description: >- WORKSPACE_INVOKE_MODEL_APIS only. Model APIs the account may call; omit for all. examples: - - my-model-api title: Model Api Slugs required: - type title: ServiceAccountPresetPermissionsV1 type: object ServiceAccountPresetTypeV1: description: >- What a service account may do: the workspace API key categories, plus Model APIs. Temporary: mirrors API key access until fine-grained access control is available, and may be removed. enum: - WORKSPACE_MANAGE_ALL - WORKSPACE_INVOKE - WORKSPACE_EXPORT_METRICS - WORKSPACE_MANAGE_API_KEYS - WORKSPACE_INVOKE_MODEL_APIS title: ServiceAccountPresetTypeV1 type: string securitySchemes: BearerAuth: type: http scheme: bearer description: >- Send `Authorization: Bearer `. The legacy `Authorization: Api-Key ` scheme is also accepted. ````