CData

CData Service Accounts API

Full lifecycle management for machine identities (CI/CD pipelines, IaC tooling, Terraform automation). Service accounts are not SCIM-owned and authenticate via OAuth 2.0 client credentials using the `client_id` returned on creation.

Documentation GitHub OpenAPI

Business capability

Identity & Access Management BC-620.20

Operations 14

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

POST /service-accounts Create a service account for automation · Create Service Account #

Ask an LLM

“How do I create a machine identity for my Terraform or CI/CD pipeline?”

“Will creating a service account twice with the same external Id make a duplicate?”

Tell an agent

Create a service account named {name}.

Create service account {name} described as {description} with idempotency key {external_id}.

GET /service-accounts List the organization's service accounts · List Service Accounts #

Ask an LLM

“Which machine identities, like CI/CD service accounts, exist in our Connect AI organization?”

“Can I list only the service accounts that are deactivated?”

Tell an agent

List all service accounts in the organization.

Show service accounts with status {status}.

GET /service-accounts/{id} Get one service account and its permissions · Get Service Account #

Ask an LLM

“How do I look up a single service account's details and direct permissions?”

“What status and settings does a given service account currently have?”

Tell an agent

Get service account {id}.

Show me the details of machine identity {id}.

PATCH /service-accounts/{id} Rename or deactivate a service account · Update Service Account #

Ask an LLM

“Does deactivating a service account revoke its personal access tokens right away?”

“Can I rename a service account without touching its other fields?”

Tell an agent

Rename service account {id} to {name}.

Set the status of service account {id} to {status}.

DELETE /service-accounts/{id} Deprovision a service account · Delete Service Account #

Ask an LLM

“What happens to a service account's tokens and roles when I delete it?”

“How do I permanently deprovision a machine identity we no longer use?”

Tell an agent destructive · confirm first

Delete service account {id} and revoke all its tokens.

Permanently deprovision the machine identity {id}.

POST /service-accounts/{id}/roles Grant the account-wide admin role to a service account · Assign Service Account Role #

Ask an LLM

“How do I make a service account an organization-wide admin?”

“Which role can be granted to a service account at the account level rather than per workspace?”

Tell an agent

Grant account-wide role {role_id} to service account {id}.

Make service account {id} an organization admin using role {role_id}.

GET /service-accounts/{id}/roles List roles held by a service account · List Service Account Roles #

Ask an LLM

“Which roles does a service account have across the organization, and where did each come from?”

“Is a service account an admin, and was it granted directly?”

Tell an agent

List all roles assigned to service account {id}.

Show every role grant and its provenance for machine identity {id}.

DELETE /service-accounts/{id}/roles/{role_id} Remove an account-level role from a service account · Remove Service Account Role #

Ask an LLM

“How do I take the admin role away from a service account?”

“Can I remove a role a service account got through a group?”

Tell an agent destructive · confirm first

Remove account-level role {role_id} from service account {id}.

Revoke the org-wide admin role {role_id} held directly by machine identity {id}.

POST /service-accounts/{id}/permissions Give a service account access to a connection · Assign Service Account Permission #

Ask an LLM

“How do I let a service account query one specific connection?”

“Can I restrict a service account to particular operations on a connection?”

Tell an agent

Give service account {id} {operations} access to connection {resource} as a {type} permission.

Grant machine identity {id} permission of type {type} to perform {operations} on {resource}.

GET /service-accounts/{id}/permissions List a service account's direct permissions · List Service Account Permissions #

Ask an LLM

“Which connections can a service account access through direct permissions?”

“What resource-level permissions were granted straight to a service account?”

Tell an agent

List the direct permissions of service account {id}.

Show which connections machine identity {id} has direct access to.

DELETE /service-accounts/{id}/permissions/{permission_id} Revoke a direct permission from a service account · Remove Service Account Permission #

Ask an LLM

“How do I cut off a service account's access to one connection without deleting it?”

“Can I revoke a single direct permission from a machine identity?”

Tell an agent destructive · confirm first

Remove permission {permission_id} from service account {id}.

Revoke direct permission {permission_id} held by machine identity {id}.

POST /service-accounts/{id}/workspaces/{workspace_id}/roles Grant a workspace role to a service account · Assign Service Account Workspace Role #

Ask an LLM

“How do I make a service account a workspace_admin in one workspace?”

“Can I assign a custom access role to a service account for a single workspace?”

Tell an agent

Grant role {role_id} to service account {id} in workspace {workspace_id}.

Make machine identity {id} a workspace admin of {workspace_id} with role {role_id}.

GET /service-accounts/{id}/workspaces/{workspace_id}/roles List a service account's roles in one workspace · List Service Account Workspace Roles #

Ask an LLM

“Which roles does a service account hold inside a particular workspace?”

“Is a service account a workspace admin in a given workspace?”

Tell an agent

List the roles service account {id} holds in workspace {workspace_id}.

Show workspace-scoped role grants for machine identity {id} in {workspace_id}.

DELETE /service-accounts/{id}/workspaces/{workspace_id}/roles/{role_id} Remove a workspace role from a service account · Remove Service Account Workspace Role #

Ask an LLM

“How do I take a workspace role away from a service account in one workspace?”

“Can I strip workspace admin rights from a machine identity without affecting other workspaces?”

Tell an agent destructive · confirm first

Remove role {role_id} from service account {id} in workspace {workspace_id}.

Revoke workspace {workspace_id} role {role_id} from machine identity {id}.

CData Service Accounts API

Operations 14

Documentation

Specifications

Schemas & Data

Other Resources

Work with this as data

MCP server

Tools for apis

Call it yourself

Get an API key

OpenAPI Specification