MongoDB Service Accounts API
Endpoints for managing Service Accounts and secrets. Service Accounts are used for programmatic access to the Atlas Admin API through the OAuth 2.0 Client Credentials flow.
OpenAPI Specification
openapi: 3.0.1
info:
description: "The MongoDB Atlas Administration API allows developers to manage all components in MongoDB Atlas.\n\nThe Atlas Administration API supports OAuth2 Service Accounts and HTTP Digest-based API keys. Service accounts are the recommended authentication method and API keys are considered a legacy option.\n\nTo authenticate with a Service Account, first exchange its client ID and secret for an access token using the OAuth 2.0 Client Credentials flow. Atlas provides a token endpoint at `POST https://cloud.mongodb.com/api/oauth/token`, which returns a Bearer token that is reusable and valid for 1 hour (3600 seconds).\n\nFor example, to [return a list of your organizations](https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/operation/operation-listorgs) with [cURL](https://en.wikipedia.org/wiki/CURL), first generate an access token and then use that token to call the same Atlas Administration API endpoint shown in the current example:\n\n```\nACCESS_TOKEN=$(curl -fsS --request POST https://cloud.mongodb.com/api/oauth/token \\\n --header \"Authorization: Basic $(printf '%s' \"${CLIENT_ID}:${CLIENT_SECRET}\" | base64 | tr -d '\\n')\" \\\n --header \"Content-Type: application/x-www-form-urlencoded\" \\\n --header \"Accept: application/json\" \\\n --data \"grant_type=client_credentials\" | jq -r '.access_token')\n\ncurl --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n -X GET \"https://cloud.mongodb.com/api/atlas/v2/orgs?pretty=true\"\n```\n\nIf your organization requires an IP access list for the Atlas Administration API, the token can be created from any IP address, but the API call that uses the token must originate from an allowed IP.\n\nTo learn more, see [Get Started with the Atlas Administration API](https://www.mongodb.com/docs/atlas/configure-api-access/). For support, see [MongoDB Support](https://www.mongodb.com/support/get-started).\n\nYou can also explore the various endpoints available through the Atlas Administration API in MongoDB's [Postman workspace](https://www.postman.com/mongodb-devrel/workspace/mongodb-atlas-administration-apis/) (requires a Postman account)."
license:
name: CC BY-NC-SA 3.0 US
url: https://creativecommons.org/licenses/by-nc-sa/3.0/us/
termsOfService: https://www.mongodb.com/mongodb-management-service-terms-and-conditions
title: MongoDB Atlas Administration Access Tracking Service Accounts API
version: '2.0'
x-xgen-sha: 3d70e065843c008b9871ea7836c98c9de6f202f9
servers:
- url: https://cloud.mongodb.com
security:
- ServiceAccounts: []
- DigestAuth: []
tags:
- description: Endpoints for managing Service Accounts and secrets. Service Accounts are used for programmatic access to the Atlas Admin API through the OAuth 2.0 Client Credentials flow.
externalDocs:
description: Get Started with the Atlas Administration API
url: https://www.mongodb.com/docs/atlas/configure-api-access/
name: Service Accounts
paths:
/api/atlas/v2/groups/{groupId}/serviceAccounts:
get:
description: Returns all Service Accounts for the specified Project.
operationId: listGroupServiceAccounts
parameters:
- $ref: '#/components/parameters/groupId'
- $ref: '#/components/parameters/itemsPerPage'
- $ref: '#/components/parameters/pageNum'
- $ref: '#/components/parameters/pretty'
- $ref: '#/components/parameters/envelope'
responses:
'200':
content:
application/vnd.atlas.2024-08-05+json:
schema:
$ref: '#/components/schemas/PaginatedGroupServiceAccounts'
x-xgen-version: '2024-08-05'
description: OK
headers:
RateLimit-Limit:
$ref: '#/components/headers/HeaderRateLimitLimit'
RateLimit-Remaining:
$ref: '#/components/headers/HeaderRateLimitRemaining'
'401':
$ref: '#/components/responses/unauthorized'
'403':
$ref: '#/components/responses/forbidden'
'404':
$ref: '#/components/responses/notFound'
'429':
$ref: '#/components/responses/tooManyRequests'
'500':
$ref: '#/components/responses/internalServerError'
summary: Return All Project Service Accounts
tags:
- Service Accounts
x-codeSamples:
- lang: cURL
label: Atlas CLI
source: atlas api serviceAccounts listGroupServiceAccounts --help
- lang: go
label: Go
source: "import (\n\t\"os\"\n\t\"context\"\n\t\"log\"\n\tsdk \"go.mongodb.org/atlas-sdk/v20250312001/admin\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\tclientID := os.Getenv(\"MONGODB_ATLAS_CLIENT_ID\")\n\tclientSecret := os.Getenv(\"MONGODB_ATLAS_CLIENT_SECRET\")\n\n\t// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth\n\tclient, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))\n\n\tif err != nil {\n\t\tlog.Fatalf(\"Error: %v\", err)\n\t}\n\n\tparams = &sdk.ListGroupServiceAccountsApiParams{}\n\tsdkResp, httpResp, err := client.ServiceAccountsApi.\n\t\tListGroupServiceAccountsWithParams(ctx, params).\n\t\tExecute()\n}\n"
- lang: cURL
label: curl (Service Accounts)
source: "curl --include --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n -X GET \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/serviceAccounts?pretty=true\""
- lang: cURL
label: curl (Digest)
source: "curl --user \"${PUBLIC_KEY}:${PRIVATE_KEY}\" \\\n --digest --include \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n -X GET \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/serviceAccounts?pretty=true\""
x-rolesRequirements:
- Project Read Only
x-xgen-docs-url: https://mongodb.com/docs/atlas/reference/api-resources-spec/v2/#tag/Service-Accounts/operation/listGroupServiceAccounts
post:
description: Creates one Service Account for the specified Project. The Service Account will automatically be added as an Organization Member to the Organization that the specified Project is a part of.
operationId: createGroupServiceAccount
parameters:
- $ref: '#/components/parameters/groupId'
- $ref: '#/components/parameters/envelope'
- $ref: '#/components/parameters/pretty'
requestBody:
content:
application/vnd.atlas.2024-08-05+json:
schema:
$ref: '#/components/schemas/GroupServiceAccountRequest'
x-xgen-version: '2024-08-05'
description: Details of the new Service Account.
required: true
responses:
'201':
content:
application/vnd.atlas.2024-08-05+json:
schema:
$ref: '#/components/schemas/GroupServiceAccount'
x-xgen-version: '2024-08-05'
description: Created
headers:
RateLimit-Limit:
$ref: '#/components/headers/HeaderRateLimitLimit'
RateLimit-Remaining:
$ref: '#/components/headers/HeaderRateLimitRemaining'
'400':
$ref: '#/components/responses/badRequest'
'401':
$ref: '#/components/responses/unauthorized'
'403':
$ref: '#/components/responses/forbidden'
'404':
$ref: '#/components/responses/notFound'
'429':
$ref: '#/components/responses/tooManyRequests'
'500':
$ref: '#/components/responses/internalServerError'
summary: Create One Project Service Account
tags:
- Service Accounts
x-codeSamples:
- lang: cURL
label: Atlas CLI
source: atlas api serviceAccounts createGroupServiceAccount --help
- lang: go
label: Go
source: "import (\n\t\"os\"\n\t\"context\"\n\t\"log\"\n\tsdk \"go.mongodb.org/atlas-sdk/v20250312001/admin\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\tclientID := os.Getenv(\"MONGODB_ATLAS_CLIENT_ID\")\n\tclientSecret := os.Getenv(\"MONGODB_ATLAS_CLIENT_SECRET\")\n\n\t// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth\n\tclient, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))\n\n\tif err != nil {\n\t\tlog.Fatalf(\"Error: %v\", err)\n\t}\n\n\tparams = &sdk.CreateGroupServiceAccountApiParams{}\n\tsdkResp, httpResp, err := client.ServiceAccountsApi.\n\t\tCreateGroupServiceAccountWithParams(ctx, params).\n\t\tExecute()\n}\n"
- lang: cURL
label: curl (Service Accounts)
source: "curl --include --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n --header \"Content-Type: application/json\" \\\n -X POST \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/serviceAccounts\" \\\n -d '{ <Payload> }'"
- lang: cURL
label: curl (Digest)
source: "curl --user \"${PUBLIC_KEY}:${PRIVATE_KEY}\" \\\n --digest --include \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n --header \"Content-Type: application/json\" \\\n -X POST \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/serviceAccounts\" \\\n -d '{ <Payload> }'"
x-rolesRequirements:
- Project Owner
x-xgen-docs-url: https://mongodb.com/docs/atlas/reference/api-resources-spec/v2/#tag/Service-Accounts/operation/createGroupServiceAccount
/api/atlas/v2/groups/{groupId}/serviceAccounts/{clientId}:
delete:
description: Removes the specified Service Account from the specified project. The Service Account will still be a part of the Organization it was created in, and the credentials will remain active until expired or manually revoked.
operationId: deleteGroupServiceAccount
parameters:
- description: The Client ID of the Service Account.
in: path
name: clientId
required: true
schema:
example: mdb_sa_id_1234567890abcdef12345678
pattern: ^mdb_sa_id_[a-fA-F\d]{24}$
type: string
- $ref: '#/components/parameters/groupId'
- $ref: '#/components/parameters/envelope'
- $ref: '#/components/parameters/pretty'
responses:
'204':
content:
application/vnd.atlas.2024-08-05+json:
x-xgen-version: '2024-08-05'
description: This endpoint does not return a response body.
headers:
RateLimit-Limit:
$ref: '#/components/headers/HeaderRateLimitLimit'
RateLimit-Remaining:
$ref: '#/components/headers/HeaderRateLimitRemaining'
x-xgen-version: '2024-08-05'
'401':
$ref: '#/components/responses/unauthorized'
'403':
$ref: '#/components/responses/forbidden'
'404':
$ref: '#/components/responses/notFound'
'429':
$ref: '#/components/responses/tooManyRequests'
'500':
$ref: '#/components/responses/internalServerError'
summary: Remove One Project Service Account
tags:
- Service Accounts
x-codeSamples:
- lang: cURL
label: Atlas CLI
source: atlas api serviceAccounts deleteGroupServiceAccount --help
- lang: go
label: Go
source: "import (\n\t\"os\"\n\t\"context\"\n\t\"log\"\n\tsdk \"go.mongodb.org/atlas-sdk/v20250312001/admin\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\tclientID := os.Getenv(\"MONGODB_ATLAS_CLIENT_ID\")\n\tclientSecret := os.Getenv(\"MONGODB_ATLAS_CLIENT_SECRET\")\n\n\t// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth\n\tclient, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))\n\n\tif err != nil {\n\t\tlog.Fatalf(\"Error: %v\", err)\n\t}\n\n\tparams = &sdk.DeleteGroupServiceAccountApiParams{}\n\thttpResp, err := client.ServiceAccountsApi.\n\t\tDeleteGroupServiceAccountWithParams(ctx, params).\n\t\tExecute()\n}\n"
- lang: cURL
label: curl (Service Accounts)
source: "curl --include --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n -X DELETE \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/serviceAccounts/{clientId}\""
- lang: cURL
label: curl (Digest)
source: "curl --user \"${PUBLIC_KEY}:${PRIVATE_KEY}\" \\\n --digest --include \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n -X DELETE \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/serviceAccounts/{clientId}\""
x-rolesRequirements:
- Project Owner
x-xgen-docs-url: https://mongodb.com/docs/atlas/reference/api-resources-spec/v2/#tag/Service-Accounts/operation/deleteGroupServiceAccount
get:
description: Returns one Service Account in the specified Project.
operationId: getGroupServiceAccount
parameters:
- $ref: '#/components/parameters/groupId'
- description: The Client ID of the Service Account.
in: path
name: clientId
required: true
schema:
example: mdb_sa_id_1234567890abcdef12345678
pattern: ^mdb_sa_id_[a-fA-F\d]{24}$
type: string
- $ref: '#/components/parameters/envelope'
- $ref: '#/components/parameters/pretty'
responses:
'200':
content:
application/vnd.atlas.2024-08-05+json:
schema:
$ref: '#/components/schemas/GroupServiceAccount'
x-xgen-version: '2024-08-05'
description: OK
headers:
RateLimit-Limit:
$ref: '#/components/headers/HeaderRateLimitLimit'
RateLimit-Remaining:
$ref: '#/components/headers/HeaderRateLimitRemaining'
'401':
$ref: '#/components/responses/unauthorized'
'403':
$ref: '#/components/responses/forbidden'
'404':
$ref: '#/components/responses/notFound'
'429':
$ref: '#/components/responses/tooManyRequests'
'500':
$ref: '#/components/responses/internalServerError'
summary: Return One Project Service Account
tags:
- Service Accounts
x-codeSamples:
- lang: cURL
label: Atlas CLI
source: atlas api serviceAccounts getGroupServiceAccount --help
- lang: go
label: Go
source: "import (\n\t\"os\"\n\t\"context\"\n\t\"log\"\n\tsdk \"go.mongodb.org/atlas-sdk/v20250312001/admin\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\tclientID := os.Getenv(\"MONGODB_ATLAS_CLIENT_ID\")\n\tclientSecret := os.Getenv(\"MONGODB_ATLAS_CLIENT_SECRET\")\n\n\t// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth\n\tclient, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))\n\n\tif err != nil {\n\t\tlog.Fatalf(\"Error: %v\", err)\n\t}\n\n\tparams = &sdk.GetGroupServiceAccountApiParams{}\n\tsdkResp, httpResp, err := client.ServiceAccountsApi.\n\t\tGetGroupServiceAccountWithParams(ctx, params).\n\t\tExecute()\n}\n"
- lang: cURL
label: curl (Service Accounts)
source: "curl --include --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n -X GET \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/serviceAccounts/{clientId}?pretty=true\""
- lang: cURL
label: curl (Digest)
source: "curl --user \"${PUBLIC_KEY}:${PRIVATE_KEY}\" \\\n --digest --include \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n -X GET \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/serviceAccounts/{clientId}?pretty=true\""
x-rolesRequirements:
- Project Read Only
x-xgen-docs-url: https://mongodb.com/docs/atlas/reference/api-resources-spec/v2/#tag/Service-Accounts/operation/getGroupServiceAccount
patch:
description: Updates one Service Account in the specified Project.
operationId: updateGroupServiceAccount
parameters:
- description: The Client ID of the Service Account.
in: path
name: clientId
required: true
schema:
example: mdb_sa_id_1234567890abcdef12345678
pattern: ^mdb_sa_id_[a-fA-F\d]{24}$
type: string
- $ref: '#/components/parameters/groupId'
- $ref: '#/components/parameters/envelope'
- $ref: '#/components/parameters/pretty'
requestBody:
content:
application/vnd.atlas.2024-08-05+json:
schema:
$ref: '#/components/schemas/GroupServiceAccountUpdateRequest'
description: The new details for the Service Account.
required: true
responses:
'200':
content:
application/vnd.atlas.2024-08-05+json:
schema:
$ref: '#/components/schemas/GroupServiceAccount'
x-xgen-version: '2024-08-05'
description: OK
headers:
RateLimit-Limit:
$ref: '#/components/headers/HeaderRateLimitLimit'
RateLimit-Remaining:
$ref: '#/components/headers/HeaderRateLimitRemaining'
'400':
$ref: '#/components/responses/badRequest'
'401':
$ref: '#/components/responses/unauthorized'
'403':
$ref: '#/components/responses/forbidden'
'404':
$ref: '#/components/responses/notFound'
'429':
$ref: '#/components/responses/tooManyRequests'
'500':
$ref: '#/components/responses/internalServerError'
summary: Update One Project Service Account
tags:
- Service Accounts
x-codeSamples:
- lang: cURL
label: Atlas CLI
source: atlas api serviceAccounts updateGroupServiceAccount --help
- lang: go
label: Go
source: "import (\n\t\"os\"\n\t\"context\"\n\t\"log\"\n\tsdk \"go.mongodb.org/atlas-sdk/v20250312001/admin\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\tclientID := os.Getenv(\"MONGODB_ATLAS_CLIENT_ID\")\n\tclientSecret := os.Getenv(\"MONGODB_ATLAS_CLIENT_SECRET\")\n\n\t// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth\n\tclient, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))\n\n\tif err != nil {\n\t\tlog.Fatalf(\"Error: %v\", err)\n\t}\n\n\tparams = &sdk.UpdateGroupServiceAccountApiParams{}\n\tsdkResp, httpResp, err := client.ServiceAccountsApi.\n\t\tUpdateGroupServiceAccountWithParams(ctx, params).\n\t\tExecute()\n}\n"
- lang: cURL
label: curl (Service Accounts)
source: "curl --include --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n --header \"Content-Type: application/json\" \\\n -X PATCH \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/serviceAccounts/{clientId}\" \\\n -d '{ <Payload> }'"
- lang: cURL
label: curl (Digest)
source: "curl --user \"${PUBLIC_KEY}:${PRIVATE_KEY}\" \\\n --digest --include \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n --header \"Content-Type: application/json\" \\\n -X PATCH \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/serviceAccounts/{clientId}\" \\\n -d '{ <Payload> }'"
x-rolesRequirements:
- Project Owner
x-xgen-docs-url: https://mongodb.com/docs/atlas/reference/api-resources-spec/v2/#tag/Service-Accounts/operation/updateGroupServiceAccount
/api/atlas/v2/groups/{groupId}/serviceAccounts/{clientId}/accessList:
get:
description: Returns all access list entries that you configured for the specified Service Account for the project.
operationId: listGroupServiceAccountAccessList
parameters:
- $ref: '#/components/parameters/envelope'
- $ref: '#/components/parameters/includeCount'
- $ref: '#/components/parameters/itemsPerPage'
- $ref: '#/components/parameters/groupId'
- $ref: '#/components/parameters/pageNum'
- $ref: '#/components/parameters/pretty'
- description: The Client ID of the Service Account.
in: path
name: clientId
required: true
schema:
example: mdb_sa_id_1234567890abcdef12345678
pattern: ^mdb_sa_id_[a-fA-F\d]{24}$
type: string
responses:
'200':
content:
application/vnd.atlas.2024-08-05+json:
schema:
$ref: '#/components/schemas/PaginatedServiceAccountIPAccessEntryView'
x-xgen-version: '2024-08-05'
description: OK
headers:
RateLimit-Limit:
$ref: '#/components/headers/HeaderRateLimitLimit'
RateLimit-Remaining:
$ref: '#/components/headers/HeaderRateLimitRemaining'
'401':
$ref: '#/components/responses/unauthorized'
'403':
$ref: '#/components/responses/forbidden'
'404':
$ref: '#/components/responses/notFound'
'429':
$ref: '#/components/responses/tooManyRequests'
'500':
$ref: '#/components/responses/internalServerError'
summary: Return All Access List Entries for One Project Service Account
tags:
- Service Accounts
x-codeSamples:
- lang: cURL
label: Atlas CLI
source: atlas api serviceAccounts listAccessList --help
- lang: go
label: Go
source: "import (\n\t\"os\"\n\t\"context\"\n\t\"log\"\n\tsdk \"go.mongodb.org/atlas-sdk/v20250312001/admin\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\tclientID := os.Getenv(\"MONGODB_ATLAS_CLIENT_ID\")\n\tclientSecret := os.Getenv(\"MONGODB_ATLAS_CLIENT_SECRET\")\n\n\t// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth\n\tclient, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))\n\n\tif err != nil {\n\t\tlog.Fatalf(\"Error: %v\", err)\n\t}\n\n\tparams = &sdk.ListGroupServiceAccountAccessListApiParams{}\n\tsdkResp, httpResp, err := client.ServiceAccountsApi.\n\t\tListGroupServiceAccountAccessListWithParams(ctx, params).\n\t\tExecute()\n}\n"
- lang: cURL
label: curl (Service Accounts)
source: "curl --include --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n -X GET \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/serviceAccounts/{clientId}/accessList?pretty=true\""
- lang: cURL
label: curl (Digest)
source: "curl --user \"${PUBLIC_KEY}:${PRIVATE_KEY}\" \\\n --digest --include \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n -X GET \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/serviceAccounts/{clientId}/accessList?pretty=true\""
x-rolesRequirements:
- Project Read Only
x-xgen-docs-url: https://mongodb.com/docs/atlas/reference/api-resources-spec/v2/#tag/Service-Accounts/operation/listGroupServiceAccountAccessList
x-xgen-operation-id-override: listAccessList
post:
description: Add Access List Entries for the specified Service Account for the project. Resources require all API requests to originate from IP addresses on the API access list. To use this resource, the requesting Service Account or API Key must have the Project Owner role or Project Access Manager role.
operationId: createGroupServiceAccountAccessList
parameters:
- $ref: '#/components/parameters/envelope'
- $ref: '#/components/parameters/includeCount'
- $ref: '#/components/parameters/itemsPerPage'
- $ref: '#/components/parameters/groupId'
- $ref: '#/components/parameters/pageNum'
- $ref: '#/components/parameters/pretty'
- description: The Client ID of the Service Account.
in: path
name: clientId
required: true
schema:
example: mdb_sa_id_1234567890abcdef12345678
pattern: ^mdb_sa_id_[a-fA-F\d]{24}$
type: string
requestBody:
content:
application/vnd.atlas.2024-08-05+json:
schema:
items:
$ref: '#/components/schemas/ServiceAccountIPAccessListEntry'
maxItems: 200
type: array
x-xgen-version: '2024-08-05'
description: A list of access list entries to add to the access list of the specified Service Account for the project.
required: true
responses:
'200':
content:
application/vnd.atlas.2024-08-05+json:
schema:
$ref: '#/components/schemas/PaginatedServiceAccountIPAccessEntryView'
x-xgen-version: '2024-08-05'
description: OK
headers:
RateLimit-Limit:
$ref: '#/components/headers/HeaderRateLimitLimit'
RateLimit-Remaining:
$ref: '#/components/headers/HeaderRateLimitRemaining'
'400':
$ref: '#/components/responses/badRequest'
'401':
$ref: '#/components/responses/unauthorized'
'403':
$ref: '#/components/responses/forbidden'
'404':
$ref: '#/components/responses/notFound'
'409':
$ref: '#/components/responses/conflict'
'429':
$ref: '#/components/responses/tooManyRequests'
'500':
$ref: '#/components/responses/internalServerError'
summary: Add Access List Entries for One Project Service Account
tags:
- Service Accounts
x-codeSamples:
- lang: cURL
label: Atlas CLI
source: atlas api serviceAccounts createAccessList --help
- lang: go
label: Go
source: "import (\n\t\"os\"\n\t\"context\"\n\t\"log\"\n\tsdk \"go.mongodb.org/atlas-sdk/v20250312001/admin\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\tclientID := os.Getenv(\"MONGODB_ATLAS_CLIENT_ID\")\n\tclientSecret := os.Getenv(\"MONGODB_ATLAS_CLIENT_SECRET\")\n\n\t// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth\n\tclient, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))\n\n\tif err != nil {\n\t\tlog.Fatalf(\"Error: %v\", err)\n\t}\n\n\tparams = &sdk.CreateGroupServiceAccountAccessListApiParams{}\n\tsdkResp, httpResp, err := client.ServiceAccountsApi.\n\t\tCreateGroupServiceAccountAccessListWithParams(ctx, params).\n\t\tExecute()\n}\n"
- lang: cURL
label: curl (Service Accounts)
source: "curl --include --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n --header \"Content-Type: application/json\" \\\n -X POST \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/serviceAccounts/{clientId}/accessList\" \\\n -d '{ <Payload> }'"
- lang: cURL
label: curl (Digest)
source: "curl --user \"${PUBLIC_KEY}:${PRIVATE_KEY}\" \\\n --digest --include \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n --header \"Content-Type: application/json\" \\\n -X POST \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/serviceAccounts/{clientId}/accessList\" \\\n -d '{ <Payload> }'"
x-rolesRequirements:
- Project Access Manager
x-xgen-docs-url: https://mongodb.com/docs/atlas/reference/api-resources-spec/v2/#tag/Service-Accounts/operation/createGroupServiceAccountAccessList
x-xgen-operation-id-override: createAccessList
/api/atlas/v2/groups/{groupId}/serviceAccounts/{clientId}/accessList/{ipAddress}:
delete:
description: Removes the specified access list entry from the specified Service Account for the project. You can't remove the requesting IP address from the access list. To use this resource, the requesting Service Account or API Key must have the Project Owner role or Project Access Manager role.
operationId: deleteGroupServiceAccountAccessListEntry
parameters:
- $ref: '#/components/parameters/envelope'
- $ref: '#/components/parameters/groupId'
- $ref: '#/components/parameters/pretty'
- description: The Client ID of the Service Account.
in: path
name: clientId
required: true
schema:
example: mdb_sa_id_1234567890abcdef12345678
pattern: ^mdb_sa_id_[a-fA-F\d]{24}$
type: string
- description: One IP address or multiple IP addresses represented as one CIDR block. When specifying a CIDR block with a subnet mask, such as 192.0.2.0/24, use the URL-encoded value %2F for the forward slash /.
in: path
name: ipAddress
required: true
schema:
example: 192.0.2.0%2F24
pattern: ^([0-9]{1,3}\.){3}[0-9]{1,3}(%2[fF][0-9]{1,3})?|([0-9a-f]{1,4}\:){7}[0-9a-f]{1,4}(%2[fF][0-9]{1,3})?|([0-9a-f]{1,4}\:){1,6}\:(%2[fF][0-9]{1,3})?$
type: string
responses:
'204':
content:
application/vnd.atlas.2024-08-05+json:
x-xgen-version: '2024-08-05'
description: This endpoint does not return a response body.
headers:
RateLimit-Limit:
$ref: '#/components/headers/HeaderRateLimitLimit'
RateLimit-Remaining:
$ref: '#/components/headers/HeaderRateLimitRemaining'
'400':
$ref: '#/components/responses/badRequest'
'401':
$ref: '#/components/responses/unauthorized'
'403':
$ref: '#/components/responses/forbidden'
'404':
$ref: '#/components/responses/notFound'
'429':
$ref: '#/components/responses/tooManyRequests'
'500':
$ref: '#/components/responses/internalServerError'
summary: Remove One Access List Entry from One Project Service Account
tags:
- Service Accounts
x-codeSamples:
- lang: cURL
label: Atlas CLI
source: atlas api serviceAccounts deleteGroupAccessEntry --help
- lang: go
label: Go
source: "import (\n\t\"os\"\n\t\"context\"\n\t\"log\"\n\tsdk \"go.mongodb.org/atlas-sdk/v20250312001/admin\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\tclientID := os.Getenv(\"MONGODB_ATLAS_CLIENT_ID\")\n\tclientSecret := os.Getenv(\"MONGODB_ATLAS_CLIENT_SECRET\")\n\n\t// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth\n\tclient, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))\n\n\tif err != nil {\n\t\tlog.Fatalf(\"Error: %v\", err)\n\t}\n\n\tparams = &sdk.DeleteGroupServiceAccountAccessListEntryApiParams{}\n\thttpResp, err := client.ServiceAccountsApi.\n\t\tDeleteGroupServiceAccountAccessListEntryWithParams(ctx, params).\n\t\tExecute()\n}\n"
- lang: cURL
label: curl (Service Accounts)
source: "curl --include --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n -X DELETE \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/serviceAccounts/{clientId}/accessList/{ipAddress}\""
- lang: cURL
label: curl (Digest)
source: "curl --user \"${PUBLIC_KEY}:${PRIVATE_KEY}\" \\\n --digest --include \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n -X DELETE \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/serviceAccounts/{clientId}/accessList/{ipAddress}\""
x-rolesRequirements:
- Project Access Manager
x-xgen-docs-url: https://mongodb.com/docs/atlas/reference/api-resources-spec/v2/#tag/Service-Accounts/operation/deleteGroupServiceAccountAccessListEntry
x-xgen-method-verb-override:
customMethod: false
verb: deleteEntry
x-xgen-operation-id-override: deleteGroupAccessEntry
/api/atlas/v2/groups/{groupId}/serviceAccounts/{clientId}/secrets:
post:
description: Create a secret for the specified Service Account in the specified Project.
operationId: createGroupServiceAccountSecret
parameters:
- $ref: '#/components/parameters/groupId'
- description: The Client ID of the Service Account.
in: path
name: clientId
required: true
schema:
example: mdb_sa_id_1234567890abcdef12345678
pattern: ^mdb_sa_id_[a-fA-F\d]{24}$
type: string
- $ref: '#/components/parameters/envelope'
- $ref: '#/components/parameters/pretty'
requestBody:
content:
application/vnd.atlas.2024-08-05+json:
schema:
$ref: '#/components/schemas/ServiceAccountSecretRequest'
description: Details for the new secret.
required: true
responses:
'201':
content:
application/vnd.atlas.2024-08-05+json:
schema:
$ref
# --- truncated at 32 KB (105 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/mongodb/refs/heads/main/openapi/mongodb-service-accounts-api-openapi.yml