Observe

Observe Service Accounts API

Manage service accounts and api tokens. Learn more about service accounts.

GitHub OpenAPI

Operations 10

POST /v1/service-accounts/{accountId}/api-tokens Create an API token #
GET /v1/service-accounts/{accountId}/api-tokens Get a list of API tokens for this service account #
POST /v1/service-accounts Create a service account #
GET /v1/service-accounts Get a list of service accounts #
DELETE /v1/service-accounts/{accountId}/api-tokens/{tokenId} Delete an API token #
GET /v1/service-accounts/{accountId}/api-tokens/{tokenId} Get an API token #
PATCH /v1/service-accounts/{accountId}/api-tokens/{tokenId} Update an API token #
DELETE /v1/service-accounts/{accountId} Delete a service account #
GET /v1/service-accounts/{accountId} Get a service account #
PATCH /v1/service-accounts/{accountId} Update a service account #

Documentation

📖
Documentation
https://docs.observeinc.com/reference/how-you-can-interact-with-the-observe-api
📖
Authentication
https://docs.observeinc.com/reference/observe-api-authentication
📖
RateLimits
https://docs.observeinc.com/reference/observe-api-rate-limits

Specifications

⚙
OpenAPI
https://artifacts.apis.io/observeinc/openapi/observeinc-service-accounts-api-openapi.yml

Schemas & Data

📊
JSONSchema
https://artifacts.apis.io/observeinc/json-schema/observeinc-monitor-resource-schema.json
📊
JSONSchema
https://artifacts.apis.io/observeinc/json-schema/observeinc-dataset-resource-schema.json
📊
JSONSchema
https://artifacts.apis.io/observeinc/json-schema/observeinc-alert-resource-schema.json
📊
JSONSchema
https://artifacts.apis.io/observeinc/json-schema/observeinc-ingest-routes-resource-schema.json
📊
JSONSchema
https://artifacts.apis.io/observeinc/json-schema/observeinc-dataset-query-filter-resource-schema.json
📊
JSONSchema
https://artifacts.apis.io/observeinc/json-schema/observeinc-ingest-filters-resource-schema.json

Other Resources

🔗
ChangeLog
https://docs.observeinc.com/reference/api-changelog

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/observeinc:observeinc-service-accounts-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

observeinc-service-accounts-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Observeinc Service Accounts API
  version: 1.0.230307
  x-assembled-from:
  - https://docs.observeinc.com/reference/createapitoken.md
  - https://docs.observeinc.com/reference/createdashboard.md
  - https://docs.observeinc.com/reference/createdatasetqueryfilter.md
  - https://docs.observeinc.com/reference/createingestfilter.md
  - https://docs.observeinc.com/reference/createingestroute.md
  - https://docs.observeinc.com/reference/createingesttoken.md
  - https://docs.observeinc.com/reference/createmonitor.md
  - https://docs.observeinc.com/reference/createmonitormute.md
  - https://docs.observeinc.com/reference/createmonitormuterule.md
  - https://docs.observeinc.com/reference/createreferencetable.md
  - https://docs.observeinc.com/reference/createserviceaccount.md
  - https://docs.observeinc.com/reference/createskill.md
  - https://docs.observeinc.com/reference/deleteapitoken.md
  - https://docs.observeinc.com/reference/deletedashboard.md
  - https://docs.observeinc.com/reference/deletedatasetqueryfilter.md
  - https://docs.observeinc.com/reference/deleteingestfilter.md
  - https://docs.observeinc.com/reference/deleteingestroute.md
  - https://docs.observeinc.com/reference/deleteingesttoken.md
  - https://docs.observeinc.com/reference/deletemonitor.md
  - https://docs.observeinc.com/reference/deletemonitormute.md
  - https://docs.observeinc.com/reference/deletemonitormuterule.md
  - https://docs.observeinc.com/reference/deletereferencetable.md
  - https://docs.observeinc.com/reference/deleteserviceaccount.md
  - https://docs.observeinc.com/reference/deleteskill.md
  - https://docs.observeinc.com/reference/exportquery.md
  - https://docs.observeinc.com/reference/exportquerypage.md
  - https://docs.observeinc.com/reference/exportworksheet.md
  - https://docs.observeinc.com/reference/generateapitoken.md
  - https://docs.observeinc.com/reference/getalert.md
  - https://docs.observeinc.com/reference/getapitoken.md
  - https://docs.observeinc.com/reference/getapminvocationgraph.md
  - https://docs.observeinc.com/reference/getdashboard.md
  - https://docs.observeinc.com/reference/getdataset.md
  - https://docs.observeinc.com/reference/getdatasetbyid.md
  - https://docs.observeinc.com/reference/getdatasetgraph.md
  - https://docs.observeinc.com/reference/getdatasetqueryfilterbyid.md
  - https://docs.observeinc.com/reference/getdatasetstats.md
  - https://docs.observeinc.com/reference/getingestfilter.md
  - https://docs.observeinc.com/reference/getingestroute.md
  - https://docs.observeinc.com/reference/getingesttoken.md
  - https://docs.observeinc.com/reference/getmonitor-1.md
  - https://docs.observeinc.com/reference/getmonitormute.md
  - https://docs.observeinc.com/reference/getmonitormuterule.md
  - https://docs.observeinc.com/reference/getmonitorstats.md
  - https://docs.observeinc.com/reference/getreferencetable.md
  - https://docs.observeinc.com/reference/getserviceaccount.md
  - https://docs.observeinc.com/reference/getskill.md
  - https://docs.observeinc.com/reference/listalerts.md
  - https://docs.observeinc.com/reference/listapitokens.md
  - https://docs.observeinc.com/reference/listapmenvironments.md
  - https://docs.observeinc.com/reference/listapmservices.md
  - https://docs.observeinc.com/reference/listdashboards.md
  - https://docs.observeinc.com/reference/listdatasetgraph.md
  - https://docs.observeinc.com/reference/listdatasetqueryfilters.md
  - https://docs.observeinc.com/reference/listdatasets-1.md
  - https://docs.observeinc.com/reference/listdatasets.md
  - https://docs.observeinc.com/reference/listdatasettags.md
  - https://docs.observeinc.com/reference/listfilterabledatasets.md
  - https://docs.observeinc.com/reference/listingestfilters.md
  - https://docs.observeinc.com/reference/listingestroutes.md
  - https://docs.observeinc.com/reference/listingesttokens.md
  - https://docs.observeinc.com/reference/listmetrics.md
  - https://docs.observeinc.com/reference/listmonitormuterules.md
  - https://docs.observeinc.com/reference/listmonitormutes.md
  - https://docs.observeinc.com/reference/listmonitors-1.md
  - https://docs.observeinc.com/reference/listserviceaccounts.md
  - https://docs.observeinc.com/reference/listskills.md
  - https://docs.observeinc.com/reference/polldelegatedlogin.md
  - https://docs.observeinc.com/reference/queryreferencetables.md
  - https://docs.observeinc.com/reference/searchdocumentation.md
  - https://docs.observeinc.com/reference/searchobjecttagkeys.md
  - https://docs.observeinc.com/reference/searchobjecttagvalues.md
  - https://docs.observeinc.com/reference/searchtagvalues.md
  - https://docs.observeinc.com/reference/startdelegatedlogin.md
  - https://docs.observeinc.com/reference/updateapitoken.md
  - https://docs.observeinc.com/reference/updatedashboard.md
  - https://docs.observeinc.com/reference/updatedatasetqueryfilter.md
  - https://docs.observeinc.com/reference/updateingestfilter.md
  - https://docs.observeinc.com/reference/updateingestroute.md
  - https://docs.observeinc.com/reference/updateingestroutepriorities.md
  - https://docs.observeinc.com/reference/updateingesttoken.md
  - https://docs.observeinc.com/reference/updatemonitor.md
  - https://docs.observeinc.com/reference/updatemonitormute.md
  - https://docs.observeinc.com/reference/updatereferencetable.md
  - https://docs.observeinc.com/reference/updatereferencetablemetadata.md
  - https://docs.observeinc.com/reference/updateserviceaccount.md
  - https://docs.observeinc.com/reference/updateskill.md
  - https://docs.observeinc.com/reference/validateingestfilterexpression.md
  x-retrieved: '2026-10-13'
  x-source: Assembled verbatim from the OpenAPI 3.1 definitions ReadMe embeds in each of 88 operation pages under https://docs.observeinc.com/reference/ (no single downloadable spec is published); paths and components merged, nothing authored.
  description: 'Operations tagged ServiceAccounts across 2 of this provider''s published API definitions: observeinc-openapi-assembled.json, observeinc-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://{customerid}.observeinc.com
  description: US west server
  variables:
    customerid:
      default: OBSERVE_CUSTOMERID
      description: The customer ID for your instance.
- url: https://{customerid}.{cluster}.observeinc.com
  description: Specific regional cluster (prod)
  variables:
    customerid:
      default: OBSERVE_CUSTOMERID
      description: The customer ID for your instance.
    cluster:
      enum:
      - eu-1
      - ap-1
      default: eu-1
      description: For regional clusters, choose one.
- url: https://{customerid}.{domain}.com
  description: Specific Observe server
  variables:
    customerid:
      default: OBSERVE_CUSTOMERID
      description: The customer ID for your instance.
    domain:
      default: OBSERVE_DOMAIN
      description: The Observe domain for your instance.
security:
- bearerAuth: []
tags:
- name: Service Accounts
  x-displayName: Service Account
  description: Manage service accounts and api tokens. Learn more about service accounts.
paths:
  /v1/service-accounts/{accountId}/api-tokens:
    post:
      summary: Create an API token
      operationId: CreateApiToken
      tags:
      - Service Accounts
      parameters:
      - in: path
        name: accountId
        schema:
          type: string
          format: int64
        required: true
        description: The id of the service account associated with the API token
        example: 1
      - $ref: '#/components/parameters/ExpandParam'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApiToken-CreateRequest'
      responses:
        '201':
          description: API token created successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiToken-Resource'
        '400':
          $ref: '#/components/responses/ErrorResponse-400'
        '401':
          $ref: '#/components/responses/ErrorResponse-401'
        '403':
          $ref: '#/components/responses/ErrorResponse-403'
        '429':
          $ref: '#/components/responses/ErrorResponse-429'
        5XX:
          $ref: '#/components/responses/ErrorResponse-5XX'
    get:
      summary: Get a list of API tokens for this service account
      description: Get a list of all API tokens for this service account
      operationId: ListApiTokens
      tags:
      - Service Accounts
      parameters:
      - in: path
        name: accountId
        schema:
          type: string
          format: int64
        required: true
        description: The id of the service account associated with the API token
        example: 1
      - $ref: '#/components/parameters/ExpandParam'
      responses:
        '200':
          description: API tokens queried successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiToken-ListResponse'
        '400':
          $ref: '#/components/responses/ErrorResponse-400'
        '401':
          $ref: '#/components/responses/ErrorResponse-401'
        '403':
          $ref: '#/components/responses/ErrorResponse-403'
        '429':
          $ref: '#/components/responses/ErrorResponse-429'
        5XX:
          $ref: '#/components/responses/ErrorResponse-5XX'
    servers:
    - url: https://{customerid}.observeinc.com
      description: US west server
      variables:
        customerid:
          default: OBSERVE_CUSTOMERID
          description: The customer ID for your instance.
    - url: https://{customerid}.{cluster}.observeinc.com
      description: Specific regional cluster (prod)
      variables:
        customerid:
          default: OBSERVE_CUSTOMERID
          description: The customer ID for your instance.
        cluster:
          enum:
          - eu-1
          - ap-1
          default: eu-1
          description: For regional clusters, choose one.
    - url: https://{customerid}.{domain}.com
      description: Specific Observe server
      variables:
        customerid:
          default: OBSERVE_CUSTOMERID
          description: The customer ID for your instance.
        domain:
          default: OBSERVE_DOMAIN
          description: The Observe domain for your instance.
  /v1/service-accounts:
    post:
      summary: Create a service account
      operationId: CreateServiceAccount
      tags:
      - Service Accounts
      parameters:
      - $ref: '#/components/parameters/ExpandParam'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ServiceAccount-CreateRequest'
      responses:
        '201':
          description: Service account created successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceAccount-Resource'
        '400':
          $ref: '#/components/responses/ErrorResponse-400'
        '401':
          $ref: '#/components/responses/ErrorResponse-401'
        '403':
          $ref: '#/components/responses/ErrorResponse-403'
        '429':
          $ref: '#/components/responses/ErrorResponse-429'
        5XX:
          $ref: '#/components/responses/ErrorResponse-5XX'
    get:
      summary: Get a list of service accounts
      description: Get a list of all service accounts
      operationId: ListServiceAccounts
      tags:
      - Service Accounts
      parameters:
      - $ref: '#/components/parameters/ExpandParam'
      responses:
        '200':
          description: Service account queried successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceAccount-ListResponse'
        '400':
          $ref: '#/components/responses/ErrorResponse-400'
        '401':
          $ref: '#/components/responses/ErrorResponse-401'
        '403':
          $ref: '#/components/responses/ErrorResponse-403'
        '429':
          $ref: '#/components/responses/ErrorResponse-429'
        5XX:
          $ref: '#/components/responses/ErrorResponse-5XX'
    servers:
    - url: https://{customerid}.observeinc.com
      description: US west server
      variables:
        customerid:
          default: OBSERVE_CUSTOMERID
          description: The customer ID for your instance.
    - url: https://{customerid}.{cluster}.observeinc.com
      description: Specific regional cluster (prod)
      variables:
        customerid:
          default: OBSERVE_CUSTOMERID
          description: The customer ID for your instance.
        cluster:
          enum:
          - eu-1
          - ap-1
          default: eu-1
          description: For regional clusters, choose one.
    - url: https://{customerid}.{domain}.com
      description: Specific Observe server
      variables:
        customerid:
          default: OBSERVE_CUSTOMERID
          description: The customer ID for your instance.
        domain:
          default: OBSERVE_DOMAIN
          description: The Observe domain for your instance.
  /v1/service-accounts/{accountId}/api-tokens/{tokenId}:
    delete:
      summary: Delete an API token
      operationId: DeleteApiToken
      tags:
      - Service Accounts
      parameters:
      - in: path
        name: accountId
        schema:
          type: string
          format: int64
        required: true
        description: The id of the service account associated with the API token
        example: 1
      - in: path
        name: tokenId
        schema:
          type: string
        required: true
        description: The id of the API token to update
        example: 1
      responses:
        '200':
          description: API token deleted successfully
        '400':
          $ref: '#/components/responses/ErrorResponse-400'
        '401':
          $ref: '#/components/responses/ErrorResponse-401'
        '403':
          $ref: '#/components/responses/ErrorResponse-403'
        '429':
          $ref: '#/components/responses/ErrorResponse-429'
        5XX:
          $ref: '#/components/responses/ErrorResponse-5XX'
    get:
      summary: Get an API token
      description: Retrieve a specific API token by ID
      operationId: GetApiToken
      tags:
      - Service Accounts
      parameters:
      - in: path
        name: accountId
        schema:
          type: string
          format: int64
        required: true
        description: The id of the service account associated with the API token
        example: 1
      - in: path
        name: tokenId
        schema:
          type: string
        required: true
        description: The id of the API token to update
        example: 1
      - $ref: '#/components/parameters/ExpandParam'
      responses:
        '200':
          description: API token queried successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiToken-Resource'
        '400':
          $ref: '#/components/responses/ErrorResponse-400'
        '401':
          $ref: '#/components/responses/ErrorResponse-401'
        '403':
          $ref: '#/components/responses/ErrorResponse-403'
        '404':
          $ref: '#/components/responses/ErrorResponse-404'
        '429':
          $ref: '#/components/responses/ErrorResponse-429'
        5XX:
          $ref: '#/components/responses/ErrorResponse-5XX'
    patch:
      summary: Update an API token
      operationId: UpdateApiToken
      tags:
      - Service Accounts
      parameters:
      - in: path
        name: accountId
        schema:
          type: string
          format: int64
        required: true
        description: The id of the service account associated with the API token
        example: 1
      - in: path
        name: tokenId
        schema:
          type: string
        required: true
        description: The id of the API token to update
        example: 1
      - $ref: '#/components/parameters/ExpandParam'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApiToken-UpdateRequest'
      responses:
        '200':
          description: API token updated successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiToken-Resource'
        '400':
          $ref: '#/components/responses/ErrorResponse-400'
        '401':
          $ref: '#/components/responses/ErrorResponse-401'
        '403':
          $ref: '#/components/responses/ErrorResponse-403'
        '404':
          $ref: '#/components/responses/ErrorResponse-404'
        '429':
          $ref: '#/components/responses/ErrorResponse-429'
        5XX:
          $ref: '#/components/responses/ErrorResponse-5XX'
    servers:
    - url: https://{customerid}.observeinc.com
      description: US west server
      variables:
        customerid:
          default: OBSERVE_CUSTOMERID
          description: The customer ID for your instance.
    - url: https://{customerid}.{cluster}.observeinc.com
      description: Specific regional cluster (prod)
      variables:
        customerid:
          default: OBSERVE_CUSTOMERID
          description: The customer ID for your instance.
        cluster:
          enum:
          - eu-1
          - ap-1
          default: eu-1
          description: For regional clusters, choose one.
    - url: https://{customerid}.{domain}.com
      description: Specific Observe server
      variables:
        customerid:
          default: OBSERVE_CUSTOMERID
          description: The customer ID for your instance.
        domain:
          default: OBSERVE_DOMAIN
          description: The Observe domain for your instance.
  /v1/service-accounts/{accountId}:
    delete:
      summary: Delete a service account
      operationId: DeleteServiceAccount
      tags:
      - Service Accounts
      parameters:
      - in: path
        name: accountId
        schema:
          type: string
          format: int64
        required: true
        description: The id of the service account to delete
        example: 1
      responses:
        '200':
          description: Service account deleted successfully
        '400':
          $ref: '#/components/responses/ErrorResponse-400'
        '401':
          $ref: '#/components/responses/ErrorResponse-401'
        '403':
          $ref: '#/components/responses/ErrorResponse-403'
        '429':
          $ref: '#/components/responses/ErrorResponse-429'
        5XX:
          $ref: '#/components/responses/ErrorResponse-5XX'
    get:
      summary: Get a service account
      description: Retrieve a specific service account by ID
      operationId: GetServiceAccount
      tags:
      - Service Accounts
      parameters:
      - in: path
        name: accountId
        schema:
          type: string
          format: int64
        required: true
        description: The id of the service account
        example: 1
      - $ref: '#/components/parameters/ExpandParam'
      responses:
        '200':
          description: Service account queried successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceAccount-Resource'
        '400':
          $ref: '#/components/responses/ErrorResponse-400'
        '401':
          $ref: '#/components/responses/ErrorResponse-401'
        '403':
          $ref: '#/components/responses/ErrorResponse-403'
        '404':
          $ref: '#/components/responses/ErrorResponse-404'
        '429':
          $ref: '#/components/responses/ErrorResponse-429'
        5XX:
          $ref: '#/components/responses/ErrorResponse-5XX'
    patch:
      summary: Update a service account
      operationId: UpdateServiceAccount
      tags:
      - Service Accounts
      parameters:
      - in: path
        name: accountId
        schema:
          type: string
          format: int64
        required: true
        description: The id of the service account to update
        example: 1
      - $ref: '#/components/parameters/ExpandParam'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ServiceAccount-UpdateRequest'
      responses:
        '200':
          description: Service account updated successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceAccount-Resource'
        '400':
          $ref: '#/components/responses/ErrorResponse-400'
        '401':
          $ref: '#/components/responses/ErrorResponse-401'
        '403':
          $ref: '#/components/responses/ErrorResponse-403'
        '404':
          $ref: '#/components/responses/ErrorResponse-404'
        '429':
          $ref: '#/components/responses/ErrorResponse-429'
        5XX:
          $ref: '#/components/responses/ErrorResponse-5XX'
    servers:
    - url: https://{customerid}.observeinc.com
      description: US west server
      variables:
        customerid:
          default: OBSERVE_CUSTOMERID
          description: The customer ID for your instance.
    - url: https://{customerid}.{cluster}.observeinc.com
      description: Specific regional cluster (prod)
      variables:
        customerid:
          default: OBSERVE_CUSTOMERID
          description: The customer ID for your instance.
        cluster:
          enum:
          - eu-1
          - ap-1
          default: eu-1
          description: For regional clusters, choose one.
    - url: https://{customerid}.{domain}.com
      description: Specific Observe server
      variables:
        customerid:
          default: OBSERVE_CUSTOMERID
          description: The customer ID for your instance.
        domain:
          default: OBSERVE_DOMAIN
          description: The Observe domain for your instance.
components:
  parameters:
    ExpandParam:
      name: expand
      in: query
      description: Whether to expand resources referenced in the response to include additional fields
      schema:
        type: boolean
  schemas:
    Meta:
      description: List Response Metadata
      type: object
      required:
      - totalCount
      properties:
        totalCount:
          description: 'The total number of resources available, independent of pagination.

            The API may return -1 if the total count is unknown or cannot be computed

            in reasonable time.

            '
          type: integer
          format: int64
    RbacGroupRef:
      title: RbacGroupRef
      description: Reference to an RBAC group, including id, label, and description.
      type: object
      required:
      - id
      - legacyId
      - label
      - description
      properties:
        id:
          $ref: '#/components/schemas/ObjectId'
        legacyId:
          type: string
          description: Deprecated. For compatibility with legacy APIs.
          deprecated: true
        label:
          type: string
        description:
          type: string
    ApiTokenScope:
      type: string
      enum:
      - api:read
      - api:write
      - unscoped
    ServiceAccount-UpdateRequest:
      title: ServiceAccountUpdateRequest
      type: object
      properties:
        label:
          type: string
        description:
          type: string
        disabled:
          type: boolean
          description: Whether the service account is disabled. Disabling a service account will delete all of its API tokens.
        externalOAuth:
          description: The external OAuth binding for this service account. Set to null to clear the binding.
          anyOf:
          - $ref: '#/components/schemas/ServiceAccount-ExternalOAuth'
          - type: 'null'
    ApiToken-UpdateRequest:
      title: ApiTokenUpdateRequest
      type: object
      properties:
        label:
          type: string
        description:
          type: string
        lifetimeHours:
          type: integer
          minimum: 1
        disabled:
          type: boolean
    ObjectId:
      type: string
      format: ObjectId
    Time:
      type: string
      format: RFC3339
    User:
      title: User
      type: object
      required:
      - id
      properties:
        id:
          title: User Identifier
          $ref: '#/components/schemas/ObjectId'
        label:
          title: User Label
          type: string
        timezone:
          type: string
        locale:
          type: string
    ApiToken-CreateRequest:
      title: ApiTokenCreateRequest
      type: object
      required:
      - label
      - lifetimeHours
      properties:
        label:
          type: string
        description:
          type: string
        lifetimeHours:
          type: integer
          minimum: 1
        scopes:
          type: array
          description: Optionally constrains the token's effective permissions. An empty/omitted list leaves the token unscoped. Unknown scopes are rejected.
          items:
            $ref: '#/components/schemas/ApiTokenScope'
    ApiToken-ListResponse:
      title: ApiTokenListResponse
      type: object
      required:
      - apiTokens
      - meta
      properties:
        apiTokens:
          type: array
          items:
            $ref: '#/components/schemas/ApiToken-Resource'
        meta:
          $ref: '#/components/schemas/Meta'
    OAuthExternalIntegrationRef:
      title: OAuthExternalIntegrationRef
      type: object
      required:
      - id
      properties:
        id:
          $ref: '#/components/schemas/ObjectId'
    ServiceAccount-CreateRequest:
      title: ServiceAccountCreateRequest
      type: object
      required:
      - label
      properties:
        label:
          type: string
        description:
          type: string
        externalOAuth:
          description: The external OAuth binding to create for this service account.
          $ref: '#/components/schemas/ServiceAccount-ExternalOAuth'
    ServiceAccount-ListResponse:
      title: ServiceAccountListResponse
      type: object
      required:
      - serviceAccounts
      - meta
      properties:
        serviceAccounts:
          type: array
          items:
            $ref: '#/components/schemas/ServiceAccount-Resource'
        meta:
          $ref: '#/components/schemas/Meta'
    ServiceAccount-Resource:
      title: ServiceAccountObject
      type: object
      required:
      - id
      - label
      - description
      - createdBy
      - createdAt
      - updatedBy
      - updatedAt
      - disabled
      - externalOAuth
      properties:
        id:
          $ref: '#/components/schemas/ObjectId'
        label:
          type: string
        description:
          type: string
        createdBy:
          $ref: '#/components/schemas/User'
        createdAt:
          $ref: '#/components/schemas/Time'
        updatedBy:
          $ref: '#/components/schemas/User'
        updatedAt:
          $ref: '#/components/schemas/Time'
        disabled:
          type: boolean
          description: Whether the service account is disabled. Disabling a service account will delete all of its API tokens.
        apiTokenCount:
          type: integer
          format: int64
          description: Number of API tokens for this service account. Includes recently expired and disabled tokens. Only populated when the expand query parameter is set to true.
        rbacGroups:
          type: array
          description: RBAC groups this service account belongs to. Only populated when the expand query parameter is set to true.
          items:
            $ref: '#/components/schemas/RbacGroupRef'
        externalOAuth:
          description: The external OAuth binding for this service account, or null if no binding exists.
          anyOf:
          - $ref: '#/components/schemas/ServiceAccount-ExternalOAuth'
          - type: 'null'
    ErrorMessage:
      type: object
      properties:
        type:
          type: string
          description: A stable, machine-readable identifier for the kind of error.
        message:
          type: string
          description: Error message
      required:
      - type
      - message
    ApiToken-Resource:
      title: ApiTokenObject
      type: object
      required:
      - id
      - label
      - description
      - expiration
      - createdBy
      - createdAt
      - updatedBy
      - updatedAt
      - disabled
      properties:
        id:
          type: string
        label:
          type: string
        description:
          type: string
        expiration:
          $ref: '#/components/schemas/Time'
        createdBy:
          $ref: '#/components/schemas/User'
        createdAt:
          $ref: '#/components/schemas/Time'
        updatedBy:
          $ref: '#/components/schemas/User'
        updatedAt:
          $ref: '#/components/schemas/Time'
        disabled:
          type: boolean
        scopes:
          type: array
          description: The token's effective scopes. An empty/omitted list means the token is unscoped.
          items:
            $ref: '#/components/schemas/ApiTokenScope'
        secret:
          type: string
          description: The secret for the API token. Only returned on create.
    ServiceAccount-ExternalOAuth:
      title: ServiceAccountExternalOAuth
      type: object
      required:
      - integration
      - subject
      properties:
        integration:
          $ref: '#/components/schemas/OAuthExternalIntegrationRef'
        subject:
          type: string
          description: The external identity subject (JWT sub/oid claim) this service account is bound to.
  responses:
    ErrorResponse-400:
      description: Bad request
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorMessage'
    ErrorResponse-404:
      description: Resource not found
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorMessage'
    ErrorResponse-403:
      description: Forbidden
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorMessage'
    ErrorResponse-5XX:
      description: Internal server error
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorMessage'
    ErrorResponse-429:
      description: Rate limit reached
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorMessage'
    ErrorResponse-401:
      description: Unauthorized
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorMessage'
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: 'Authorization: Bearer <customerid> <apitoken>

        '
x-refined-from:
- observeinc-openapi-assembled.json
- observeinc-openapi.yml