NVIDIA Run:ai Service Accounts API

openapi: 3.0.3
info:
  version: latest
  description: '# Introduction


    The NVIDIA Run:ai Control-Plane API reference is a guide that provides an easy-to-use programming interface for adding various tasks to your application, including workload submission, resource management, and administrative operations.


    NVIDIA Run:ai APIs are accessed using *bearer tokens*. To obtain a token, you need to create a **Service account** through the NVIDIA Run:ai user interface.

    To create a service account, in your UI, go to Access → Service Accounts (for organization-level service accounts) or User settings → Access Keys (for user access keys), and create a new one.


    After you have created a new service account, you will need to assign it access rules.

    To assign access rules to the service account, see [Create access rules](https://run-ai-docs.nvidia.com/saas/infrastructure-setup/authentication/accessrules#create-or-delete-rules).

    Make sure you assign the correct rules to your service account. Use the [Roles](https://run-ai-docs.nvidia.com/saas/infrastructure-setup/authentication/roles) to assign the correct access rules.


    To get your access token, follow the instructions in [Request a token](https://run-ai-docs.nvidia.com/saas/reference/api/rest-auth/#request-an-api-token).

    '
  title: NVIDIA Run:ai Access Keys Service Accounts API
  x-logo:
    url: https://api.redocly.com/registry/raw/runai-xq8/saas/latest/public/runai-logo-api.png
    altText: NVIDIA Run:ai
    href: https://run.ai
  license:
    name: NVIDIA Run:ai
    url: https://www.nvidia.com/en-us/agreements/enterprise-software/nvidia-software-license-agreement/
servers:
- url: https://app.run.ai
security:
- bearerAuth: []
tags:
- name: Service Accounts
  description: "Service accounts enable programmatic access to the NVIDIA Run:ai API, allowing applications or automated systems to authenticate and interact securely. \nEach service account is associated with an access key which includes a client ID and secret used to generate access token. \nService accounts can be managed organization-wide or with a defined scope.\n"
paths:
  /api/v1/service-accounts:
    get:
      summary: Get a list of service accounts.
      description: Retrieve a list of service accounts.
      operationId: get_service_accounts
      tags:
      - Service Accounts
      responses:
        '200':
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceAccounts'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
    post:
      summary: Create a service account.
      description: Used to create a service account.
      operationId: create_service_account
      tags:
      - Service Accounts
      requestBody:
        description: Service account object to create
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ServiceAccountCreationRequest'
      responses:
        '201':
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceAccountPostResponse'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '409':
          $ref: '#/components/responses/409Conflict'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/service-accounts/{serviceAccountId}:
    get:
      summary: Get service account by id.
      description: Retrieve the details of a service account by id.
      operationId: get_service_account_by_id
      tags:
      - Service Accounts
      parameters:
      - $ref: '#/components/parameters/serviceAccountId'
      responses:
        '200':
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceAccount'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
    patch:
      summary: Update service account details by id.
      description: Use to update the details of a service account by id.
      operationId: update_service_account_by_id
      tags:
      - Service Accounts
      parameters:
      - $ref: '#/components/parameters/serviceAccountId'
      requestBody:
        description: Service account object that needs to be updated.
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ServiceAccountPatchRequest'
      responses:
        '200':
          description: Executed successfully.
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
    delete:
      summary: Delete a service account by id.
      description: Use to delete a service account by id.
      operationId: delete_service_account_by_id
      tags:
      - Service Accounts
      parameters:
      - $ref: '#/components/parameters/serviceAccountId'
      responses:
        '204':
          description: Executed successfully.
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/service-accounts/{serviceAccountId}/secret:
    post:
      summary: Regenerate a service account secret.
      description: Use to regenerate the service account secret by id.
      operationId: regenerate_service_account_secret
      tags:
      - Service Accounts
      parameters:
      - $ref: '#/components/parameters/serviceAccountId'
      responses:
        '200':
          description: Regenerated successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RegenerateServiceAccountSecretResponse'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
components:
  responses:
    409Conflict:
      description: The specified resource already exists
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            code: 409
            message: Resource with this name already exists
    401Unauthorized:
      description: Unauthorized
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            code: 401
            message: Issuer is not familiar.
    404NotFound:
      description: The specified resource was not found
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            code: 404
            message: Resource id not found.
    500InternalServerError:
      description: unexpected error
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            code: 500
            message: Something went wrong.
    400BadRequest:
      description: Bad request.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            code: 400
            message: Required parameter is missing
    503ServiceUnavailable:
      description: unexpected error
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            code: 503
            message: Please try again in few minutes.
    403Forbidden:
      description: Forbidden
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            code: 403
            message: You do not have sufficient permissions.
  schemas:
    RegenerateServiceAccountSecretResponse:
      type: object
      properties:
        clientSecret:
          type: string
          description: Secret credential paired with the client ID. Used to obtain authentication tokens. Displayed only once upon regeneration.
      example:
        clientSecret: 189ej2ijd92fj092k049fk0
    ServiceAccount:
      type: object
      required:
      - name
      - createdBy
      - createdAt
      - updatedAt
      - enabled
      - lastLogin
      - id
      - clientId
      properties:
        name:
          type: string
          description: The name of the service account.
        createdBy:
          type: string
          description: The email address of the user who created the service account.
        createdAt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp for when the service account was created.
        updatedAt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp for when the service account was last updated.
        enabled:
          type: boolean
          description: Indicates whether the service account is enabled.
        tenantId:
          type: string
          description: The unique identifier of the tenant.
        lastLogin:
          type: string
          format: date-time
          nullable: true
          description: The timestamp of the last time the service account was used to authenticate.
        id:
          type: string
          description: The unique identifier of the service account.
        clientId:
          type: string
          description: The client identifier associated with the service account. Used when requesting authentication tokens.
      example:
        name: service-account-123
        createdBy: test@run.ai
        createdAt: '2020-01-01T00:00:00Z'
        updatedAt: '2020-01-01T00:00:00Z'
        enabled: true
        tenantId: 1234567890
        lastLogin: '2020-01-01T00:00:00Z'
        id: 3434c-12323ab-4ce2ea6-b44fc-db344d
        clientId: service-account-123
    ServiceAccounts:
      type: array
      items:
        $ref: '#/components/schemas/ServiceAccount'
    ServiceAccountPostResponse:
      type: object
      required:
      - id
      - name
      - clientSecret
      properties:
        id:
          type: string
          description: The unique identifier of the service account.
        name:
          type: string
          description: The name of the service account.
        clientSecret:
          type: string
          description: Secret credential paired with the client ID. Used to obtain authentication tokens. Displayed only once upon creation.
        clientId:
          type: string
          description: The client identifier associated with the service account. Used when requesting authentication tokens.
      example:
        id: 0eeaf222-e503-4f35-9d9c-c419816272e3
        name: service-account-123
        clientSecret: asdasidjn9d
        clientId: service-account-123
    Error:
      required:
      - code
      - message
      properties:
        code:
          type: integer
          minimum: 100
          maximum: 599
        message:
          type: string
        details:
          type: string
      example:
        code: 400
        message: Bad request - Resource should have a name
    ServiceAccountCreationRequest:
      type: object
      required:
      - name
      properties:
        name:
          type: string
          pattern: ^[a-z][-_a-z0-9]*[a-z0-9]$
          description: The name of the service account. The name must be unique within the organization and can only contain lowercase alphanumeric characters and hyphens. It must start and end with a letter.
      example:
        name: service-account-123
    ServiceAccountPatchRequest:
      type: object
      required:
      - enabled
      properties:
        enabled:
          type: boolean
          description: Indicates whether the service account is enabled.
      example:
        enabled: true
  parameters:
    serviceAccountId:
      name: serviceAccountId
      in: path
      required: true
      description: Service account id
      schema:
        type: string
        example: 6d2894ba-f998-4039-bba1-caba57caf681
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: Bearer authentication
x-tagGroups:
- name: Organizations
  tags:
  - Clusters
  - Departments
  - Reports
  - NodePools
  - Nodes
  - Projects
  - Tenant
  - Logo
  - Researcher Command Line Interface
  - Researcher Command Line Interface Deprecated
  - Administrator Command Line Interface
  - Network Topologies
- name: Authentication and Authorization
  tags:
  - Access Keys
  - Access rules
  - Permissions
  - Applications
  - Service Accounts
  - Roles
  - Tokens
  - Users
  - User Applications
  - Idps
  - Me
  - Settings
  - Org unit
- name: Audit
  tags:
  - AuditLogs
- name: Datavolumes
  tags:
  - Datavolumes
- name: Workloads
  tags:
  - Events
  - Pods
  - Workloads
  - Workloads V2
  - NVIDIA NIM
  - Workspaces
  - Trainings
  - Inferences
  - Revisions
  - Distributed
  - Workloads batch
  - Workload properties
  - Workload templates
  - Distributed Inferences
- name: Workload assets
  tags:
  - Compute
  - Credentials
  - Datasources
  - Environment
  - Storage Classes
  - Storage Class Configuration
  - Git
  - HostPath
  - NFS
  - PVC
  - Registry
  - S3
  - ConfigMap
  - Secret
  - Template
- name: Policies
  tags:
  - Policy
- name: Notifications
  tags:
  - Notification State
  - Notification Types
  - NotificationChannels
  - Subscriptions
- name: AI Applications
  tags:
  - AI Applications