Tower Service Accounts API

openapi: 3.1.0
info:
  contact:
    email: hello@tower.dev
    name: Tower Computing GmbH
    url: https://tower.dev
  description: REST API to interact with Tower Services.
  termsOfService: https://tower.dev/terms
  title: Tower Accounts Service Accounts API
  version: v0.11.16
servers:
- url: https://api.tower.dev/v1
tags:
- name: Service Accounts
paths:
  /service-accounts:
    get:
      description: List all service accounts in the current account. Team admin only.
      operationId: list-service-accounts
      parameters:
      - description: The page number to fetch.
        explode: false
        in: query
        name: page
        schema:
          default: 1
          description: The page number to fetch.
          format: int64
          type: integer
      - description: The number of records to fetch on each page.
        explode: false
        in: query
        name: page_size
        schema:
          default: 20
          description: The number of records to fetch on each page.
          format: int64
          type: integer
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListServiceAccountsResponse'
          description: OK
        default:
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ErrorModel'
          description: Error
      security:
      - AccessTokenAuth:
        - service_accounts:read
      - APIKeyAuth:
        - service_accounts:read
      summary: List service accounts
      tags:
      - Service Accounts
    post:
      description: Create a new service account in the current account. Team admin only.
      operationId: create-service-account
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateServiceAccountParams'
        required: true
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateServiceAccountResponse'
          description: Created
        default:
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ErrorModel'
          description: Error
      security:
      - AccessTokenAuth:
        - service_accounts:create
      - APIKeyAuth:
        - service_accounts:create
      summary: Create service account
      tags:
      - Service Accounts
  /service-accounts/{idOrName}:
    delete:
      description: 'Tombstones a service account: revokes API keys, disables owned schedules, cancels in-flight runs, then soft-deletes the SA. Team admin only.'
      operationId: delete-service-account
      parameters:
      - description: The ID or name of the service account to delete.
        in: path
        name: idOrName
        required: true
        schema:
          description: The ID or name of the service account to delete.
          type: string
      responses:
        '204':
          description: No Content
        default:
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ErrorModel'
          description: Error
      security:
      - AccessTokenAuth:
        - service_accounts:delete
      - APIKeyAuth:
        - service_accounts:delete
      summary: Delete service account
      tags:
      - Service Accounts
    get:
      description: Fetch a single service account by ID or name. Team admin only.
      operationId: describe-service-account
      parameters:
      - description: The ID or name of the service account.
        in: path
        name: idOrName
        required: true
        schema:
          description: The ID or name of the service account.
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DescribeServiceAccountResponse'
          description: OK
        default:
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ErrorModel'
          description: Error
      security:
      - AccessTokenAuth:
        - service_accounts:read
      - APIKeyAuth:
        - service_accounts:read
      summary: Describe service account
      tags:
      - Service Accounts
    patch:
      description: Update one or more fields on an existing service account. Team admin only.
      operationId: update-service-account
      parameters:
      - description: The ID or name of the service account to update.
        in: path
        name: idOrName
        required: true
        schema:
          description: The ID or name of the service account to update.
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateServiceAccountParams'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UpdateServiceAccountResponse'
          description: OK
        default:
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ErrorModel'
          description: Error
      security:
      - AccessTokenAuth:
        - service_accounts:update
      - APIKeyAuth:
        - service_accounts:update
      summary: Update service account
      tags:
      - Service Accounts
  /service-accounts/{idOrName}/api-keys:
    delete:
      description: Revoke an API key bound to a service account. Team admin only.
      operationId: delete-service-account-api-key
      parameters:
      - description: The ID or name of the service account.
        in: path
        name: idOrName
        required: true
        schema:
          description: The ID or name of the service account.
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DeleteServiceAccountAPIKeyParams'
        required: true
      responses:
        '204':
          description: No Content
        default:
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ErrorModel'
          description: Error
      security:
      - AccessTokenAuth:
        - service_accounts:update
      - APIKeyAuth:
        - service_accounts:update
      summary: Delete API key for service account
      tags:
      - Service Accounts
    get:
      description: List API keys bound to a service account. Team admin only.
      operationId: list-service-account-api-keys
      parameters:
      - description: The ID or name of the service account.
        in: path
        name: idOrName
        required: true
        schema:
          description: The ID or name of the service account.
          type: string
      - description: The page number to fetch.
        explode: false
        in: query
        name: page
        schema:
          default: 1
          description: The page number to fetch.
          format: int64
          type: integer
      - description: The number of records to fetch on each page.
        explode: false
        in: query
        name: page_size
        schema:
          default: 20
          description: The number of records to fetch on each page.
          format: int64
          type: integer
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListServiceAccountAPIKeysResponse'
          description: OK
        default:
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ErrorModel'
          description: Error
      security:
      - AccessTokenAuth:
        - service_accounts:read
      - APIKeyAuth:
        - service_accounts:read
      summary: List API keys for service account
      tags:
      - Service Accounts
    post:
      description: Mint a new API key bound to a service account. The full identifier is only returned on this response. Team admin only.
      operationId: create-service-account-api-key
      parameters:
      - description: The ID or name of the service account this key authenticates as.
        in: path
        name: idOrName
        required: true
        schema:
          description: The ID or name of the service account this key authenticates as.
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateServiceAccountAPIKeyParams'
        required: true
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateServiceAccountAPIKeyResponse'
          description: Created
        default:
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ErrorModel'
          description: Error
      security:
      - AccessTokenAuth:
        - service_accounts:update
      - APIKeyAuth:
        - service_accounts:update
      summary: Create API key for service account
      tags:
      - Service Accounts
components:
  schemas:
    ErrorDetail:
      additionalProperties: false
      properties:
        location:
          description: Where the error occurred, e.g. 'body.items[3].tags' or 'path.thing-id'
          type: string
        message:
          description: Error message text
          type: string
        value:
          description: The value at the given location
      type: object
    UpdateServiceAccountParams:
      additionalProperties: false
      properties:
        $schema:
          description: A URL to the JSON Schema for this object.
          examples:
          - https://api.tower.dev/v1/schemas/UpdateServiceAccountParams.json
          format: uri
          readOnly: true
          type: string
        metadata:
          description: Replacement JSON metadata for the service account.
          type: string
        name:
          description: The new human-readable name for the service account.
          type: string
        role:
          description: The new team role this service account acts as.
          enum:
          - admin
          - developer
          type: string
      type: object
    ListServiceAccountAPIKeysResponse:
      additionalProperties: false
      properties:
        $schema:
          description: A URL to the JSON Schema for this object.
          examples:
          - https://api.tower.dev/v1/schemas/ListServiceAccountAPIKeysResponse.json
          format: uri
          readOnly: true
          type: string
        api_keys:
          items:
            $ref: '#/components/schemas/APIKey'
          type: array
        pages:
          $ref: '#/components/schemas/Pagination'
      required:
      - api_keys
      - pages
      type: object
    CreateServiceAccountResponse:
      additionalProperties: false
      properties:
        $schema:
          description: A URL to the JSON Schema for this object.
          examples:
          - https://api.tower.dev/v1/schemas/CreateServiceAccountResponse.json
          format: uri
          readOnly: true
          type: string
        service_account:
          $ref: '#/components/schemas/ServiceAccount'
      required:
      - service_account
      type: object
    APIKeyOwner:
      additionalProperties: false
      properties:
        name:
          description: 'The owner''s name: a user''s full name (or email) or a service account''s name.'
          readOnly: true
          type: string
        type:
          description: The kind of principal this API key authenticates as.
          enum:
          - user
          - service_account
          type: string
      required:
      - type
      - name
      type: object
    CreateServiceAccountAPIKeyResponse:
      additionalProperties: false
      properties:
        $schema:
          description: A URL to the JSON Schema for this object.
          examples:
          - https://api.tower.dev/v1/schemas/CreateServiceAccountAPIKeyResponse.json
          format: uri
          readOnly: true
          type: string
        api_key:
          $ref: '#/components/schemas/APIKey'
      required:
      - api_key
      type: object
    ErrorModel:
      additionalProperties: false
      properties:
        $schema:
          description: A URL to the JSON Schema for this object.
          examples:
          - https://api.tower.dev/v1/schemas/ErrorModel.json
          format: uri
          readOnly: true
          type: string
        detail:
          description: A human-readable explanation specific to this occurrence of the problem.
          examples:
          - Property foo is required but is missing.
          type: string
        errors:
          description: Optional list of individual error details
          items:
            $ref: '#/components/schemas/ErrorDetail'
          type: array
        instance:
          description: A URI reference that identifies the specific occurrence of the problem.
          examples:
          - https://example.com/error-log/abc123
          format: uri
          type: string
        status:
          description: HTTP status code
          examples:
          - 400
          format: int64
          type: integer
        title:
          description: A short, human-readable summary of the problem type. This value should not change between occurrences of the error.
          examples:
          - Bad Request
          type: string
        type:
          default: about:blank
          description: A URI reference to human-readable documentation for the error.
          examples:
          - https://example.com/errors/example
          format: uri
          type: string
      type: object
    ServiceAccount:
      additionalProperties: false
      properties:
        created_at:
          description: When the service account was created.
          format: date-time
          type: string
        creator:
          $ref: '#/components/schemas/ServiceAccountCreator'
          description: The user who created this service account.
        id:
          description: The unique identifier for the service account.
          type: string
        metadata:
          description: Customer-supplied JSON metadata associated with the service account.
        name:
          description: The human-readable name of the service account.
          type: string
        role:
          description: The team role this service account acts as.
          enum:
          - admin
          - developer
          type: string
        updated_at:
          description: When the service account was last updated.
          format: date-time
          type: string
      required:
      - id
      - name
      - role
      - created_at
      - updated_at
      type: object
    APIKey:
      additionalProperties: false
      properties:
        created_at:
          format: date-time
          type: string
        expires_at:
          format: date-time
          type: string
        identifier:
          type: string
        last_used_at:
          format: date-time
          type:
          - string
          - 'null'
        name:
          type: string
        owner:
          $ref: '#/components/schemas/APIKeyOwner'
          description: The principal this API key authenticates as. Omitted on legacy user-key responses that do not yet resolve the owner.
        scopes:
          type: string
      required:
      - name
      - identifier
      - last_used_at
      - created_at
      type: object
    ServiceAccountCreator:
      additionalProperties: false
      properties:
        name:
          description: 'The creator''s name: a user''s full name (or email) or a service account''s name.'
          readOnly: true
          type: string
        type:
          description: The kind of principal that created the service account. Always 'user'.
          enum:
          - user
          - service_account
          type: string
      required:
      - type
      - name
      type: object
    DeleteServiceAccountAPIKeyParams:
      additionalProperties: false
      properties:
        $schema:
          description: A URL to the JSON Schema for this object.
          examples:
          - https://api.tower.dev/v1/schemas/DeleteServiceAccountAPIKeyParams.json
          format: uri
          readOnly: true
          type: string
        identifier:
          description: The API key identifier (with or without the 'sk-' prefix).
          type: string
      required:
      - identifier
      type: object
    DescribeServiceAccountResponse:
      additionalProperties: false
      properties:
        $schema:
          description: A URL to the JSON Schema for this object.
          examples:
          - https://api.tower.dev/v1/schemas/DescribeServiceAccountResponse.json
          format: uri
          readOnly: true
          type: string
        service_account:
          $ref: '#/components/schemas/ServiceAccount'
      required:
      - service_account
      type: object
    Pagination:
      additionalProperties: false
      properties:
        num_pages:
          format: int64
          type: integer
        page:
          format: int64
          type: integer
        page_size:
          format: int64
          type: integer
        total:
          format: int64
          type: integer
      required:
      - page
      - total
      - num_pages
      - page_size
      type: object
    UpdateServiceAccountResponse:
      additionalProperties: false
      properties:
        $schema:
          description: A URL to the JSON Schema for this object.
          examples:
          - https://api.tower.dev/v1/schemas/UpdateServiceAccountResponse.json
          format: uri
          readOnly: true
          type: string
        service_account:
          $ref: '#/components/schemas/ServiceAccount'
      required:
      - service_account
      type: object
    ListServiceAccountsResponse:
      additionalProperties: false
      properties:
        $schema:
          description: A URL to the JSON Schema for this object.
          examples:
          - https://api.tower.dev/v1/schemas/ListServiceAccountsResponse.json
          format: uri
          readOnly: true
          type: string
        pages:
          $ref: '#/components/schemas/Pagination'
        service_accounts:
          items:
            $ref: '#/components/schemas/ServiceAccount'
          type: array
      required:
      - service_accounts
      - pages
      type: object
    CreateServiceAccountParams:
      additionalProperties: false
      properties:
        $schema:
          description: A URL to the JSON Schema for this object.
          examples:
          - https://api.tower.dev/v1/schemas/CreateServiceAccountParams.json
          format: uri
          readOnly: true
          type: string
        metadata:
          description: Optional, customer-supplied JSON metadata.
          type: string
        name:
          description: Human-readable name for the service account. Must be unique within the account.
          minLength: 1
          type: string
        role:
          description: The team role this service account acts as.
          enum:
          - admin
          - developer
          type: string
      required:
      - name
      - role
      type: object
    CreateServiceAccountAPIKeyParams:
      additionalProperties: false
      properties:
        $schema:
          description: A URL to the JSON Schema for this object.
          examples:
          - https://api.tower.dev/v1/schemas/CreateServiceAccountAPIKeyParams.json
          format: uri
          readOnly: true
          type: string
        expires_at:
          description: When the API key expires.
          format: date-time
          type: string
        name:
          description: Human-readable name for the API key.
          minLength: 1
          type: string
        scopes:
          description: Space-separated scopes for the key. Defaults to the SA's role scopes when omitted.
          type: string
      required:
      - name
      type: object
  securitySchemes:
    APIKeyAuth:
      description: API key created by a Tower user or Tower service account to authenticate an API request.
      in: header
      name: X-API-Key
      type: apiKey
    AccessTokenAuth:
      description: Access token authentication scheme which uses an access token provided by the Tower API as part of a Tower session (see documentation about creating sessions).
      scheme: Bearer
      type: http