--- title: Service Accounts url: https://platform.claude.com/docs/en/api/csharp/organization/service_accounts --- # Service Accounts ## Create Service Account `ServiceAccount Organization.ServiceAccounts.Create(parameters, cancellationToken = default)` **POST** `/v1/organizations/service_accounts` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=csharp). Create a service account. A service account is a named workload identity that federation rules target. `organization_role` is `developer` (default) or `admin`; a rule may only be created or retargeted to grant `org:admin` scope when the target's `organization_role` is `admin`. Creating an `admin`-role service account requires an interactive credential (a user OAuth token or a Console session) — a workload may only create `developer`-role service accounts. ### Parameters - `ServiceAccountCreateParams parameters` - `required string name` Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409. minLength: 1, maxLength: 255 - `string? description` Optional free-text description. maxLength: 2000 - `OrganizationRole organizationRole` Org-level role. Defaults to `developer`. - `Admin("admin")` - `Developer("developer")` ### Returns - `class ServiceAccount` Named non-human identity within the caller's organization. A service account is a pure identity: name + org. Authorization lives on whatever references it (federation rules). - `JsonElement Type = "service_account"` - `required string ID` Tagged ID of the service account. - `required DateTimeOffset? ArchivedAt` If set, this service account is archived. format: date-time - `required string? ArchivedByActorID` Tagged ID (`user_`/`svac_`) of the actor that archived this service account. - `required DateTimeOffset CreatedAt` When this service account was created. format: date-time - `required string? CreatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that created this service account. - `required string? Description` Optional free-text description. - `required string Name` Admin-chosen slug identifier. - `required OrganizationRole OrganizationRole` Org-level role. A federation rule may only be created or retargeted to grant `org:admin` scope when this is `admin`. A rule granting `org:admin` whose target is later demoted to `developer` is rejected at token exchange. Rules granting `org:admin` are managed in the Console. - `Admin("admin")` - `Developer("developer")` - `required DateTimeOffset UpdatedAt` When this service account was last updated. format: date-time - `required string? UpdatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that last updated this service account. ### Example ```csharp using System; using Anthropic.Models.Organization.ServiceAccounts; ServiceAccountCreateParams parameters = new() { Name = "ci-deploy-bot" }; var serviceAccount = await client.Organization.ServiceAccounts.Create(parameters); Console.WriteLine(serviceAccount); ``` #### Response (200) ```json { "id": "svac_01SDCCSbTxrXDpWc1phhtcfK", "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "description": "description", "name": "ci-deploy-bot", "organization_role": "admin", "type": "service_account", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id" } ``` ## List Service Accounts `ServiceAccountListPage Organization.ServiceAccounts.List(parameters, cancellationToken = default)` **GET** `/v1/organizations/service_accounts` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=csharp). List service accounts in the caller's organization. Results are ordered by creation time, newest first. Use `limit` and the `next_page` cursor to paginate; set `include_archived=true` to include archived service accounts. ### Parameters - `ServiceAccountListParams parameters` - `bool includeArchived` (query parameter) Include archived resources. Defaults to false. - `long limit` (query parameter) Number of results per page. minimum: 1, maximum: 100 - `string? page` (query parameter) Opaque cursor from a previous response's `next_page`. ### Returns - `class ServiceAccount` Named non-human identity within the caller's organization. A service account is a pure identity: name + org. Authorization lives on whatever references it (federation rules). - `JsonElement Type = "service_account"` - `required string ID` Tagged ID of the service account. - `required DateTimeOffset? ArchivedAt` If set, this service account is archived. format: date-time - `required string? ArchivedByActorID` Tagged ID (`user_`/`svac_`) of the actor that archived this service account. - `required DateTimeOffset CreatedAt` When this service account was created. format: date-time - `required string? CreatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that created this service account. - `required string? Description` Optional free-text description. - `required string Name` Admin-chosen slug identifier. - `required OrganizationRole OrganizationRole` Org-level role. A federation rule may only be created or retargeted to grant `org:admin` scope when this is `admin`. A rule granting `org:admin` whose target is later demoted to `developer` is rejected at token exchange. Rules granting `org:admin` are managed in the Console. - `Admin("admin")` - `Developer("developer")` - `required DateTimeOffset UpdatedAt` When this service account was last updated. format: date-time - `required string? UpdatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that last updated this service account. ### Example ```csharp using System; using Anthropic.Models.Organization.ServiceAccounts; ServiceAccountListParams parameters = new(); var page = await client.Organization.ServiceAccounts.List(parameters); await foreach (var item in page.Paginate()) { Console.WriteLine(item); } ``` #### Response (200) ```json { "data": [ { "id": "svac_01SDCCSbTxrXDpWc1phhtcfK", "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "description": "description", "name": "ci-deploy-bot", "organization_role": "admin", "type": "service_account", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id" } ], "next_page": "next_page" } ``` ## Get Service Account `ServiceAccount Organization.ServiceAccounts.Retrieve(parameters, cancellationToken = default)` **GET** `/v1/organizations/service_accounts/{service_account_id}` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=csharp). Retrieve a service account by its ID (`svac_...`). ### Parameters - `ServiceAccountRetrieveParams parameters` - `required string serviceAccountID` (path parameter) ID of the service account. ### Returns - `class ServiceAccount` Named non-human identity within the caller's organization. A service account is a pure identity: name + org. Authorization lives on whatever references it (federation rules). - `JsonElement Type = "service_account"` - `required string ID` Tagged ID of the service account. - `required DateTimeOffset? ArchivedAt` If set, this service account is archived. format: date-time - `required string? ArchivedByActorID` Tagged ID (`user_`/`svac_`) of the actor that archived this service account. - `required DateTimeOffset CreatedAt` When this service account was created. format: date-time - `required string? CreatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that created this service account. - `required string? Description` Optional free-text description. - `required string Name` Admin-chosen slug identifier. - `required OrganizationRole OrganizationRole` Org-level role. A federation rule may only be created or retargeted to grant `org:admin` scope when this is `admin`. A rule granting `org:admin` whose target is later demoted to `developer` is rejected at token exchange. Rules granting `org:admin` are managed in the Console. - `Admin("admin")` - `Developer("developer")` - `required DateTimeOffset UpdatedAt` When this service account was last updated. format: date-time - `required string? UpdatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that last updated this service account. ### Example ```csharp using System; using Anthropic.Models.Organization.ServiceAccounts; ServiceAccountRetrieveParams parameters = new() { ServiceAccountID = "service_account_id" }; var serviceAccount = await client.Organization.ServiceAccounts.Retrieve(parameters); Console.WriteLine(serviceAccount); ``` #### Response (200) ```json { "id": "svac_01SDCCSbTxrXDpWc1phhtcfK", "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "description": "description", "name": "ci-deploy-bot", "organization_role": "admin", "type": "service_account", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id" } ``` ## Update Service Account `ServiceAccount Organization.ServiceAccounts.Update(parameters, cancellationToken = default)` **POST** `/v1/organizations/service_accounts/{service_account_id}` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=csharp). Update a service account. Only `description` and `organization_role` are mutable; `name` cannot be changed. Archived service accounts cannot be updated; this returns 400. Setting `organization_role` to `admin` (even when unchanged) requires an interactive credential (a user OAuth token or a Console session). ### Parameters - `ServiceAccountUpdateParams parameters` - `required string serviceAccountID` (path parameter) ID of the service account to update. - `string? description` Replaces the description. Omit to leave unchanged; send `null` to clear (the field is stored as an empty string). maxLength: 2000 - `OrganizationRole? organizationRole` Replaces the org-level role. Omit or send `null` to leave unchanged. - `Admin("admin")` - `Developer("developer")` ### Returns - `class ServiceAccount` Named non-human identity within the caller's organization. A service account is a pure identity: name + org. Authorization lives on whatever references it (federation rules). - `JsonElement Type = "service_account"` - `required string ID` Tagged ID of the service account. - `required DateTimeOffset? ArchivedAt` If set, this service account is archived. format: date-time - `required string? ArchivedByActorID` Tagged ID (`user_`/`svac_`) of the actor that archived this service account. - `required DateTimeOffset CreatedAt` When this service account was created. format: date-time - `required string? CreatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that created this service account. - `required string? Description` Optional free-text description. - `required string Name` Admin-chosen slug identifier. - `required OrganizationRole OrganizationRole` Org-level role. A federation rule may only be created or retargeted to grant `org:admin` scope when this is `admin`. A rule granting `org:admin` whose target is later demoted to `developer` is rejected at token exchange. Rules granting `org:admin` are managed in the Console. - `Admin("admin")` - `Developer("developer")` - `required DateTimeOffset UpdatedAt` When this service account was last updated. format: date-time - `required string? UpdatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that last updated this service account. ### Example ```csharp using System; using Anthropic.Models.Organization.ServiceAccounts; ServiceAccountUpdateParams parameters = new() { ServiceAccountID = "service_account_id" }; var serviceAccount = await client.Organization.ServiceAccounts.Update(parameters); Console.WriteLine(serviceAccount); ``` #### Response (200) ```json { "id": "svac_01SDCCSbTxrXDpWc1phhtcfK", "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "description": "description", "name": "ci-deploy-bot", "organization_role": "admin", "type": "service_account", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id" } ``` ## Archive Service Account `ServiceAccount Organization.ServiceAccounts.Archive(parameters, cancellationToken = default)` **POST** `/v1/organizations/service_accounts/{service_account_id}/archive` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=csharp). Archive a service account. Idempotent; re-archiving returns the service account with its original `archived_at`. Rejected with 400 if any live (non-archived) federation rule still targets this service account, same as issuer archival; archive those rules first or change their target to another service account. ### Parameters - `ServiceAccountArchiveParams parameters` - `required string serviceAccountID` (path parameter) ID of the service account to archive. ### Returns - `class ServiceAccount` Named non-human identity within the caller's organization. A service account is a pure identity: name + org. Authorization lives on whatever references it (federation rules). - `JsonElement Type = "service_account"` - `required string ID` Tagged ID of the service account. - `required DateTimeOffset? ArchivedAt` If set, this service account is archived. format: date-time - `required string? ArchivedByActorID` Tagged ID (`user_`/`svac_`) of the actor that archived this service account. - `required DateTimeOffset CreatedAt` When this service account was created. format: date-time - `required string? CreatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that created this service account. - `required string? Description` Optional free-text description. - `required string Name` Admin-chosen slug identifier. - `required OrganizationRole OrganizationRole` Org-level role. A federation rule may only be created or retargeted to grant `org:admin` scope when this is `admin`. A rule granting `org:admin` whose target is later demoted to `developer` is rejected at token exchange. Rules granting `org:admin` are managed in the Console. - `Admin("admin")` - `Developer("developer")` - `required DateTimeOffset UpdatedAt` When this service account was last updated. format: date-time - `required string? UpdatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that last updated this service account. ### Example ```csharp using System; using Anthropic.Models.Organization.ServiceAccounts; ServiceAccountArchiveParams parameters = new() { ServiceAccountID = "service_account_id" }; var serviceAccount = await client.Organization.ServiceAccounts.Archive(parameters); Console.WriteLine(serviceAccount); ``` #### Response (200) ```json { "id": "svac_01SDCCSbTxrXDpWc1phhtcfK", "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "description": "description", "name": "ci-deploy-bot", "organization_role": "admin", "type": "service_account", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id" } ``` ## Domain types ### Service Account - `class ServiceAccount` Named non-human identity within the caller's organization. A service account is a pure identity: name + org. Authorization lives on whatever references it (federation rules). - `JsonElement Type = "service_account"` - `required string ID` Tagged ID of the service account. - `required DateTimeOffset? ArchivedAt` If set, this service account is archived. format: date-time - `required string? ArchivedByActorID` Tagged ID (`user_`/`svac_`) of the actor that archived this service account. - `required DateTimeOffset CreatedAt` When this service account was created. format: date-time - `required string? CreatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that created this service account. - `required string? Description` Optional free-text description. - `required string Name` Admin-chosen slug identifier. - `required OrganizationRole OrganizationRole` Org-level role. A federation rule may only be created or retargeted to grant `org:admin` scope when this is `admin`. A rule granting `org:admin` whose target is later demoted to `developer` is rejected at token exchange. Rules granting `org:admin` are managed in the Console. - `Admin("admin")` - `Developer("developer")` - `required DateTimeOffset UpdatedAt` When this service account was last updated. format: date-time - `required string? UpdatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that last updated this service account. ### Service Account Workspace Member - `class ServiceAccountWorkspaceMember` - `JsonElement Type = "service_account_workspace_member"` - `required string? CreatedByActorID` Tagged ID (`user_...`/`svac_...`) of the actor who created this membership. - `required bool? Implicit` True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed. - `required string ServiceAccountID` Tagged service account ID (`svac_...`). - `required string WorkspaceID` Tagged workspace ID (`wrkspc_...`). - `required WorkspaceRole WorkspaceRole` Role of the service account in this workspace. Service accounts cannot hold the `workspace_billing` role. - `WorkspaceAdmin("workspace_admin")` - `WorkspaceBilling("workspace_billing")` - `WorkspaceDeveloper("workspace_developer")` - `WorkspaceRestrictedDeveloper("workspace_restricted_developer")` - `WorkspaceUser("workspace_user")` ## Service Accounts › Workspaces ### Add Workspace To Service Account `ServiceAccountWorkspaceMember Organization.ServiceAccounts.Workspaces.Add(parameters, cancellationToken = default)` **POST** `/v1/organizations/service_accounts/{service_account_id}/workspaces` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=csharp). Add a service account to a workspace with the given `workspace_role`. Mirror of `POST /workspaces/{workspace_id}/service_accounts`, addressed from the service-account side; both create the same membership. If the service account is already an explicit member of the workspace, its `workspace_role` is replaced with the value supplied here. Archived workspaces return 400. Archived service accounts cannot be added and are rejected. #### Parameters - `WorkspaceAddParams parameters` - `required string serviceAccountID` (path parameter) ID of the service account. - `required string workspaceID` Tagged workspace ID to add the service account to. - `required NoBillingWorkspaceRole workspaceRole` Role to assign to the service account in this workspace. #### Returns - `class ServiceAccountWorkspaceMember` - `JsonElement Type = "service_account_workspace_member"` - `required string? CreatedByActorID` Tagged ID (`user_...`/`svac_...`) of the actor who created this membership. - `required bool? Implicit` True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed. - `required string ServiceAccountID` Tagged service account ID (`svac_...`). - `required string WorkspaceID` Tagged workspace ID (`wrkspc_...`). - `required WorkspaceRole WorkspaceRole` Role of the service account in this workspace. Service accounts cannot hold the `workspace_billing` role. - `WorkspaceAdmin("workspace_admin")` - `WorkspaceBilling("workspace_billing")` - `WorkspaceDeveloper("workspace_developer")` - `WorkspaceRestrictedDeveloper("workspace_restricted_developer")` - `WorkspaceUser("workspace_user")` #### Example ```csharp using System; using Anthropic.Models.Organization.ServiceAccounts.Workspaces; using Anthropic.Models.Organization.Workspaces; WorkspaceAddParams parameters = new() { ServiceAccountID = "service_account_id", WorkspaceID = "workspace_id", WorkspaceRole = NoBillingWorkspaceRole.WorkspaceAdmin, }; var serviceAccountWorkspaceMember = await client.Organization.ServiceAccounts.Workspaces.Add(parameters); Console.WriteLine(serviceAccountWorkspaceMember); ``` ##### Response (200) ```json { "created_by_actor_id": "created_by_actor_id", "implicit": true, "service_account_id": "service_account_id", "type": "service_account_workspace_member", "workspace_id": "workspace_id", "workspace_role": "workspace_admin" } ``` ### List Workspaces For Service Account `WorkspaceListPage Organization.ServiceAccounts.Workspaces.List(parameters, cancellationToken = default)` **GET** `/v1/organizations/service_accounts/{service_account_id}/workspaces` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=csharp). List the workspaces a service account is a member of. Each entry includes the service account's `workspace_role` in that workspace. Use `limit` and the `next_page` cursor to paginate. When the service account has no explicit default-workspace membership, the implicit (`implicit: true`) membership is returned as the first entry on the first page; with `limit=1` the first page may return up to 2 entries (the implicit entry plus one explicit membership) so a pagination cursor can be derived. Memberships are returned only while the service account is active. Without a `page` cursor, an archived service account returns an empty list. A `page` cursor that does not match an active membership returns a 400 invalid-request error. A cursor stops matching when the membership is removed, the workspace is deleted, or the service account is archived. Restart pagination from the first page to recover. #### Parameters - `WorkspaceListParams parameters` - `required string serviceAccountID` (path parameter) ID of the service account. - `long limit` (query parameter) Number of results per page. minimum: 1, maximum: 100 - `string? page` (query parameter) Opaque cursor from a previous response's `next_page`. #### Returns - `class ServiceAccountWorkspaceMember` - `JsonElement Type = "service_account_workspace_member"` - `required string? CreatedByActorID` Tagged ID (`user_...`/`svac_...`) of the actor who created this membership. - `required bool? Implicit` True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed. - `required string ServiceAccountID` Tagged service account ID (`svac_...`). - `required string WorkspaceID` Tagged workspace ID (`wrkspc_...`). - `required WorkspaceRole WorkspaceRole` Role of the service account in this workspace. Service accounts cannot hold the `workspace_billing` role. - `WorkspaceAdmin("workspace_admin")` - `WorkspaceBilling("workspace_billing")` - `WorkspaceDeveloper("workspace_developer")` - `WorkspaceRestrictedDeveloper("workspace_restricted_developer")` - `WorkspaceUser("workspace_user")` #### Example ```csharp using System; using Anthropic.Models.Organization.ServiceAccounts.Workspaces; WorkspaceListParams parameters = new() { ServiceAccountID = "service_account_id" }; var page = await client.Organization.ServiceAccounts.Workspaces.List(parameters); await foreach (var item in page.Paginate()) { Console.WriteLine(item); } ``` ##### Response (200) ```json { "data": [ { "created_by_actor_id": "created_by_actor_id", "implicit": true, "service_account_id": "service_account_id", "type": "service_account_workspace_member", "workspace_id": "workspace_id", "workspace_role": "workspace_admin" } ], "next_page": "next_page" } ``` ### Remove Workspace From Service Account `WorkspaceRemoveResponse Organization.ServiceAccounts.Workspaces.Remove(parameters, cancellationToken = default)` **DELETE** `/v1/organizations/service_accounts/{service_account_id}/workspaces/{workspace_id}` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=csharp). Remove a service account from a workspace. Mirror of `DELETE /workspaces/{workspace_id}/service_accounts/{service_account_id}`, addressed from the service-account side. Removal is idempotent (returns 200 even if the membership was already removed). A DELETE against the implicit default-workspace membership returns 200 but is a no-op and the membership persists; deleting an explicit default-workspace row reverts to the implicit `workspace_user` membership. Archived workspaces return 400. #### Parameters - `WorkspaceRemoveParams parameters` - `required string serviceAccountID` (path parameter) ID of the service account. - `required string workspaceID` (path parameter) ID of the workspace. #### Returns - `class WorkspaceRemoveResponse` - `JsonElement Type = "service_account_workspace_member_deleted"` - `required string ServiceAccountID` Tagged service account ID (`svac_...`) named in the delete request. Removal is idempotent; see the endpoint description for the implicit-membership no-op. - `required string WorkspaceID` Tagged workspace ID (`wrkspc_...`) named in the delete request. #### Example ```csharp using System; using Anthropic.Models.Organization.ServiceAccounts.Workspaces; WorkspaceRemoveParams parameters = new() { ServiceAccountID = "service_account_id", WorkspaceID = "workspace_id", }; var workspace = await client.Organization.ServiceAccounts.Workspaces.Remove(parameters); Console.WriteLine(workspace); ``` ##### Response (200) ```json { "service_account_id": "service_account_id", "type": "service_account_workspace_member_deleted", "workspace_id": "workspace_id" } ```