---
title: Service Accounts
url: https://platform.claude.com/docs/en/api/go/organization/workspaces/service_accounts
---

# Service Accounts

## List Service Account Workspace Members

`client.Organization.Workspaces.ServiceAccounts.List(ctx, workspaceID, query) (*PageCursor[ServiceAccountWorkspaceMember], error)`

**GET** `/v1/organizations/workspaces/{workspace_id}/service_accounts`

**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=go).

List the service accounts that are members of a workspace.

Each entry includes the service account's `workspace_role`. Use `limit`
and the `next_page` cursor to paginate. Archived workspaces return 400;
use `GET /service_accounts/{id}/workspaces` to audit memberships of an
archived workspace. The implicit default-workspace membership is not
included in this list. Memberships of archived service accounts are
omitted from the results.

### Parameters

- `workspaceID string` (path parameter)

  ID of the workspace.

- `query OrganizationWorkspaceServiceAccountListParams`

  - `Limit param.Opt[int64] Optional` (query parameter)

    Number of results per page.

    minimum: 1, maximum: 100

  - `Page param.Opt[string] Optional` (query parameter)

    Opaque cursor from a previous response's `next_page`.

### Returns

- `type ServiceAccountWorkspaceMember`

  - `Type ServiceAccountWorkspaceMember`

    default: service_account_workspace_member

  - `CreatedByActorID string`

    Tagged ID (`user_...`/`svac_...`) of the actor who created this membership.

  - `Implicit bool`

    True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed.

  - `ServiceAccountID string`

    Tagged service account ID (`svac_...`).

  - `WorkspaceID string`

    Tagged workspace ID (`wrkspc_...`).

  - `WorkspaceRole WorkspaceRole`

    Role of the service account in this workspace. Service accounts cannot hold the `workspace_billing` role.

    - `const WorkspaceRoleWorkspaceAdmin WorkspaceRole = "workspace_admin"`

    - `const WorkspaceRoleWorkspaceBilling WorkspaceRole = "workspace_billing"`

    - `const WorkspaceRoleWorkspaceDeveloper WorkspaceRole = "workspace_developer"`

    - `const WorkspaceRoleWorkspaceRestrictedDeveloper WorkspaceRole = "workspace_restricted_developer"`

    - `const WorkspaceRoleWorkspaceUser WorkspaceRole = "workspace_user"`

### Example

```go
package main

import (
	"context"
	"fmt"

	"github.com/anthropics/anthropic-sdk-go"
	"github.com/anthropics/anthropic-sdk-go/option"
)

func main() {
	client := anthropic.NewClient(
		option.WithAPIKey("my-anthropic-api-key"),
	)
	page, err := client.Organization.Workspaces.ServiceAccounts.List(
		context.TODO(),
		"workspace_id",
		anthropic.OrganizationWorkspaceServiceAccountListParams{},
	)
	if err != nil {
		panic(err.Error())
	}
	fmt.Printf("%+v\n", page)
}
```

#### Response (200)

```json
{
  "data": [
    {
      "created_by_actor_id": "created_by_actor_id",
      "implicit": true,
      "service_account_id": "service_account_id",
      "type": "service_account_workspace_member",
      "workspace_id": "workspace_id",
      "workspace_role": "workspace_admin"
    }
  ],
  "next_page": "next_page"
}
```

## Create Service Account Workspace Member

`client.Organization.Workspaces.ServiceAccounts.Add(ctx, workspaceID, body) (*ServiceAccountWorkspaceMember, error)`

**POST** `/v1/organizations/workspaces/{workspace_id}/service_accounts`

**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=go).

Add a service account to a workspace with the given `workspace_role`.

The role determines what the service account can do in the workspace and
which workspace-scoped permissions it can be granted when authenticating
through federation. Every service account is already an implicit
`workspace_user` member of the default workspace; adding it explicitly
assigns a chosen role. If the service account is already an explicit
member of the workspace, its `workspace_role` is replaced with the
value supplied here. Archived workspaces return 400. Archived service
accounts cannot be added and are rejected.

### Parameters

- `workspaceID string` (path parameter)

  ID of the workspace.

- `body OrganizationWorkspaceServiceAccountAddParams`

  - `ServiceAccountID string`

    Tagged service account ID to add.

  - `WorkspaceRole NoBillingWorkspaceRole`

    Role to assign to the service account in this workspace.

### Returns

- `type ServiceAccountWorkspaceMember`

  - `Type ServiceAccountWorkspaceMember`

    default: service_account_workspace_member

  - `CreatedByActorID string`

    Tagged ID (`user_...`/`svac_...`) of the actor who created this membership.

  - `Implicit bool`

    True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed.

  - `ServiceAccountID string`

    Tagged service account ID (`svac_...`).

  - `WorkspaceID string`

    Tagged workspace ID (`wrkspc_...`).

  - `WorkspaceRole WorkspaceRole`

    Role of the service account in this workspace. Service accounts cannot hold the `workspace_billing` role.

    - `const WorkspaceRoleWorkspaceAdmin WorkspaceRole = "workspace_admin"`

    - `const WorkspaceRoleWorkspaceBilling WorkspaceRole = "workspace_billing"`

    - `const WorkspaceRoleWorkspaceDeveloper WorkspaceRole = "workspace_developer"`

    - `const WorkspaceRoleWorkspaceRestrictedDeveloper WorkspaceRole = "workspace_restricted_developer"`

    - `const WorkspaceRoleWorkspaceUser WorkspaceRole = "workspace_user"`

### Example

```go
package main

import (
	"context"
	"fmt"

	"github.com/anthropics/anthropic-sdk-go"
	"github.com/anthropics/anthropic-sdk-go/option"
)

func main() {
	client := anthropic.NewClient(
		option.WithAPIKey("my-anthropic-api-key"),
	)
	serviceAccountWorkspaceMember, err := client.Organization.Workspaces.ServiceAccounts.Add(
		context.TODO(),
		"workspace_id",
		anthropic.OrganizationWorkspaceServiceAccountAddParams{
			ServiceAccountID: "service_account_id",
			WorkspaceRole:    anthropic.NoBillingWorkspaceRoleWorkspaceAdmin,
		},
	)
	if err != nil {
		panic(err.Error())
	}
	fmt.Printf("%+v\n", serviceAccountWorkspaceMember.CreatedByActorID)
}
```

#### Response (200)

```json
{
  "created_by_actor_id": "created_by_actor_id",
  "implicit": true,
  "service_account_id": "service_account_id",
  "type": "service_account_workspace_member",
  "workspace_id": "workspace_id",
  "workspace_role": "workspace_admin"
}
```

## Get Service Account Workspace Member

`client.Organization.Workspaces.ServiceAccounts.Get(ctx, serviceAccountID, query) (*ServiceAccountWorkspaceMember, error)`

**GET** `/v1/organizations/workspaces/{workspace_id}/service_accounts/{service_account_id}`

**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=go).

Retrieve a service account's membership in a workspace.

Returns the membership record, including the service account's
`workspace_role` in this workspace. Archived workspaces return 400. For
the default workspace, returns the implicit (`implicit: true`)
membership when no explicit membership exists; an explicitly added
membership is returned with its assigned role. An archived service
account returns 404.

### Parameters

- `serviceAccountID string` (path parameter)

  ID of the service account.

- `query OrganizationWorkspaceServiceAccountGetParams`

  - `WorkspaceID string` (path parameter)

    ID of the workspace.

### Returns

- `type ServiceAccountWorkspaceMember`

  - `Type ServiceAccountWorkspaceMember`

    default: service_account_workspace_member

  - `CreatedByActorID string`

    Tagged ID (`user_...`/`svac_...`) of the actor who created this membership.

  - `Implicit bool`

    True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed.

  - `ServiceAccountID string`

    Tagged service account ID (`svac_...`).

  - `WorkspaceID string`

    Tagged workspace ID (`wrkspc_...`).

  - `WorkspaceRole WorkspaceRole`

    Role of the service account in this workspace. Service accounts cannot hold the `workspace_billing` role.

    - `const WorkspaceRoleWorkspaceAdmin WorkspaceRole = "workspace_admin"`

    - `const WorkspaceRoleWorkspaceBilling WorkspaceRole = "workspace_billing"`

    - `const WorkspaceRoleWorkspaceDeveloper WorkspaceRole = "workspace_developer"`

    - `const WorkspaceRoleWorkspaceRestrictedDeveloper WorkspaceRole = "workspace_restricted_developer"`

    - `const WorkspaceRoleWorkspaceUser WorkspaceRole = "workspace_user"`

### Example

```go
package main

import (
	"context"
	"fmt"

	"github.com/anthropics/anthropic-sdk-go"
	"github.com/anthropics/anthropic-sdk-go/option"
)

func main() {
	client := anthropic.NewClient(
		option.WithAPIKey("my-anthropic-api-key"),
	)
	serviceAccountWorkspaceMember, err := client.Organization.Workspaces.ServiceAccounts.Get(
		context.TODO(),
		"service_account_id",
		anthropic.OrganizationWorkspaceServiceAccountGetParams{
			WorkspaceID: "workspace_id",
		},
	)
	if err != nil {
		panic(err.Error())
	}
	fmt.Printf("%+v\n", serviceAccountWorkspaceMember.CreatedByActorID)
}
```

#### Response (200)

```json
{
  "created_by_actor_id": "created_by_actor_id",
  "implicit": true,
  "service_account_id": "service_account_id",
  "type": "service_account_workspace_member",
  "workspace_id": "workspace_id",
  "workspace_role": "workspace_admin"
}
```

## Update Service Account Workspace Member

`client.Organization.Workspaces.ServiceAccounts.Update(ctx, serviceAccountID, params) (*ServiceAccountWorkspaceMember, error)`

**POST** `/v1/organizations/workspaces/{workspace_id}/service_accounts/{service_account_id}`

**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=go).

Change a service account's role in a workspace.

The new `workspace_role` replaces the current one. Only explicit
memberships can be updated; to set a role on the implicit
default-workspace membership, add the service account explicitly with
`POST /workspaces/{workspace_id}/service_accounts`. Archived workspaces
return 400. Archived service accounts cannot be updated and are
rejected.

### Parameters

- `serviceAccountID string` (path parameter)

  ID of the service account.

- `params OrganizationWorkspaceServiceAccountUpdateParams`

  - `WorkspaceID string` (path parameter)

    ID of the workspace.

  - `WorkspaceRole NoBillingWorkspaceRole`

    New role for the service account in this workspace.

### Returns

- `type ServiceAccountWorkspaceMember`

  - `Type ServiceAccountWorkspaceMember`

    default: service_account_workspace_member

  - `CreatedByActorID string`

    Tagged ID (`user_...`/`svac_...`) of the actor who created this membership.

  - `Implicit bool`

    True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed.

  - `ServiceAccountID string`

    Tagged service account ID (`svac_...`).

  - `WorkspaceID string`

    Tagged workspace ID (`wrkspc_...`).

  - `WorkspaceRole WorkspaceRole`

    Role of the service account in this workspace. Service accounts cannot hold the `workspace_billing` role.

    - `const WorkspaceRoleWorkspaceAdmin WorkspaceRole = "workspace_admin"`

    - `const WorkspaceRoleWorkspaceBilling WorkspaceRole = "workspace_billing"`

    - `const WorkspaceRoleWorkspaceDeveloper WorkspaceRole = "workspace_developer"`

    - `const WorkspaceRoleWorkspaceRestrictedDeveloper WorkspaceRole = "workspace_restricted_developer"`

    - `const WorkspaceRoleWorkspaceUser WorkspaceRole = "workspace_user"`

### Example

```go
package main

import (
	"context"
	"fmt"

	"github.com/anthropics/anthropic-sdk-go"
	"github.com/anthropics/anthropic-sdk-go/option"
)

func main() {
	client := anthropic.NewClient(
		option.WithAPIKey("my-anthropic-api-key"),
	)
	serviceAccountWorkspaceMember, err := client.Organization.Workspaces.ServiceAccounts.Update(
		context.TODO(),
		"service_account_id",
		anthropic.OrganizationWorkspaceServiceAccountUpdateParams{
			WorkspaceID:   "workspace_id",
			WorkspaceRole: anthropic.NoBillingWorkspaceRoleWorkspaceAdmin,
		},
	)
	if err != nil {
		panic(err.Error())
	}
	fmt.Printf("%+v\n", serviceAccountWorkspaceMember.CreatedByActorID)
}
```

#### Response (200)

```json
{
  "created_by_actor_id": "created_by_actor_id",
  "implicit": true,
  "service_account_id": "service_account_id",
  "type": "service_account_workspace_member",
  "workspace_id": "workspace_id",
  "workspace_role": "workspace_admin"
}
```

## Delete Service Account Workspace Member

`client.Organization.Workspaces.ServiceAccounts.Remove(ctx, serviceAccountID, body) (*OrganizationWorkspaceServiceAccountRemoveResponse, error)`

**DELETE** `/v1/organizations/workspaces/{workspace_id}/service_accounts/{service_account_id}`

**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=go).

Remove a service account from a workspace.

Removal is idempotent (returns 200 even if the membership was already
removed). A DELETE against the implicit default-workspace membership
returns 200 but is a no-op and the membership persists; deleting an
explicit default-workspace row reverts to the implicit `workspace_user`
membership. Archived workspaces return 400.

### Parameters

- `serviceAccountID string` (path parameter)

  ID of the service account.

- `body OrganizationWorkspaceServiceAccountRemoveParams`

  - `WorkspaceID string` (path parameter)

    ID of the workspace.

### Returns

- `type OrganizationWorkspaceServiceAccountRemoveResponse`

  - `Type ServiceAccountWorkspaceMemberDeleted`

    default: service_account_workspace_member_deleted

  - `ServiceAccountID string`

    Tagged service account ID (`svac_...`) named in the delete request. Removal is idempotent; see the endpoint description for the implicit-membership no-op.

  - `WorkspaceID string`

    Tagged workspace ID (`wrkspc_...`) named in the delete request.

### Example

```go
package main

import (
	"context"
	"fmt"

	"github.com/anthropics/anthropic-sdk-go"
	"github.com/anthropics/anthropic-sdk-go/option"
)

func main() {
	client := anthropic.NewClient(
		option.WithAPIKey("my-anthropic-api-key"),
	)
	serviceAccount, err := client.Organization.Workspaces.ServiceAccounts.Remove(
		context.TODO(),
		"service_account_id",
		anthropic.OrganizationWorkspaceServiceAccountRemoveParams{
			WorkspaceID: "workspace_id",
		},
	)
	if err != nil {
		panic(err.Error())
	}
	fmt.Printf("%+v\n", serviceAccount.ServiceAccountID)
}
```

#### Response (200)

```json
{
  "service_account_id": "service_account_id",
  "type": "service_account_workspace_member_deleted",
  "workspace_id": "workspace_id"
}
```