--- title: Service Accounts url: https://platform.claude.com/docs/en/api/java/organization/workspaces/service_accounts --- # Service Accounts ## List Service Account Workspace Members `ServiceAccountListPage organization().workspaces().serviceAccounts().list(params = ServiceAccountListParams.none(), requestOptions = RequestOptions.none())` **GET** `/v1/organizations/workspaces/{workspace_id}/service_accounts` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=java). List the service accounts that are members of a workspace. Each entry includes the service account's `workspace_role`. Use `limit` and the `next_page` cursor to paginate. Archived workspaces return 400; use `GET /service_accounts/{id}/workspaces` to audit memberships of an archived workspace. The implicit default-workspace membership is not included in this list. Memberships of archived service accounts are omitted from the results. ### Parameters - `ServiceAccountListParams params` - `Optional workspaceId` (path parameter) ID of the workspace. - `Optional limit` (query parameter) Number of results per page. minimum: 1, maximum: 100 - `Optional page` (query parameter) Opaque cursor from a previous response's `next_page`. ### Returns - `class ServiceAccountWorkspaceMember` - `JsonValue type = "service_account_workspace_member"` - `Optional createdByActorId` Tagged ID (`user_...`/`svac_...`) of the actor who created this membership. - `Optional implicit` True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed. - `String serviceAccountId` Tagged service account ID (`svac_...`). - `String workspaceId` Tagged workspace ID (`wrkspc_...`). - `WorkspaceRole workspaceRole` Role of the service account in this workspace. Service accounts cannot hold the `workspace_billing` role. - `WORKSPACE_ADMIN("workspace_admin")` - `WORKSPACE_BILLING("workspace_billing")` - `WORKSPACE_DEVELOPER("workspace_developer")` - `WORKSPACE_RESTRICTED_DEVELOPER("workspace_restricted_developer")` - `WORKSPACE_USER("workspace_user")` ### Example ```java package com.anthropic.example; import com.anthropic.client.AnthropicClient; import com.anthropic.client.okhttp.AnthropicOkHttpClient; import com.anthropic.models.organization.workspaces.serviceaccounts.ServiceAccountListPage; import com.anthropic.models.organization.workspaces.serviceaccounts.ServiceAccountListParams; public final class Main { private Main() {} public static void main(String[] args) { AnthropicClient client = AnthropicOkHttpClient.fromEnv(); ServiceAccountListPage page = client.organization().workspaces().serviceAccounts().list("workspace_id"); } } ``` #### Response (200) ```json { "data": [ { "created_by_actor_id": "created_by_actor_id", "implicit": true, "service_account_id": "service_account_id", "type": "service_account_workspace_member", "workspace_id": "workspace_id", "workspace_role": "workspace_admin" } ], "next_page": "next_page" } ``` ## Create Service Account Workspace Member `ServiceAccountWorkspaceMember organization().workspaces().serviceAccounts().add(params, requestOptions = RequestOptions.none())` **POST** `/v1/organizations/workspaces/{workspace_id}/service_accounts` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=java). Add a service account to a workspace with the given `workspace_role`. The role determines what the service account can do in the workspace and which workspace-scoped permissions it can be granted when authenticating through federation. Every service account is already an implicit `workspace_user` member of the default workspace; adding it explicitly assigns a chosen role. If the service account is already an explicit member of the workspace, its `workspace_role` is replaced with the value supplied here. Archived workspaces return 400. Archived service accounts cannot be added and are rejected. ### Parameters - `ServiceAccountAddParams params` - `Optional workspaceId` (path parameter) ID of the workspace. - `String serviceAccountId` Tagged service account ID to add. - `NoBillingWorkspaceRole workspaceRole` Role to assign to the service account in this workspace. ### Returns - `class ServiceAccountWorkspaceMember` - `JsonValue type = "service_account_workspace_member"` - `Optional createdByActorId` Tagged ID (`user_...`/`svac_...`) of the actor who created this membership. - `Optional implicit` True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed. - `String serviceAccountId` Tagged service account ID (`svac_...`). - `String workspaceId` Tagged workspace ID (`wrkspc_...`). - `WorkspaceRole workspaceRole` Role of the service account in this workspace. Service accounts cannot hold the `workspace_billing` role. - `WORKSPACE_ADMIN("workspace_admin")` - `WORKSPACE_BILLING("workspace_billing")` - `WORKSPACE_DEVELOPER("workspace_developer")` - `WORKSPACE_RESTRICTED_DEVELOPER("workspace_restricted_developer")` - `WORKSPACE_USER("workspace_user")` ### Example ```java package com.anthropic.example; import com.anthropic.client.AnthropicClient; import com.anthropic.client.okhttp.AnthropicOkHttpClient; import com.anthropic.models.organization.serviceaccounts.ServiceAccountWorkspaceMember; import com.anthropic.models.organization.workspaces.NoBillingWorkspaceRole; import com.anthropic.models.organization.workspaces.serviceaccounts.ServiceAccountAddParams; public final class Main { private Main() {} public static void main(String[] args) { AnthropicClient client = AnthropicOkHttpClient.fromEnv(); ServiceAccountAddParams params = ServiceAccountAddParams.builder() .workspaceId("workspace_id") .serviceAccountId("service_account_id") .workspaceRole(NoBillingWorkspaceRole.WORKSPACE_ADMIN) .build(); ServiceAccountWorkspaceMember serviceAccountWorkspaceMember = client.organization().workspaces().serviceAccounts().add(params); } } ``` #### Response (200) ```json { "created_by_actor_id": "created_by_actor_id", "implicit": true, "service_account_id": "service_account_id", "type": "service_account_workspace_member", "workspace_id": "workspace_id", "workspace_role": "workspace_admin" } ``` ## Get Service Account Workspace Member `ServiceAccountWorkspaceMember organization().workspaces().serviceAccounts().retrieve(params, requestOptions = RequestOptions.none())` **GET** `/v1/organizations/workspaces/{workspace_id}/service_accounts/{service_account_id}` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=java). Retrieve a service account's membership in a workspace. Returns the membership record, including the service account's `workspace_role` in this workspace. Archived workspaces return 400. For the default workspace, returns the implicit (`implicit: true`) membership when no explicit membership exists; an explicitly added membership is returned with its assigned role. An archived service account returns 404. ### Parameters - `ServiceAccountRetrieveParams params` - `String workspaceId` (path parameter) ID of the workspace. - `Optional serviceAccountId` (path parameter) ID of the service account. ### Returns - `class ServiceAccountWorkspaceMember` - `JsonValue type = "service_account_workspace_member"` - `Optional createdByActorId` Tagged ID (`user_...`/`svac_...`) of the actor who created this membership. - `Optional implicit` True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed. - `String serviceAccountId` Tagged service account ID (`svac_...`). - `String workspaceId` Tagged workspace ID (`wrkspc_...`). - `WorkspaceRole workspaceRole` Role of the service account in this workspace. Service accounts cannot hold the `workspace_billing` role. - `WORKSPACE_ADMIN("workspace_admin")` - `WORKSPACE_BILLING("workspace_billing")` - `WORKSPACE_DEVELOPER("workspace_developer")` - `WORKSPACE_RESTRICTED_DEVELOPER("workspace_restricted_developer")` - `WORKSPACE_USER("workspace_user")` ### Example ```java package com.anthropic.example; import com.anthropic.client.AnthropicClient; import com.anthropic.client.okhttp.AnthropicOkHttpClient; import com.anthropic.models.organization.serviceaccounts.ServiceAccountWorkspaceMember; import com.anthropic.models.organization.workspaces.serviceaccounts.ServiceAccountRetrieveParams; public final class Main { private Main() {} public static void main(String[] args) { AnthropicClient client = AnthropicOkHttpClient.fromEnv(); ServiceAccountRetrieveParams params = ServiceAccountRetrieveParams.builder() .workspaceId("workspace_id") .serviceAccountId("service_account_id") .build(); ServiceAccountWorkspaceMember serviceAccountWorkspaceMember = client.organization().workspaces().serviceAccounts().retrieve(params); } } ``` #### Response (200) ```json { "created_by_actor_id": "created_by_actor_id", "implicit": true, "service_account_id": "service_account_id", "type": "service_account_workspace_member", "workspace_id": "workspace_id", "workspace_role": "workspace_admin" } ``` ## Update Service Account Workspace Member `ServiceAccountWorkspaceMember organization().workspaces().serviceAccounts().update(params, requestOptions = RequestOptions.none())` **POST** `/v1/organizations/workspaces/{workspace_id}/service_accounts/{service_account_id}` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=java). Change a service account's role in a workspace. The new `workspace_role` replaces the current one. Only explicit memberships can be updated; to set a role on the implicit default-workspace membership, add the service account explicitly with `POST /workspaces/{workspace_id}/service_accounts`. Archived workspaces return 400. Archived service accounts cannot be updated and are rejected. ### Parameters - `ServiceAccountUpdateParams params` - `String workspaceId` (path parameter) ID of the workspace. - `Optional serviceAccountId` (path parameter) ID of the service account. - `NoBillingWorkspaceRole workspaceRole` New role for the service account in this workspace. ### Returns - `class ServiceAccountWorkspaceMember` - `JsonValue type = "service_account_workspace_member"` - `Optional createdByActorId` Tagged ID (`user_...`/`svac_...`) of the actor who created this membership. - `Optional implicit` True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed. - `String serviceAccountId` Tagged service account ID (`svac_...`). - `String workspaceId` Tagged workspace ID (`wrkspc_...`). - `WorkspaceRole workspaceRole` Role of the service account in this workspace. Service accounts cannot hold the `workspace_billing` role. - `WORKSPACE_ADMIN("workspace_admin")` - `WORKSPACE_BILLING("workspace_billing")` - `WORKSPACE_DEVELOPER("workspace_developer")` - `WORKSPACE_RESTRICTED_DEVELOPER("workspace_restricted_developer")` - `WORKSPACE_USER("workspace_user")` ### Example ```java package com.anthropic.example; import com.anthropic.client.AnthropicClient; import com.anthropic.client.okhttp.AnthropicOkHttpClient; import com.anthropic.models.organization.serviceaccounts.ServiceAccountWorkspaceMember; import com.anthropic.models.organization.workspaces.NoBillingWorkspaceRole; import com.anthropic.models.organization.workspaces.serviceaccounts.ServiceAccountUpdateParams; public final class Main { private Main() {} public static void main(String[] args) { AnthropicClient client = AnthropicOkHttpClient.fromEnv(); ServiceAccountUpdateParams params = ServiceAccountUpdateParams.builder() .workspaceId("workspace_id") .serviceAccountId("service_account_id") .workspaceRole(NoBillingWorkspaceRole.WORKSPACE_ADMIN) .build(); ServiceAccountWorkspaceMember serviceAccountWorkspaceMember = client.organization().workspaces().serviceAccounts().update(params); } } ``` #### Response (200) ```json { "created_by_actor_id": "created_by_actor_id", "implicit": true, "service_account_id": "service_account_id", "type": "service_account_workspace_member", "workspace_id": "workspace_id", "workspace_role": "workspace_admin" } ``` ## Delete Service Account Workspace Member `ServiceAccountRemoveResponse organization().workspaces().serviceAccounts().remove(params, requestOptions = RequestOptions.none())` **DELETE** `/v1/organizations/workspaces/{workspace_id}/service_accounts/{service_account_id}` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=java). Remove a service account from a workspace. Removal is idempotent (returns 200 even if the membership was already removed). A DELETE against the implicit default-workspace membership returns 200 but is a no-op and the membership persists; deleting an explicit default-workspace row reverts to the implicit `workspace_user` membership. Archived workspaces return 400. ### Parameters - `ServiceAccountRemoveParams params` - `String workspaceId` (path parameter) ID of the workspace. - `Optional serviceAccountId` (path parameter) ID of the service account. ### Returns - `class ServiceAccountRemoveResponse` - `JsonValue type = "service_account_workspace_member_deleted"` - `String serviceAccountId` Tagged service account ID (`svac_...`) named in the delete request. Removal is idempotent; see the endpoint description for the implicit-membership no-op. - `String workspaceId` Tagged workspace ID (`wrkspc_...`) named in the delete request. ### Example ```java package com.anthropic.example; import com.anthropic.client.AnthropicClient; import com.anthropic.client.okhttp.AnthropicOkHttpClient; import com.anthropic.models.organization.workspaces.serviceaccounts.ServiceAccountRemoveParams; import com.anthropic.models.organization.workspaces.serviceaccounts.ServiceAccountRemoveResponse; public final class Main { private Main() {} public static void main(String[] args) { AnthropicClient client = AnthropicOkHttpClient.fromEnv(); ServiceAccountRemoveParams params = ServiceAccountRemoveParams.builder() .workspaceId("workspace_id") .serviceAccountId("service_account_id") .build(); ServiceAccountRemoveResponse serviceAccount = client.organization().workspaces().serviceAccounts().remove(params); } } ``` #### Response (200) ```json { "service_account_id": "service_account_id", "type": "service_account_workspace_member_deleted", "workspace_id": "workspace_id" } ```