Service Accounts — Proposed Guide

Planned API — Reference Only

Service Accounts: A service account is a machine principal with an accountable owner, not a shared employee login. Its access should be tied to a specific…

Overview

A service account is a machine principal with an accountable owner, not a shared employee login. Its access should be tied to a specific integration purpose and organization.

Key concepts

Separate principal identity from credentials and distinguish disabled principals from rotated keys. Record an owner who can review ongoing access.

Implementation considerations

No service accounts are issued by this site. Avoid creating a fictional service account that implies access to a real financial system.

Illustrative data model

This local fixture shows a possible representation for the concepts above. It is not an endpoint response, production configuration or a claim that the described capability is implemented.

JSON fixture

Fictional concept fixture

{
  "reference_only": true,
  "topic": "Service Accounts",
  "principal_id": "principal_example_123",
  "owner_id": "usr_example_123",
  "organization_id": "org_example_123",
  "status": "draft"
}

Design review checklist

Document which organization owns the service accounts representation and which actor may view or change it.
Test the boundaries of principal id, owner id, organization id, status using synthetic values, including missing or inconsistent references.
Before future implementation, obtain an approved contract and review failure behavior. This documentation does not authorize production activation.

Proposed data types

Illustrative field dictionary
Name	Type	Description
principal_id	string	Stable fictional principal reference; not a secret and not evidence that a resource exists.
owner_id	string	Stable fictional owner reference; not a secret and not evidence that a resource exists.
organization_id	string	Stable fictional organization reference; not a secret and not evidence that a resource exists.
status	string	Proposed lifecycle value. Its meaning depends on the resource and must not be inferred from HTTP success.

Authentication Scopes

Authentication

Application Permissions