Service Accounts & Machine API Keys
Create non-human credentials with strictly scoped permissions for CI/CD runners, Kubernetes operators, and automated workloads.
1. Provision a Service Account
Service accounts are bound to a specific vault project and hold explicitly assigned scopes (read, write, or admin):
POST /v1/secrets/projects/{id}/service-accountsAuth
Request
POST/v1/secrets/projects/{id}/service-accounts
Response
⚠️ Security Notice: The raw API key token is displayed exactly once at creation time and cannot be recovered if lost.
2. Token Rotation & Revocation
If a credential is suspected of being compromised, rotate or revoke it instantly:
POST /v1/secrets/service-accounts/{saId}/rotateAuth
Request
POST/v1/secrets/service-accounts/{saId}/rotate
Response