# Service Accounts API

Manage service account API keys: list, create, rotate, and revoke.

## List service account API keys

`GET /api/v0/service-accounts/{serviceAccountId}/api-keys`

Returns all API keys for a service account, active and inactive. Each item carries `isRevoked`, `expiresAt`, and `revokedAt` so clients can split them into active/inactive views.

```bash
curl 'https://api.factory.ai/api/v0/service-accounts/{serviceAccountId}/api-keys' \
  -H 'Authorization: Bearer $FACTORY_API_KEY'
```

**Parameters**

- `serviceAccountId` (`string`, required) - Path parameter. Service account ID

**Response:** `200` - Response for status 200

## Create a service account API key

`POST /api/v0/service-accounts/{serviceAccountId}/api-keys`

Mints a new API key for a service account and returns the one-time key value. The value is shown only once and cannot be retrieved later.

```bash
curl -X POST 'https://api.factory.ai/api/v0/service-accounts/{serviceAccountId}/api-keys' \
  -H 'Authorization: Bearer $FACTORY_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{ ... }'
```

**Parameters**

- `serviceAccountId` (`string`, required) - Path parameter. Service account ID

**Response:** `201` - Response for status 201

## Revoke a service account API key

`POST /api/v0/service-accounts/{serviceAccountId}/api-keys/{keyId}/revoke`

Revokes an API key for a service account. Once revoked, the key can no longer authenticate. Idempotent.

```bash
curl -X POST 'https://api.factory.ai/api/v0/service-accounts/{serviceAccountId}/api-keys/{keyId}/revoke' \
  -H 'Authorization: Bearer $FACTORY_API_KEY'
```

**Parameters**

- `serviceAccountId` (`string`, required) - Path parameter. Service account ID
- `keyId` (`string`, required) - Path parameter. API key ID

**Response:** `204` - Response for status 204

## Rotate a service account API key

`POST /api/v0/service-accounts/{serviceAccountId}/api-keys/{keyId}/rotate`

DESTRUCTIVE: atomically revokes the existing key and issues a replacement that inherits its name, returning the new one-time key value (shown only once). The previous key stops authenticating the instant this call succeeds, so any client still using it will immediately start failing with 401. Update every consumer with the new value before rotating, or set `gracePeriodMinutes` to keep the old key valid for a short overlap window.

```bash
curl -X POST 'https://api.factory.ai/api/v0/service-accounts/{serviceAccountId}/api-keys/{keyId}/rotate' \
  -H 'Authorization: Bearer $FACTORY_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{ ... }'
```

**Parameters**

- `serviceAccountId` (`string`, required) - Path parameter. Service account ID
- `keyId` (`string`, required) - Path parameter. API key ID

**Response:** `200` - Response for status 200