Disable a service account

You can disable a service account to temporarily prevent it from authenticating.

Before you begin
Copy link

  • A service account exists in the target project.
  • You have the service_account:disable permission, or you are a project administrator.

About this task
Copy link

Use this option when you need to temporarily revoke access, such as during a security investigation or while an integration is offline for maintenance.

To identify service accounts that are no longer in use, check the last_authenticated_at field in the service account detail response. A null value indicates that the service account has never authenticated.

Procedure
Copy link

  1. Send a POST request to the disable endpoint: 
    $ curl -X POST \
    -H "Authorization: Bearer access_token" \
    https://orchestrator_host/api/v1/service_accounts/service_account_id/disable

    Where:

    • access_token is your personal access token or session token.
    • service_account_id is the UUID of the service account.
    • orchestrator_host is the hostname of your automation orchestrator instance.
  2. Verify the status change: 
    $ curl -H "Authorization: Bearer access_token" \
    https://orchestrator_host/api/v1/service_accounts/service_account_id

    The response shows "status": "disabled".

Results
Copy link

When you disable a service account:

  • All tokens previously issued to the service account are immediately rejected.
  • The service account cannot request new tokens.
  • The service account's credentials and role assignments are preserved.

Re-enable a disabled service account
Copy link

You can re-enable a disabled service account to restore its ability to authenticate.

Before you begin
Copy link

  • A service account exists in the target project and has a status of disabled.
  • You have the service_account:enable permission, or you are a project administrator.

Procedure
Copy link

  1. Send a POST request to the enable endpoint: 
    $ curl -X POST \
    -H "Authorization: Bearer access_token" \
    https://orchestrator_host/api/v1/service_accounts/service_account_id/enable

    Where:

    • access_token is your personal access token or session token.
    • service_account_id is the UUID of the service account.
    • orchestrator_host is the hostname of your automation orchestrator instance.
  2. Verify the response shows "status": "active".
    Note

    Tokens that were issued before the service account was disabled remain invalid. The external system must request a new token after the service account is re-enabled.