---
title: "Create a service account"
canonical: "https://admiral.io/docs/api/service-accounts/ServiceAccountAPI_CreateServiceAccount"
---

# Create a service account

`POST https://api.admiral.io/v1/service-accounts`

Scope: `serviceaccount:write`

### Request body

- `service_account` (ServiceAccount, required): The service account to create: `name`, `issuer_id` and `subject`. create_service_account.identity // name, issuer_id and subject are required
  - `id` (string): Pattern `^sa-[0-9a-z]+$`. Read-only.
  - `agent_id` (string): `agt-`: the agent that runs as this service account. Empty for one that runs no agent. Read-only.
  - `issuer_id` (string): (IMMUTABLE) `iss-`: the issuer whose tokens it accepts. For an agent's, set when the agent enrolls; empty before. For one that runs no agent, set on create. Pattern `^iss-[0-9a-z]+$`.
  - `subject` (string): (IMMUTABLE) The `sub` a token must carry. For a Kubernetes service account, `system:serviceaccount:<namespace>:<name>`; for GitHub Actions, `repo:<owner>/<repo>:ref:refs/heads/<branch>` or `repo:<owner>/<repo>:environment:<name>`. For an agent's, recorded from its verified token when it enrolls; empty before. Fixed once set. Length at most 512.
  - `enrolled_at` (Timestamp): A point in time in RFC 3339 format, with up to nanosecond precision. Output uses UTC (`Z`); input may use an offset from UTC. Read-only.
  - `created_by` (ActorRef): ActorRef is a lightweight reference to the user or agent that performed an action. Server-populated on all resource responses. Clients should never send this. Read-only.
    - `id` (string): The actor's typed id: a `usr-` user id or an `sa-` service account id.
    - `display_name` (string): Human-readable name (e.g., "John Smith", "deploy-bot").
    - `email` (string): Email address (empty for non-human actors).
  - `created_at` (Timestamp): A point in time in RFC 3339 format, with up to nanosecond precision. Output uses UTC (`Z`); input may use an offset from UTC. Read-only.
  - `name` (string): (IMMUTABLE) An agent's takes the agent's name. Unique in the organization. Pattern `^[a-z]([a-z0-9-]{0,61}[a-z0-9])?$`. Length at most 63.

### Response 200

Success

- `service_account` (ServiceAccount): ServiceAccount is a non-human principal. With `issuer_id` and `subject` set it signs in with a token from that issuer carrying that subject, matched exactly; the exact match is what secures a shared issuer, which anyone can get a token from.
  - `id` (string): Pattern `^sa-[0-9a-z]+$`. Read-only.
  - `agent_id` (string): `agt-`: the agent that runs as this service account. Empty for one that runs no agent. Read-only.
  - `issuer_id` (string): (IMMUTABLE) `iss-`: the issuer whose tokens it accepts. For an agent's, set when the agent enrolls; empty before. For one that runs no agent, set on create. Pattern `^iss-[0-9a-z]+$`.
  - `subject` (string): (IMMUTABLE) The `sub` a token must carry. For a Kubernetes service account, `system:serviceaccount:<namespace>:<name>`; for GitHub Actions, `repo:<owner>/<repo>:ref:refs/heads/<branch>` or `repo:<owner>/<repo>:environment:<name>`. For an agent's, recorded from its verified token when it enrolls; empty before. Fixed once set. Length at most 512.
  - `enrolled_at` (Timestamp): A point in time in RFC 3339 format, with up to nanosecond precision. Output uses UTC (`Z`); input may use an offset from UTC. Read-only.
  - `created_by` (ActorRef): ActorRef is a lightweight reference to the user or agent that performed an action. Server-populated on all resource responses. Clients should never send this. Read-only.
    - `id` (string): The actor's typed id: a `usr-` user id or an `sa-` service account id.
    - `display_name` (string): Human-readable name (e.g., "John Smith", "deploy-bot").
    - `email` (string): Email address (empty for non-human actors).
  - `created_at` (Timestamp): A point in time in RFC 3339 format, with up to nanosecond precision. Output uses UTC (`Z`); input may use an offset from UTC. Read-only.
  - `name` (string): (IMMUTABLE) An agent's takes the agent's name. Unique in the organization. Pattern `^[a-z]([a-z0-9-]{0,61}[a-z0-9])?$`. Length at most 63.