--- title: "Retrieve a service account" canonical: "https://admiral.io/docs/api/service-accounts/ServiceAccountAPI_GetServiceAccount" --- # Retrieve a service account `GET https://api.admiral.io/v1/service-accounts/{service_account_id}` Scope: `serviceaccount:read` ### Path parameters - `service_account_id` (string, required): The service_account_id path parameter. Pattern `^sa-[0-9a-z]+$`. ### Response 200 Success - `service_account` (ServiceAccount): ServiceAccount is a non-human principal. With `issuer_id` and `subject` set it signs in with a token from that issuer carrying that subject, matched exactly; the exact match is what secures a shared issuer, which anyone can get a token from. - `id` (string): Pattern `^sa-[0-9a-z]+$`. Read-only. - `agent_id` (string): `agt-`: the agent that runs as this service account. Empty for one that runs no agent. Read-only. - `issuer_id` (string): `iss-`: the issuer whose tokens it accepts. For an agent's, set when the agent enrolls; empty before. Read-only. - `subject` (string): The `sub` a token must carry. For a Kubernetes service account, `system:serviceaccount::`. For an agent's, recorded from its verified token when it enrolls and fixed from then on; empty before. Read-only. - `enrolled_at` (Timestamp): A point in time in RFC 3339 format, with up to nanosecond precision. Output uses UTC (`Z`); input may use an offset from UTC. Read-only. - `created_by` (ActorRef): ActorRef is a lightweight reference to the user or agent that performed an action. Server-populated on all resource responses. Clients should never send this. Read-only. - `id` (string): The actor's typed id: a `usr-` user id or an `sa-` service account id. - `display_name` (string): Human-readable name (e.g., "John Smith", "deploy-bot"). - `email` (string): Email address (empty for non-human actors). - `created_at` (Timestamp): A point in time in RFC 3339 format, with up to nanosecond precision. Output uses UTC (`Z`); input may use an offset from UTC. Read-only.