AIR Service Accounts

Machine credentials for a domain. Domain owners/admins create service accounts and mint bearer API keys for them; the raw key is returned once from createKey and never again. Revoked keys fail authentication immediately.

📄️List service accounts

Lists machine principals in the caller domain. Requires domain owner or admin role; members receive 403.

📄️Create service account

Creates a service account for API integrations in the caller domain. Requires domain owner or admin role.

📄️List API keys for a service account

Returns masked key metadata (pid, prefix, scopes, timestamps). Never includes raw secrets or hashes. Returns 404 for foreign service-account pids.

📄️Create API key

Mints a bearer API key scoped to this domain. The response `rawKey` is shown once and cannot be retrieved again. Requires a non-empty `scopes` array.

📄️Revoke API key

Revokes a key immediately; subsequent bearer requests with that key return 401. Returns 404 for foreign pids.