Service accounts and keys
Service accounts for CI and automation, their keys, policies, delegations and audit.
Operations of this group with their access rule, retry rule, parameters and answers. Every request carries a key: Authorization: Bearer <key> (see Authentication).
Operations
List service accounts
GET HEAD /api/v1/service-accounts
Access: Service administration permission service-account.read · Retry: Safe to repeat (read)
Lists the service accounts the caller may see, ordered by ID, 50 per page, each with name, enabled flag, revision, policy bindings and creation time; continue with after set to next. The bootstrap key sees all of them, a delegate only the targets where its delegation includes service-account.read; without that the list is empty rather than refused.
Parameters
| Name | In | Type | Required | Rules |
|---|---|---|---|---|
after | query | string (uuid) | no | — |
Response 200
| Field | Type | Required | Rules |
|---|---|---|---|
items | array of object | yes | up to 50 items |
items[].id | string (uuid) | yes | — |
items[].name | string | yes | matches ^[a-zA-Z0-9_.-]{3,64}$ |
items[].enabled | boolean | yes | — |
items[].revision | integer | yes | 1–2147483647 |
items[].bindings | array of object | yes | up to 64 items |
items[].bindings[].resource | object | yes | — |
items[].bindings[].actions | array of string | yes | 1–24 items; no repeated items; each: one of repository.read, storage.read, storage.manage, diagnostics.read, artifact.read, artifact.list, artifact.delete, artifact.promote, content.read, upload.create, upload.read, upload.write, upload.complete, upload.cancel, job.read, package.read, package.publish, asset.read, asset.write, asset.restore, annotation.read, annotation.write, reference.write, audit.read |
items[].createdAt | string (date-time) | yes | — |
next | string (uuid) | yes | may be null |
Responses: 200, 400, 401, 403, 404, 409, 422, 503, 507
Example
curl -X GET "$ARKVORY_URL/api/v1/service-accounts" \
-H "Authorization: Bearer $ARKVORY_TOKEN"Create a service account
POST /api/v1/service-accounts
Access: Bootstrap key (installation recovery key) · Retry: Do not repeat automatically
Creates a machine identity for CI or an application with name (3–64 letters, digits or _.-) and its policy bindings: for each repository, the exact actions its keys may use (such as upload.create or content.read). Answers 201 with the account; then issue a key with issueServiceKey. A taken name is a 409 already_exists.
Request body (application/json)
| Field | Type | Required | Rules |
|---|---|---|---|
name | string | yes | matches ^[a-zA-Z0-9_.-]{3,64}$ |
bindings | array of object | yes | up to 64 items |
bindings[].resource | object | yes | — |
bindings[].resource.kind | string | yes | one of repository |
bindings[].resource.id | string | yes | matches ^[a-z0-9][a-z0-9_-]{0,63}$ |
bindings[].actions | array of string | yes | 1–24 items; no repeated items; each: one of repository.read, storage.read, storage.manage, diagnostics.read, artifact.read, artifact.list, artifact.delete, artifact.promote, content.read, upload.create, upload.read, upload.write, upload.complete, upload.cancel, job.read, package.read, package.publish, asset.read, asset.write, asset.restore, annotation.read, annotation.write, reference.write, audit.read |
Response 201
| Field | Type | Required | Rules |
|---|---|---|---|
id | string (uuid) | yes | — |
name | string | yes | matches ^[a-zA-Z0-9_.-]{3,64}$ |
enabled | boolean | yes | — |
revision | integer | yes | 1–2147483647 |
bindings | array of object | yes | up to 64 items |
bindings[].resource | object | yes | — |
bindings[].resource.kind | string | yes | one of repository |
bindings[].resource.id | string | yes | matches ^[a-z0-9][a-z0-9_-]{0,63}$ |
bindings[].actions | array of string | yes | 1–24 items; no repeated items; each: one of repository.read, storage.read, storage.manage, diagnostics.read, artifact.read, artifact.list, artifact.delete, artifact.promote, content.read, upload.create, upload.read, upload.write, upload.complete, upload.cancel, job.read, package.read, package.publish, asset.read, asset.write, asset.restore, annotation.read, annotation.write, reference.write, audit.read |
createdAt | string (date-time) | yes | — |
Responses: 201, 400, 401, 403, 404, 405, 409, 413, 415, 422, 503, 507
Example
curl -X POST "$ARKVORY_URL/api/v1/service-accounts" \
-H "Authorization: Bearer $ARKVORY_TOKEN" \
-H "Content-Type: application/json" \
-d '{"name":"<name>","bindings":[]}'Get a service account
GET HEAD /api/v1/service-accounts/{id}
Access: Service administration permission service-account.read · Retry: Safe to repeat (read)
Returns the account's name, enabled flag, revision, policy bindings and creation time. For a delegate, an account it was not assigned answers 404 and a missing action on an assigned one 403.
Parameters
| Name | In | Type | Required | Rules |
|---|---|---|---|---|
id | path | string (uuid) | yes | — |
Response 200
| Field | Type | Required | Rules |
|---|---|---|---|
id | string (uuid) | yes | — |
name | string | yes | matches ^[a-zA-Z0-9_.-]{3,64}$ |
enabled | boolean | yes | — |
revision | integer | yes | 1–2147483647 |
bindings | array of object | yes | up to 64 items |
bindings[].resource | object | yes | — |
bindings[].resource.kind | string | yes | one of repository |
bindings[].resource.id | string | yes | matches ^[a-z0-9][a-z0-9_-]{0,63}$ |
bindings[].actions | array of string | yes | 1–24 items; no repeated items; each: one of repository.read, storage.read, storage.manage, diagnostics.read, artifact.read, artifact.list, artifact.delete, artifact.promote, content.read, upload.create, upload.read, upload.write, upload.complete, upload.cancel, job.read, package.read, package.publish, asset.read, asset.write, asset.restore, annotation.read, annotation.write, reference.write, audit.read |
createdAt | string (date-time) | yes | — |
Responses: 200, 400, 401, 403, 404, 409, 422, 503, 507
Example
curl -X GET "$ARKVORY_URL/api/v1/service-accounts/$ID" \
-H "Authorization: Bearer $ARKVORY_TOKEN"Enable or disable a service account
PATCH /api/v1/service-accounts/{id}
Access: Service administration permission service-account.manage · Retry: Repeat only with the expected revision (compare-and-swap)
Sets enabled; expectedRevision must be the current revision, otherwise 409 revision_mismatch. Only this flag changes here (the name cannot). Disabling blocks every key of the account from the next request; enabling restores the keys that are neither expired nor revoked. A delegate may do it only when the whole current policy lies within its ceiling.
Parameters
| Name | In | Type | Required | Rules |
|---|---|---|---|---|
id | path | string (uuid) | yes | — |
Request body (application/json)
| Field | Type | Required | Rules |
|---|---|---|---|
expectedRevision | integer | yes | 1–2147483646 |
enabled | boolean | yes | — |
Response 200
| Field | Type | Required | Rules |
|---|---|---|---|
id | string (uuid) | yes | — |
name | string | yes | matches ^[a-zA-Z0-9_.-]{3,64}$ |
enabled | boolean | yes | — |
revision | integer | yes | 1–2147483647 |
bindings | array of object | yes | up to 64 items |
bindings[].resource | object | yes | — |
bindings[].resource.kind | string | yes | one of repository |
bindings[].resource.id | string | yes | matches ^[a-z0-9][a-z0-9_-]{0,63}$ |
bindings[].actions | array of string | yes | 1–24 items; no repeated items; each: one of repository.read, storage.read, storage.manage, diagnostics.read, artifact.read, artifact.list, artifact.delete, artifact.promote, content.read, upload.create, upload.read, upload.write, upload.complete, upload.cancel, job.read, package.read, package.publish, asset.read, asset.write, asset.restore, annotation.read, annotation.write, reference.write, audit.read |
createdAt | string (date-time) | yes | — |
Responses: 200, 400, 401, 403, 404, 405, 409, 413, 415, 422, 503, 507
Example
curl -X PATCH "$ARKVORY_URL/api/v1/service-accounts/$ID" \
-H "Authorization: Bearer $ARKVORY_TOKEN" \
-H "Content-Type: application/json" \
-d '{"expectedRevision":1,"enabled":false}'Get the policy of a service account
GET HEAD /api/v1/service-accounts/{id}/policy
Access: Service administration permission policy.read · Retry: Safe to repeat (read)
Returns the account with its policy bindings and revision, like getServiceAccount, for a caller that holds policy.read. A key's effective permissions are the intersection of this policy and the key's own bindings, per repository and action.
Parameters
| Name | In | Type | Required | Rules |
|---|---|---|---|---|
id | path | string (uuid) | yes | — |
Response 200
| Field | Type | Required | Rules |
|---|---|---|---|
id | string (uuid) | yes | — |
name | string | yes | matches ^[a-zA-Z0-9_.-]{3,64}$ |
enabled | boolean | yes | — |
revision | integer | yes | 1–2147483647 |
bindings | array of object | yes | up to 64 items |
bindings[].resource | object | yes | — |
bindings[].resource.kind | string | yes | one of repository |
bindings[].resource.id | string | yes | matches ^[a-z0-9][a-z0-9_-]{0,63}$ |
bindings[].actions | array of string | yes | 1–24 items; no repeated items; each: one of repository.read, storage.read, storage.manage, diagnostics.read, artifact.read, artifact.list, artifact.delete, artifact.promote, content.read, upload.create, upload.read, upload.write, upload.complete, upload.cancel, job.read, package.read, package.publish, asset.read, asset.write, asset.restore, annotation.read, annotation.write, reference.write, audit.read |
createdAt | string (date-time) | yes | — |
Responses: 200, 400, 401, 403, 404, 409, 422, 503, 507
Example
curl -X GET "$ARKVORY_URL/api/v1/service-accounts/$ID/policy" \
-H "Authorization: Bearer $ARKVORY_TOKEN"Replace the policy of a service account
PUT /api/v1/service-accounts/{id}/policy
Access: Service administration permission policy.manage · Retry: Repeat only with the expected revision (compare-and-swap)
Replaces the account's bindings (up to 64, each a repository with its exact actions); expectedRevision must be the current revision, otherwise 409 revision_mismatch. Every key follows the change from its next request: narrowing takes effect at once, widening never goes beyond a key's own bindings. A delegate needs both the current and the new policy to lie within its ceiling.
Parameters
| Name | In | Type | Required | Rules |
|---|---|---|---|---|
id | path | string (uuid) | yes | — |
Request body (application/json)
| Field | Type | Required | Rules |
|---|---|---|---|
expectedRevision | integer | yes | 1–2147483646 |
bindings | array of object | yes | up to 64 items |
bindings[].resource | object | yes | — |
bindings[].resource.kind | string | yes | one of repository |
bindings[].resource.id | string | yes | matches ^[a-z0-9][a-z0-9_-]{0,63}$ |
bindings[].actions | array of string | yes | 1–24 items; no repeated items; each: one of repository.read, storage.read, storage.manage, diagnostics.read, artifact.read, artifact.list, artifact.delete, artifact.promote, content.read, upload.create, upload.read, upload.write, upload.complete, upload.cancel, job.read, package.read, package.publish, asset.read, asset.write, asset.restore, annotation.read, annotation.write, reference.write, audit.read |
Response 200
| Field | Type | Required | Rules |
|---|---|---|---|
id | string (uuid) | yes | — |
name | string | yes | matches ^[a-zA-Z0-9_.-]{3,64}$ |
enabled | boolean | yes | — |
revision | integer | yes | 1–2147483647 |
bindings | array of object | yes | up to 64 items |
bindings[].resource | object | yes | — |
bindings[].resource.kind | string | yes | one of repository |
bindings[].resource.id | string | yes | matches ^[a-z0-9][a-z0-9_-]{0,63}$ |
bindings[].actions | array of string | yes | 1–24 items; no repeated items; each: one of repository.read, storage.read, storage.manage, diagnostics.read, artifact.read, artifact.list, artifact.delete, artifact.promote, content.read, upload.create, upload.read, upload.write, upload.complete, upload.cancel, job.read, package.read, package.publish, asset.read, asset.write, asset.restore, annotation.read, annotation.write, reference.write, audit.read |
createdAt | string (date-time) | yes | — |
Responses: 200, 400, 401, 403, 404, 405, 409, 413, 415, 422, 503, 507
Example
curl -X PUT "$ARKVORY_URL/api/v1/service-accounts/$ID/policy" \
-H "Authorization: Bearer $ARKVORY_TOKEN" \
-H "Content-Type: application/json" \
-d '{"expectedRevision":1,"bindings":[]}'List the keys of a service account
GET HEAD /api/v1/service-accounts/{id}/keys
Access: Service administration permission credential.read · Retry: Safe to repeat (read)
Lists key metadata of the account ordered by ID, 50 per page: name, state (pending, active, revoked), bindings, creation, expiry, activation deadline and the key it was rotated from; never secrets or hashes. Continue with after set to next. Expiry does not change state, so compare expiresAt with the current time.
Parameters
| Name | In | Type | Required | Rules |
|---|---|---|---|---|
id | path | string (uuid) | yes | — |
after | query | string (uuid) | no | — |
Response 200
| Field | Type | Required | Rules |
|---|---|---|---|
items | array of object | yes | up to 50 items |
items[].id | string (uuid) | yes | — |
items[].accountId | string (uuid) | yes | — |
items[].name | string | yes | matches ^[a-zA-Z0-9_.-]{3,64}$ |
items[].state | string | yes | one of pending, active, revoked |
items[].bindings | array of object | yes | up to 64 items |
items[].bindings[].resource | object | yes | — |
items[].bindings[].actions | array of string | yes | 1–24 items; no repeated items; each: one of repository.read, storage.read, storage.manage, diagnostics.read, artifact.read, artifact.list, artifact.delete, artifact.promote, content.read, upload.create, upload.read, upload.write, upload.complete, upload.cancel, job.read, package.read, package.publish, asset.read, asset.write, asset.restore, annotation.read, annotation.write, reference.write, audit.read |
items[].createdAt | string (date-time) | yes | — |
items[].expiresAt | string (date-time) | yes | — |
items[].activationExpiresAt | string (date-time) | yes | — |
items[].rotatedFrom | string (uuid) | yes | may be null |
next | string (uuid) | yes | may be null |
Responses: 200, 400, 401, 403, 404, 409, 422, 503, 507
Example
curl -X GET "$ARKVORY_URL/api/v1/service-accounts/$ID/keys" \
-H "Authorization: Bearer $ARKVORY_TOKEN"Issue a key for a service account
POST /api/v1/service-accounts/{id}/keys
Access: Service administration permission credential.manage · Retry: Safe to repeat with the same Idempotency-Key
Issues a pending key with name, bindings (effective only where the account policy allows them too) and optional expiresAt (UTC; 90 days by default, at most 365, and for a delegate never beyond its own key). The first answer is 201 with key and the secret, shown only this once; a repeat with the same Idempotency-Key and body is 200 with the metadata only, a different body a 409. The holder must call activateServiceKey with the secret within 15 minutes; if the secret was lost, revoke the key and issue a new one under a new Idempotency-Key.
Parameters
| Name | In | Type | Required | Rules |
|---|---|---|---|---|
id | path | string (uuid) | yes | — |
Idempotency-Key | header | string | yes | up to 128 characters |
Request body (application/json)
| Field | Type | Required | Rules |
|---|---|---|---|
name | string | yes | matches ^[a-zA-Z0-9_.-]{3,64}$ |
bindings | array of object | yes | up to 64 items |
bindings[].resource | object | yes | — |
bindings[].resource.kind | string | yes | one of repository |
bindings[].resource.id | string | yes | matches ^[a-z0-9][a-z0-9_-]{0,63}$ |
bindings[].actions | array of string | yes | 1–24 items; no repeated items; each: one of repository.read, storage.read, storage.manage, diagnostics.read, artifact.read, artifact.list, artifact.delete, artifact.promote, content.read, upload.create, upload.read, upload.write, upload.complete, upload.cancel, job.read, package.read, package.publish, asset.read, asset.write, asset.restore, annotation.read, annotation.write, reference.write, audit.read |
expiresAt | string (date-time) | no | — |
Response 200
| Field | Type | Required | Rules |
|---|---|---|---|
key | object | yes | — |
key.id | string (uuid) | yes | — |
key.accountId | string (uuid) | yes | — |
key.name | string | yes | matches ^[a-zA-Z0-9_.-]{3,64}$ |
key.state | string | yes | one of pending, active, revoked |
key.bindings | array of object | yes | up to 64 items |
key.bindings[].resource | object | yes | — |
key.bindings[].actions | array of string | yes | 1–24 items; no repeated items; each: one of repository.read, storage.read, storage.manage, diagnostics.read, artifact.read, artifact.list, artifact.delete, artifact.promote, content.read, upload.create, upload.read, upload.write, upload.complete, upload.cancel, job.read, package.read, package.publish, asset.read, asset.write, asset.restore, annotation.read, annotation.write, reference.write, audit.read |
key.createdAt | string (date-time) | yes | — |
key.expiresAt | string (date-time) | yes | — |
key.activationExpiresAt | string (date-time) | yes | — |
key.rotatedFrom | string (uuid) | yes | may be null |
secret | string | no | — |
Responses: 200, 201, 400, 401, 403, 404, 405, 409, 413, 415, 422, 503, 507
Example
curl -X POST "$ARKVORY_URL/api/v1/service-accounts/$ID/keys" \
-H "Authorization: Bearer $ARKVORY_TOKEN" \
-H "Idempotency-Key: $(uuidgen)" \
-H "Content-Type: application/json" \
-d '{"name":"<name>","bindings":[]}'Read the audit of a service account
GET HEAD /api/v1/service-accounts/{id}/audit
Access: Service administration permission service-audit.read · Retry: Safe to repeat (read)
Returns, oldest first, up to 100 events of the account after the sequence after (default 0): account, policy and key changes such as issue, rotation, activation and revocation, each with actor, action, key and time. To read further, pass the last sequence as after; there is no next field. Only the newest 100 000 events of the server are kept.
Parameters
| Name | In | Type | Required | Rules |
|---|---|---|---|---|
id | path | string (uuid) | yes | — |
after | query | string | no | a whole number in decimal digits, sent as a string |
Response 200
| Field | Type | Required | Rules |
|---|---|---|---|
items | array of object | yes | up to 100 items |
items[].sequence | string | yes | — |
items[].actor | string | yes | — |
items[].action | string | yes | — |
items[].accountId | string (uuid) | yes | — |
items[].keyId | string (uuid) | yes | may be null |
items[].occurredAt | string (date-time) | yes | — |
Responses: 200, 400, 401, 403, 404, 409, 422, 503, 507
Example
curl -X GET "$ARKVORY_URL/api/v1/service-accounts/$ID/audit" \
-H "Authorization: Bearer $ARKVORY_TOKEN"Get a key
GET HEAD /api/v1/api-keys/{id}
Access: Service administration permission credential.read · Retry: Safe to repeat (read)
Returns the metadata of one managed key: its account, name, state, bindings, creation, expiry, activation deadline and the key it was rotated from; never the secret or its hash.
Parameters
| Name | In | Type | Required | Rules |
|---|---|---|---|---|
id | path | string (uuid) | yes | — |
Response 200
| Field | Type | Required | Rules |
|---|---|---|---|
id | string (uuid) | yes | — |
accountId | string (uuid) | yes | — |
name | string | yes | matches ^[a-zA-Z0-9_.-]{3,64}$ |
state | string | yes | one of pending, active, revoked |
bindings | array of object | yes | up to 64 items |
bindings[].resource | object | yes | — |
bindings[].resource.kind | string | yes | one of repository |
bindings[].resource.id | string | yes | matches ^[a-z0-9][a-z0-9_-]{0,63}$ |
bindings[].actions | array of string | yes | 1–24 items; no repeated items; each: one of repository.read, storage.read, storage.manage, diagnostics.read, artifact.read, artifact.list, artifact.delete, artifact.promote, content.read, upload.create, upload.read, upload.write, upload.complete, upload.cancel, job.read, package.read, package.publish, asset.read, asset.write, asset.restore, annotation.read, annotation.write, reference.write, audit.read |
createdAt | string (date-time) | yes | — |
expiresAt | string (date-time) | yes | — |
activationExpiresAt | string (date-time) | yes | — |
rotatedFrom | string (uuid) | yes | may be null |
Responses: 200, 400, 401, 403, 404, 409, 422, 503, 507
Example
curl -X GET "$ARKVORY_URL/api/v1/api-keys/$ID" \
-H "Authorization: Bearer $ARKVORY_TOKEN"Rotate a key
POST /api/v1/api-keys/{id}/rotate
Access: Service administration permission credential.manage · Retry: Safe to repeat with the same Idempotency-Key
Issues a pending successor of key id for the same account with the same or narrower bindings, answering like issueServiceKey: 201 with the one-time secret, 200 with metadata only on a repeat with the same Idempotency-Key. Once the successor is activated, the old key stays valid for at most 24 more hours; revoke it explicitly when the new one works, but only after the jobs it started have finished. Delegations held by an operator key are not copied to its successor.
Parameters
| Name | In | Type | Required | Rules |
|---|---|---|---|---|
id | path | string (uuid) | yes | — |
Idempotency-Key | header | string | yes | up to 128 characters |
Request body (application/json)
| Field | Type | Required | Rules |
|---|---|---|---|
name | string | yes | matches ^[a-zA-Z0-9_.-]{3,64}$ |
bindings | array of object | yes | up to 64 items |
bindings[].resource | object | yes | — |
bindings[].resource.kind | string | yes | one of repository |
bindings[].resource.id | string | yes | matches ^[a-z0-9][a-z0-9_-]{0,63}$ |
bindings[].actions | array of string | yes | 1–24 items; no repeated items; each: one of repository.read, storage.read, storage.manage, diagnostics.read, artifact.read, artifact.list, artifact.delete, artifact.promote, content.read, upload.create, upload.read, upload.write, upload.complete, upload.cancel, job.read, package.read, package.publish, asset.read, asset.write, asset.restore, annotation.read, annotation.write, reference.write, audit.read |
expiresAt | string (date-time) | no | — |
Response 200
| Field | Type | Required | Rules |
|---|---|---|---|
key | object | yes | — |
key.id | string (uuid) | yes | — |
key.accountId | string (uuid) | yes | — |
key.name | string | yes | matches ^[a-zA-Z0-9_.-]{3,64}$ |
key.state | string | yes | one of pending, active, revoked |
key.bindings | array of object | yes | up to 64 items |
key.bindings[].resource | object | yes | — |
key.bindings[].actions | array of string | yes | 1–24 items; no repeated items; each: one of repository.read, storage.read, storage.manage, diagnostics.read, artifact.read, artifact.list, artifact.delete, artifact.promote, content.read, upload.create, upload.read, upload.write, upload.complete, upload.cancel, job.read, package.read, package.publish, asset.read, asset.write, asset.restore, annotation.read, annotation.write, reference.write, audit.read |
key.createdAt | string (date-time) | yes | — |
key.expiresAt | string (date-time) | yes | — |
key.activationExpiresAt | string (date-time) | yes | — |
key.rotatedFrom | string (uuid) | yes | may be null |
secret | string | no | — |
Responses: 200, 201, 400, 401, 403, 404, 405, 409, 413, 415, 422, 503, 507
Example
curl -X POST "$ARKVORY_URL/api/v1/api-keys/$ID/rotate" \
-H "Authorization: Bearer $ARKVORY_TOKEN" \
-H "Idempotency-Key: $(uuidgen)" \
-H "Content-Type: application/json" \
-d '{"name":"<name>","bindings":[]}'Revoke a key
POST /api/v1/api-keys/{id}/revoke
Access: Service administration permission credential.manage · Retry: Safe to repeat: the same request has the same effect
Revokes the key for good: its next request fails, while a download already running is not cut off. Repeating succeeds with 204. Keys that a revoked operator key issued and that were already activated stay valid; revoke them separately.
Parameters
| Name | In | Type | Required | Rules |
|---|---|---|---|---|
id | path | string (uuid) | yes | — |
Responses: 204, 400, 401, 403, 404, 405, 409, 422, 503, 507
Example
curl -X POST "$ARKVORY_URL/api/v1/api-keys/$ID/revoke" \
-H "Authorization: Bearer $ARKVORY_TOKEN"Activate a key
POST /api/v1/auth/activate-key
Access: The issued key, before or after activation · Retry: Safe to repeat: the same request has the same effect
Proves that the holder received a newly issued key: call it with that key as Authorization: Bearer within 15 minutes of issue, and the key becomes active (204). Repeating is safe and does not extend the expiry. Activating a rotated key cuts the remaining lifetime of the key it replaces to at most 24 hours.
Responses: 204, 400, 401, 403, 404, 405, 409, 422, 503, 507
Example
curl -X POST "$ARKVORY_URL/api/v1/auth/activate-key" \
-H "Authorization: Bearer $ARKVORY_TOKEN"List the delegations of a key
GET HEAD /api/v1/api-keys/{id}/delegations
Access: Bootstrap key, or the key itself · Retry: Safe to repeat (read)
Returns the delegations held by operator key id, up to 64 including disabled ones: for each target account its revision, whether it is enabled, the administration actions (such as credential.manage) and the ceiling of repository bindings it may hand out. A delegate reads its own here (its key ID is credentialId in getOwnPermissions); another key's list is a 403.
Parameters
| Name | In | Type | Required | Rules |
|---|---|---|---|---|
id | path | string (uuid) | yes | — |
Response 200
| Field | Type | Required | Rules |
|---|---|---|---|
items | array of object | yes | up to 64 items |
items[].keyId | string (uuid) | yes | — |
items[].targetAccountId | string (uuid) | yes | — |
items[].enabled | boolean | yes | — |
items[].revision | integer | yes | 1–2147483647 |
items[].actions | array of string | yes | up to 7 items; no repeated items; each: one of service-account.read, service-account.manage, policy.read, policy.manage, credential.read, credential.manage, service-audit.read |
items[].ceiling | array of object | yes | up to 16 items |
items[].ceiling[].resource | object | yes | — |
items[].ceiling[].actions | array of string | yes | 1–24 items; no repeated items; each: one of repository.read, storage.read, storage.manage, diagnostics.read, artifact.read, artifact.list, artifact.delete, artifact.promote, content.read, upload.create, upload.read, upload.write, upload.complete, upload.cancel, job.read, package.read, package.publish, asset.read, asset.write, asset.restore, annotation.read, annotation.write, reference.write, audit.read |
Responses: 200, 400, 401, 403, 404, 409, 422, 503, 507
Example
curl -X GET "$ARKVORY_URL/api/v1/api-keys/$ID/delegations" \
-H "Authorization: Bearer $ARKVORY_TOKEN"Delegate the administration of a service account
PUT /api/v1/api-keys/{id}/delegations/{accountId}
Access: Bootstrap key (installation recovery key) · Retry: Repeat only with the expected revision (compare-and-swap)
Lets key id administer the service account accountId with the given actions (service-account.read, service-account.manage, policy.read, policy.manage, credential.read, credential.manage, service-audit.read) within ceiling, up to 16 repository bindings it may hand out; manage does not imply read. expectedRevision is 0 to create and the record's current revision to change or re-enable it, otherwise 409. The key must be active and issued by the bootstrap key, and an account cannot both hold delegations and be the target of one, so delegation never chains.
Parameters
| Name | In | Type | Required | Rules |
|---|---|---|---|---|
id | path | string (uuid) | yes | — |
accountId | path | string (uuid) | yes | — |
Request body (application/json)
| Field | Type | Required | Rules |
|---|---|---|---|
expectedRevision | integer | yes | 0–2147483646 |
actions | array of string | yes | 1–7 items; no repeated items; each: one of service-account.read, service-account.manage, policy.read, policy.manage, credential.read, credential.manage, service-audit.read |
ceiling | array of object | yes | up to 16 items |
ceiling[].resource | object | yes | — |
ceiling[].resource.kind | string | yes | one of repository |
ceiling[].resource.id | string | yes | matches ^[a-z0-9][a-z0-9_-]{0,63}$ |
ceiling[].actions | array of string | yes | 1–24 items; no repeated items; each: one of repository.read, storage.read, storage.manage, diagnostics.read, artifact.read, artifact.list, artifact.delete, artifact.promote, content.read, upload.create, upload.read, upload.write, upload.complete, upload.cancel, job.read, package.read, package.publish, asset.read, asset.write, asset.restore, annotation.read, annotation.write, reference.write, audit.read |
Response 200
| Field | Type | Required | Rules |
|---|---|---|---|
keyId | string (uuid) | yes | — |
targetAccountId | string (uuid) | yes | — |
enabled | boolean | yes | — |
revision | integer | yes | 1–2147483647 |
actions | array of string | yes | up to 7 items; no repeated items; each: one of service-account.read, service-account.manage, policy.read, policy.manage, credential.read, credential.manage, service-audit.read |
ceiling | array of object | yes | up to 16 items |
ceiling[].resource | object | yes | — |
ceiling[].resource.kind | string | yes | one of repository |
ceiling[].resource.id | string | yes | matches ^[a-z0-9][a-z0-9_-]{0,63}$ |
ceiling[].actions | array of string | yes | 1–24 items; no repeated items; each: one of repository.read, storage.read, storage.manage, diagnostics.read, artifact.read, artifact.list, artifact.delete, artifact.promote, content.read, upload.create, upload.read, upload.write, upload.complete, upload.cancel, job.read, package.read, package.publish, asset.read, asset.write, asset.restore, annotation.read, annotation.write, reference.write, audit.read |
Responses: 200, 400, 401, 403, 404, 405, 409, 413, 415, 422, 503, 507
Example
curl -X PUT "$ARKVORY_URL/api/v1/api-keys/$ID/delegations/$ACCOUNTID" \
-H "Authorization: Bearer $ARKVORY_TOKEN" \
-H "Content-Type: application/json" \
-d '{"expectedRevision":0,"actions":["service-account.read"],"ceiling":[]}'Withdraw a delegation
DELETE /api/v1/api-keys/{id}/delegations/{accountId}
Access: Bootstrap key (installation recovery key) · Retry: Repeat only with the expected revision (compare-and-swap)
Disables the delegation of key id over accountId; the JSON body carries expectedRevision, the record's current revision. The record stays as a disabled entry without actions and with a higher revision, returned with 200; after a lost answer read it with listServiceDelegations instead of repeating, since the old revision is a 409. Keys the delegate already issued and activated keep working: revoke them or disable the account separately.
Parameters
| Name | In | Type | Required | Rules |
|---|---|---|---|---|
id | path | string (uuid) | yes | — |
accountId | path | string (uuid) | yes | — |
Request body (application/json)
| Field | Type | Required | Rules |
|---|---|---|---|
expectedRevision | integer | yes | 1–2147483646 |
Response 200
| Field | Type | Required | Rules |
|---|---|---|---|
keyId | string (uuid) | yes | — |
targetAccountId | string (uuid) | yes | — |
enabled | boolean | yes | — |
revision | integer | yes | 1–2147483647 |
actions | array of string | yes | up to 7 items; no repeated items; each: one of service-account.read, service-account.manage, policy.read, policy.manage, credential.read, credential.manage, service-audit.read |
ceiling | array of object | yes | up to 16 items |
ceiling[].resource | object | yes | — |
ceiling[].resource.kind | string | yes | one of repository |
ceiling[].resource.id | string | yes | matches ^[a-z0-9][a-z0-9_-]{0,63}$ |
ceiling[].actions | array of string | yes | 1–24 items; no repeated items; each: one of repository.read, storage.read, storage.manage, diagnostics.read, artifact.read, artifact.list, artifact.delete, artifact.promote, content.read, upload.create, upload.read, upload.write, upload.complete, upload.cancel, job.read, package.read, package.publish, asset.read, asset.write, asset.restore, annotation.read, annotation.write, reference.write, audit.read |
Responses: 200, 400, 401, 403, 404, 405, 409, 413, 415, 422, 503, 507
Example
curl -X DELETE "$ARKVORY_URL/api/v1/api-keys/$ID/delegations/$ACCOUNTID" \
-H "Authorization: Bearer $ARKVORY_TOKEN" \
-H "Content-Type: application/json" \
-d '{"expectedRevision":1}'