Skip to main content

list-service-accounts 

dci list-service-accounts

Returns every service account owned by the authenticated customer in a single unpaginated items array, in no guaranteed order. Requires the serviceAccountViewer permission.

Output​

OK - Service accounts returned.

By default dci renders the result as a table. Use --output json to get the full structure described below — see Output formats.

FieldTypeDescription
itemsarray of object
items[].idstringService account ID. null only on a dry-run create.
items[].customerIdstringID of the customer that owns the service account.
items[].namestringName, unique among the customer's service accounts.
items[].descriptionstringFree-text description.
items[].permissionsarray of stringPlatform permission names in camelCase, as shown in the DoiT console role editor.
items[].createdBystringDisplay name of the user who created the service account. null when unknown or when the service account was created with a service account token.
items[].createdByEmailstringEmail of the user who created the service account. null when unknown or when the service account was created with a service account token.
items[].createdByUserIdstringID of the user who created the service account. null when unknown or when the service account was created with a service account token.
items[].createTimestring (date-time)When the service account was created.
items[].updateTimestring (date-time)When the service account was last changed.
items[].etagstringCurrent version of the service account. Send it in If-Match to update or delete.

Example response (--output json)​

{
  "items": [
    {
      "id": "Lq3nO9rM5wS2tU0xY4zA",
      "customerId": "Kp2mN8qL4vR0sT1wX3yZ",
      "name": "terraform-ci",
      "description": "Manages DoiT resources from CI",
      "permissions": [
        "cloudAnalyticsReadOnly",
        "budgetsManager"
      ],
      "createdBy": "Jane Doe",
      "createdByEmail": "[email protected]",
      "createdByUserId": "Ab1cD2eF3gH4iJ5kL6mN",
      "createTime": "2026-09-01T08:00:00Z",
      "updateTime": "2026-09-01T08:00:00Z",
      "etag": "3f7a1c9e2b4d6f8a0c1e3a5b7d9f1b3d5f7a9c1e3b5d7f9a1c3e5b7d9f1a3c5e"
    }
  ]
}
Raw JSON schema
{
  "type": "object",
  "description": "Service accounts owned by the authenticated customer.",
  "required": [
    "items"
  ],
  "properties": {
    "items": {
      "type": "array",
      "items": {
        "type": "object",
        "description": "A non-human identity owned by a customer. Its API tokens authenticate with exactly the permissions listed here.",
        "required": [
          "id",
          "customerId",
          "name",
          "description",
          "permissions",
          "createdBy",
          "createdByEmail",
          "createdByUserId",
          "createTime",
          "updateTime",
          "etag"
        ],
        "properties": {
          "id": {
            "type": "string",
            "nullable": true,
            "readOnly": true,
            "description": "Service account ID. `null` only on a dry-run create.",
            "example": "Lq3nO9rM5wS2tU0xY4zA"
          },
          "customerId": {
            "type": "string",
            "readOnly": true,
            "description": "ID of the customer that owns the service account.",
            "example": "Kp2mN8qL4vR0sT1wX3yZ"
          },
          "name": {
            "type": "string",
            "description": "Name, unique among the customer's service accounts."
          },
          "description": {
            "type": "string",
            "description": "Free-text description."
          },
          "permissions": {
            "type": "array",
            "description": "Platform permission names in camelCase, as shown in the DoiT console role editor.",
            "items": {
              "type": "string"
            }
          },
          "createdBy": {
            "type": "string",
            "nullable": true,
            "readOnly": true,
            "description": "Display name of the user who created the service account. `null` when unknown or when the service account was created with a service account token."
          },
          "createdByEmail": {
            "type": "string",
            "nullable": true,
            "readOnly": true,
            "description": "Email of the user who created the service account. `null` when unknown or when the service account was created with a service account token."
          },
          "createdByUserId": {
            "type": "string",
            "nullable": true,
            "readOnly": true,
            "description": "ID of the user who created the service account. `null` when unknown or when the service account was created with a service account token."
          },
          "createTime": {
            "type": "string",
            "format": "date-time",
            "nullable": true,
            "readOnly": true,
            "description": "When the service account was created."
          },
          "updateTime": {
            "type": "string",
            "format": "date-time",
            "nullable": true,
            "readOnly": true,
            "description": "When the service account was last changed."
          },
          "etag": {
            "type": "string",
            "nullable": true,
            "readOnly": true,
            "description": "Current version of the service account. Send it in `If-Match` to update or delete."
          }
        }
      }
    }
  }
}

Errors​

On failure, dci prints a single error message — with a hint when one is available — and exits with a typed code your scripts can branch on. See Errors and exit codes for the full contract.

HTTP status to exit code mapping
HTTP statusExit codeError codeMeaning
40110AUTHENTICATION_FAILEDNot signed in, or the API token is invalid. Run dci login or check DCI_API_KEY.
40311PERMISSION_DENIEDThe DoiT user or the active customer context does not have access.
50040API_SERVER_ERRORThe API failed to process the request. Retryable; contact DoiT support if it persists.

Aliases: listserviceaccounts