Skip to main content

list-service-accounts 

dci list-service-accounts

Returns every service account owned by the authenticated customer in a single unpaginated items array, in no guaranteed order. Requires the serviceAccountViewer permission.

A service account is a non-human identity; its API tokens authenticate with exactly the permissions listed on the account. Requires the serviceAccountViewer permission. The whole list comes back in one response, in no guaranteed order, so there is no paging.

Examples​

# The service accounts your organization owns, with their permissions.
dci list-service-accounts
# Just the IDs and names, to pick a `<service-account-id>`.
dci list-service-accounts --fields id,name --output json
# Everything as JSON, for scripts.
dci list-service-accounts --output json

Output​

OK - Service accounts returned.

By default dci renders the result as a table. Use --output json to get the full structure described below — see Output formats.

FieldTypeDescription
itemsarray of object
items[].idstringService account ID. null only on a dry-run create.
items[].customerIdstringID of the customer that owns the service account.
items[].namestringName, unique among the customer's service accounts.
items[].descriptionstringFree-text description.
items[].permissionsarray of stringPlatform permission names in camelCase, as shown in the DoiT console role editor.
items[].createdBystringDisplay name of the user who created the service account. null when unknown or when the service account was created with a service account token.
items[].createdByEmailstringEmail of the user who created the service account. null when unknown or when the service account was created with a service account token.
items[].createdByUserIdstringID of the user who created the service account. null when unknown or when the service account was created with a service account token.
items[].createTimestring (date-time)When the service account was created.
items[].updateTimestring (date-time)When the service account was last changed.
items[].etagstringCurrent version of the service account. Send it in If-Match to update or delete.

Example response (--output json)​

{
  "items": [
    {
      "id": "Lq3nO9rM5wS2tU0xY4zA",
      "customerId": "Kp2mN8qL4vR0sT1wX3yZ",
      "name": "terraform-ci",
      "description": "Manages DoiT resources from CI",
      "permissions": [
        "cloudAnalyticsReadOnly",
        "budgetsManager"
      ],
      "createdBy": "Jane Doe",
      "createdByEmail": "[email protected]",
      "createdByUserId": "Ab1cD2eF3gH4iJ5kL6mN",
      "createTime": "2026-09-01T08:00:00Z",
      "updateTime": "2026-09-01T08:00:00Z",
      "etag": "3f7a1c9e2b4d6f8a0c1e3a5b7d9f1b3d5f7a9c1e3b5d7f9a1c3e5b7d9f1a3c5e"
    }
  ]
}
Raw JSON schema
{
  "type": "object",
  "description": "Service accounts owned by the authenticated customer.",
  "required": [
    "items"
  ],
  "properties": {
    "items": {
      "type": "array",
      "items": {
        "type": "object",
        "description": "A non-human identity owned by a customer. Its API tokens authenticate with exactly the permissions listed here.",
        "required": [
          "id",
          "customerId",
          "name",
          "description",
          "permissions",
          "createdBy",
          "createdByEmail",
          "createdByUserId",
          "createTime",
          "updateTime",
          "etag"
        ],
        "properties": {
          "id": {
            "type": "string",
            "nullable": true,
            "readOnly": true,
            "description": "Service account ID. `null` only on a dry-run create.",
            "example": "Lq3nO9rM5wS2tU0xY4zA"
          },
          "customerId": {
            "type": "string",
            "readOnly": true,
            "description": "ID of the customer that owns the service account.",
            "example": "Kp2mN8qL4vR0sT1wX3yZ"
          },
          "name": {
            "type": "string",
            "description": "Name, unique among the customer's service accounts."
          },
          "description": {
            "type": "string",
            "description": "Free-text description."
          },
          "permissions": {
            "type": "array",
            "description": "Platform permission names in camelCase, as shown in the DoiT console role editor.",
            "items": {
              "type": "string"
            }
          },
          "createdBy": {
            "type": "string",
            "nullable": true,
            "readOnly": true,
            "description": "Display name of the user who created the service account. `null` when unknown or when the service account was created with a service account token."
          },
          "createdByEmail": {
            "type": "string",
            "nullable": true,
            "readOnly": true,
            "description": "Email of the user who created the service account. `null` when unknown or when the service account was created with a service account token."
          },
          "createdByUserId": {
            "type": "string",
            "nullable": true,
            "readOnly": true,
            "description": "ID of the user who created the service account. `null` when unknown or when the service account was created with a service account token."
          },
          "createTime": {
            "type": "string",
            "format": "date-time",
            "nullable": true,
            "readOnly": true,
            "description": "When the service account was created."
          },
          "updateTime": {
            "type": "string",
            "format": "date-time",
            "nullable": true,
            "readOnly": true,
            "description": "When the service account was last changed."
          },
          "etag": {
            "type": "string",
            "nullable": true,
            "readOnly": true,
            "description": "Current version of the service account. Send it in `If-Match` to update or delete."
          }
        }
      }
    }
  }
}

Errors​

On failure, dci prints a single error message — with a hint when one is available — and exits with a typed code your scripts can branch on. See Errors and exit codes for the full contract.

HTTP status to exit code mapping
HTTP statusExit codeError codeMeaning
40110AUTHENTICATION_FAILEDNot signed in, or the API token is invalid. Run dci login or check DCI_API_KEY.
40311PERMISSION_DENIEDThe DoiT user or the active customer context does not have access.
50040API_SERVER_ERRORThe API failed to process the request. Retryable; contact DoiT support if it persists.

Aliases: listserviceaccounts