get-service-account

dci get-service-account

Returns a service account owned by the authenticated customer; an ID that belongs to another customer returns 404. The ETag response header carries the value to send in If-Match on update and delete. Requires the serviceAccountViewer permission.

Output

OK - Service account returned.

By default dci renders the result as a table. Use --output json to get the full structure described below — see Output formats.

Field	Type	Description
id	string	Service account ID. null only on a dry-run create.
customerId	string	ID of the customer that owns the service account.
name	string	Name, unique among the customer's service accounts.
description	string	Free-text description.
permissions	array of string	Platform permission names in camelCase, as shown in the DoiT console role editor.
createdBy	string	Display name of the user who created the service account. null when unknown or when the service account was created with a service account token.
createdByEmail	string	Email of the user who created the service account. null when unknown or when the service account was created with a service account token.
createdByUserId	string	ID of the user who created the service account. null when unknown or when the service account was created with a service account token.
createTime	string (date-time)	When the service account was created.
updateTime	string (date-time)	When the service account was last changed.
etag	string	Current version of the service account. Send it in If-Match to update or delete.

Example response (--output json)

{
  "id": "Lq3nO9rM5wS2tU0xY4zA",
  "customerId": "Kp2mN8qL4vR0sT1wX3yZ",
  "name": "terraform-ci",
  "description": "Manages DoiT resources from CI",
  "permissions": [
    "cloudAnalyticsReadOnly",
    "budgetsManager"
  ],
  "createdBy": "Jane Doe",
  "createdByEmail": "[email protected]",
  "createdByUserId": "Ab1cD2eF3gH4iJ5kL6mN",
  "createTime": "2026-09-01T08:00:00Z",
  "updateTime": "2026-09-01T08:00:00Z",
  "etag": "3f7a1c9e2b4d6f8a0c1e3a5b7d9f1b3d5f7a9c1e3b5d7f9a1c3e5b7d9f1a3c5e"
}

Raw JSON schema

{
  "type": "object",
  "description": "A non-human identity owned by a customer. Its API tokens authenticate with exactly the permissions listed here.",
  "required": [
    "id",
    "customerId",
    "name",
    "description",
    "permissions",
    "createdBy",
    "createdByEmail",
    "createdByUserId",
    "createTime",
    "updateTime",
    "etag"
  ],
  "properties": {
    "id": {
      "type": "string",
      "nullable": true,
      "readOnly": true,
      "description": "Service account ID. `null` only on a dry-run create.",
      "example": "Lq3nO9rM5wS2tU0xY4zA"
    },
    "customerId": {
      "type": "string",
      "readOnly": true,
      "description": "ID of the customer that owns the service account.",
      "example": "Kp2mN8qL4vR0sT1wX3yZ"
    },
    "name": {
      "type": "string",
      "description": "Name, unique among the customer's service accounts."
    },
    "description": {
      "type": "string",
      "description": "Free-text description."
    },
    "permissions": {
      "type": "array",
      "description": "Platform permission names in camelCase, as shown in the DoiT console role editor.",
      "items": {
        "type": "string"
      }
    },
    "createdBy": {
      "type": "string",
      "nullable": true,
      "readOnly": true,
      "description": "Display name of the user who created the service account. `null` when unknown or when the service account was created with a service account token."
    },
    "createdByEmail": {
      "type": "string",
      "nullable": true,
      "readOnly": true,
      "description": "Email of the user who created the service account. `null` when unknown or when the service account was created with a service account token."
    },
    "createdByUserId": {
      "type": "string",
      "nullable": true,
      "readOnly": true,
      "description": "ID of the user who created the service account. `null` when unknown or when the service account was created with a service account token."
    },
    "createTime": {
      "type": "string",
      "format": "date-time",
      "nullable": true,
      "readOnly": true,
      "description": "When the service account was created."
    },
    "updateTime": {
      "type": "string",
      "format": "date-time",
      "nullable": true,
      "readOnly": true,
      "description": "When the service account was last changed."
    },
    "etag": {
      "type": "string",
      "nullable": true,
      "readOnly": true,
      "description": "Current version of the service account. Send it in `If-Match` to update or delete."
    }
  }
}

Errors

On failure, dci prints a single error message — with a hint when one is available — and exits with a typed code your scripts can branch on. See Errors and exit codes for the full contract.

HTTP status to exit code mapping

HTTP status	Exit code	Error code	Meaning
400	30	VALIDATION_ERROR	The arguments or request body were rejected. Review the command's flags and payload.
401	10	AUTHENTICATION_FAILED	Not signed in, or the API token is invalid. Run dci login or check DCI_API_KEY.
403	11	PERMISSION_DENIED	The DoiT user or the active customer context does not have access.
404	20	RESOURCE_NOT_FOUND	The requested resource does not exist. Check the identifier argument.
500	40	API_SERVER_ERROR	The API failed to process the request. Retryable; contact DoiT support if it persists.

Related

• create-service-account — Create a service account
• delete-service-account — Delete a service account
• list-service-accounts — List service accounts
• update-service-account — Update a service account
• API reference: GET /iam/v1/service-accounts/{id}

Aliases: getserviceaccount