> ## Documentation Index
> Fetch the complete documentation index at: https://docs.entire.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create service account secret

> <Badge color="blue" size="sm" shape="pill">Users</Badge>

**Accepted credentials:** User token.

Returns the secret once. Exchange it at /oauth/token for a short-lived service account token. Only a person's own login session can create a secret. Any other token returns 403. A request to a region other than the service account's home region returns 421 with the home region's URL.



## OpenAPI

````yaml /openapi/core.json post /service-accounts/{accountId}/secrets
openapi: 3.1.0
info:
  description: >-
    Entire control plane: identity, orgs, projects, repos, mirrors, service
    accounts.
  title: Entire Core API
  version: 1.0.0
servers:
  - url: https://us.console.entire.io/api/v1
security: []
tags:
  - name: identity
    x-group: Account
  - name: orgs
    x-group: Organizations
  - name: projects
    x-group: Projects
  - name: repos
    x-group: Repositories
  - name: clusters
    x-group: Clusters
  - name: service-accounts
    x-group: Service accounts
paths:
  /service-accounts/{accountId}/secrets:
    post:
      tags:
        - service-accounts
      summary: Create service account secret
      description: >-
        <Badge color="blue" size="sm" shape="pill">Users</Badge>


        **Accepted credentials:** User token.


        Returns the secret once. Exchange it at /oauth/token for a short-lived
        service account token. Only a person's own login session can create a
        secret. Any other token returns 403. A request to a region other than
        the service account's home region returns 421 with the home region's
        URL.
      operationId: createServiceAccountSecret
      parameters:
        - in: path
          name: accountId
          required: true
          schema:
            minLength: 1
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateServiceAccountSecretBody'
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateServiceAccountSecretOutputBody'
          description: Created
        '400':
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ErrorModel'
          description: Bad Request
        '401':
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ErrorModel'
          description: Unauthorized
        '403':
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ErrorModel'
          description: Forbidden
        '404':
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ErrorModel'
          description: Not Found
        '409':
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ErrorModel'
          description: Conflict
        '421':
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ErrorModel'
          description: Misdirected Request
        '422':
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ErrorModel'
          description: Unprocessable Entity
        '500':
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ErrorModel'
          description: Internal Server Error
        '503':
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ErrorModel'
          description: Service Unavailable
      security:
        - oauth2: []
        - oidc: []
        - bearerAuth: []
        - sessionAuth: []
components:
  schemas:
    CreateServiceAccountSecretBody:
      additionalProperties: true
      properties:
        $schema:
          description: A URL to the JSON Schema for this object.
          examples:
            - /api/v1/schemas/CreateServiceAccountSecretBody.json
          format: uri
          readOnly: true
          type: string
        expires_in_days:
          description: Lifetime in days. Defaults to 90.
          format: int64
          maximum: 365
          minimum: 1
          type: integer
      type: object
    CreateServiceAccountSecretOutputBody:
      additionalProperties: true
      properties:
        $schema:
          description: A URL to the JSON Schema for this object.
          examples:
            - /api/v1/schemas/CreateServiceAccountSecretOutputBody.json
          format: uri
          readOnly: true
          type: string
        account_id:
          type: string
        created_at:
          format: date-time
          type: string
        created_by:
          description: Empty once the creator's account is erased.
          type: string
        expires_at:
          format: date-time
          type: string
        id:
          type: string
        last_used_at:
          description: Last exchange, to the minute.
          format: date-time
          type: string
        last_used_user_agent:
          description: User-Agent of the last exchange.
          type: string
        secret:
          description: 'The secret. Store it now: it is not shown again.'
          type: string
      required:
        - secret
        - id
        - account_id
        - created_at
        - expires_at
      type: object
    ErrorModel:
      additionalProperties: true
      properties:
        $schema:
          description: A URL to the JSON Schema for this object.
          examples:
            - /api/v1/schemas/ErrorModel.json
          format: uri
          readOnly: true
          type: string
        detail:
          description: >-
            A human-readable explanation specific to this occurrence of the
            problem.
          examples:
            - Property foo is required but is missing.
          type: string
        errors:
          description: Optional list of individual error details
          items:
            $ref: '#/components/schemas/ErrorDetail'
          type: array
        instance:
          description: >-
            A URI reference that identifies the specific occurrence of the
            problem.
          examples:
            - https://example.com/error-log/abc123
          format: uri
          type: string
        status:
          description: HTTP status code
          examples:
            - 400
          format: int64
          type: integer
        title:
          description: >-
            A short, human-readable summary of the problem type. This value
            should not change between occurrences of the error.
          examples:
            - Bad Request
          type: string
        type:
          default: about:blank
          description: A URI reference to human-readable documentation for the error.
          examples:
            - https://example.com/errors/example
          format: uri
          type: string
      type: object
    ErrorDetail:
      additionalProperties: true
      properties:
        location:
          description: >-
            Where the error occurred, e.g. 'body.items[3].tags' or
            'path.thing-id'
          type: string
        message:
          description: Error message text
          type: string
        value:
          description: The value at the given location
      type: object
  securitySchemes:
    oauth2:
      description: >-
        Authorization code flow with PKCE-S256. RFC 8628 device flow is also
        supported.
      flows:
        authorizationCode:
          authorizationUrl: /authorize
          scopes:
            offline_access: Request a refresh token.
            openid: Authenticate using OpenID Connect.
          tokenUrl: /oauth/token
      type: oauth2
    oidc:
      description: OpenID Connect discovery for browser and RFC 8628 device authentication.
      openIdConnectUrl: /.well-known/openid-configuration
      type: openIdConnect
    bearerAuth:
      bearerFormat: JWT
      description: Bearer access token.
      scheme: bearer
      type: http
    sessionAuth:
      description: Console session cookie issued by the browser login flow.
      in: cookie
      name: entire_session
      type: apiKey

````