Disable a service account

You can disable a service account to temporarily prevent it from authenticating.

Before you begin

A service account exists in the target project.
You have the service_account:disable permission, or you are a project administrator.

About this task

Use this option when you need to temporarily revoke access, such as during a security investigation or while an integration is offline for maintenance.

To identify service accounts that are no longer in use, check the last_authenticated_at field in the service account detail response. A null value indicates that the service account has never authenticated.

Procedure

Send a POST request to the disable endpoint:
```
$ curl -X POST \
    -H "Authorization: Bearer access_token" \
    https://orchestrator_host/api/v1/service_accounts/service_account_id/disable
```
Where:
- access_token is your personal access token or session token.
- service_account_id is the UUID of the service account.
- orchestrator_host is the hostname of your automation orchestrator instance.

Verify the status change:

$ curl -H "Authorization: Bearer access_token" \
    https://orchestrator_host/api/v1/service_accounts/service_account_id

The response shows "status": "disabled".

Results

When you disable a service account:

All tokens previously issued to the service account are immediately rejected.
The service account cannot request new tokens.
The service account's credentials and role assignments are preserved.

Re-enable a disabled service account

You can re-enable a disabled service account to restore its ability to authenticate.

Before you begin

A service account exists in the target project and has a status of disabled.
You have the service_account:enable permission, or you are a project administrator.

Procedure

Send a POST request to the enable endpoint:
```
$ curl -X POST \
    -H "Authorization: Bearer access_token" \
    https://orchestrator_host/api/v1/service_accounts/service_account_id/enable
```
Where:
- access_token is your personal access token or session token.
- service_account_id is the UUID of the service account.
- orchestrator_host is the hostname of your automation orchestrator instance.
Verify the response shows "status": "active".

Note:

Tokens that were issued before the service account was disabled remain invalid. The external system must request a new token after the service account is re-enabled.