Disable a service account credential

You can disable individual credentials without affecting the service account or its other credentials.

Before you begin

A service account exists with at least one credential.
You have the service_account:disable permission to disable a credential, or the service_account:enable permission to re-enable one. Project administrators have both permissions.
You know the service account ID and the credential ID. To find these values, list the credentials for the service account:
```
$ curl -H "Authorization: Bearer access_token" \
    https://orchestrator_host/api/v1/service_accounts/service_account_id/credentials
```

About this task

Use this option when you need to revoke a specific credential, such as one that was exposed in a log file, while keeping the service account operational with its remaining credentials.

Procedure

Send a POST request to the credential disable endpoint:
```
$ curl -X POST \
    -H "Authorization: Bearer access_token" \
    https://orchestrator_host/api/v1/service_accounts/service_account_id/credentials/credential_id/disable
```
Where:
- access_token is your personal access token or session token.
- service_account_id is the UUID of the service account.
- credential_id is the UUID of the credential to disable.
- orchestrator_host is the hostname of your automation orchestrator instance.

Verify the credential status:

$ curl -H "Authorization: Bearer access_token" \
    https://orchestrator_host/api/v1/service_accounts/service_account_id/credentials/credential_id

The response shows "status": "disabled".

Results

When you disable a credential:

Authentication attempts with that credential's client ID and secret are rejected.
Existing tokens issued by the disabled credential are immediately rejected.
Other credentials for the same service account are not affected.
The service account can still authenticate with its remaining active credentials.

Re-enable a disabled service account credential

You can re-enable a disabled credential to restore its ability to authenticate.

Before you begin

A service account exists in the target project with at least one credential that has a status of disabled.
You have the service_account:enable permission, or you are a project administrator.

Procedure

Send a POST request to the credential enable endpoint:
```
$ curl -X POST \
    -H "Authorization: Bearer access_token" \
    https://orchestrator_host/api/v1/service_accounts/service_account_id/credentials/credential_id/enable
```
Where:
- access_token is your personal access token or session token.
- service_account_id is the UUID of the service account.
- credential_id is the UUID of the credential to re-enable.
- orchestrator_host is the hostname of your automation orchestrator instance.
Verify the response shows "status": "active".

Note:

Tokens that were issued before the credential was disabled remain invalid. The external system must request a new token after the credential is re-enabled.