Identify unused service accounts

You can identify service accounts that are no longer in use by checking the last_authenticated_at field.

Before you begin

You have the service_account:read permission in the target project, or you are a project administrator.

About this task

Regularly reviewing unused service accounts reduces the attack surface of your automation orchestrator deployment. You can disable or delete service accounts that have never authenticated or have not authenticated recently.

Procedure

List the service accounts in your project:
```
$ curl -H "Authorization: Bearer access_token" \
    https://orchestrator_host/api/v1/service_accounts
```
Where:
- access_token is your personal access token or session token.
- orchestrator_host is the hostname of your automation orchestrator instance.
Review the last_authenticated_at field for each service account in the response:
```
{
  "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "name": "CI Pipeline",
  "status": "active",
  "last_authenticated_at": null,
  "created_at": "2026-03-15T10:00:00Z"
}
```
- A null value indicates that the service account has never authenticated.
- A timestamp that predates your organization's activity threshold indicates that the service account is no longer in active use.
For each unused service account, decide on the appropriate action:
- Disable the service account if the associated integration might be reactivated.
- Delete the service account if the associated integration has been decommissioned.