FruxonDocs
UsersAPI Access

List service accounts.

Returns every service account in the tenant, newest-first. Secrets are never included — a service account's credentials are ordinary API keys minted through the provision / rotate endpoints, and the plaintext is shown only once at mint time.

GET
/v1/tenants/{tenant}/serviceAccounts

Authorization

Bearer
AuthorizationBearer <token>

JWT Authorization header using the Bearer scheme. Enter 'Bearer' [space] and then your token.

In: header

Path Parameters

tenant*string

The tenant identifier

Query Parameters

PageSize?integer

The maximum number of items to return per page

Formatint32
PageToken.Skip?integer
Formatint32
PageToken.Cursor?string

Opaque cursor token from an external system (e.g. RAG API). When set, M:Fruxon.Common.Collections.PageToken.AsString returns this value directly instead of encoding Fruxon.Common.Collections.PageToken.Skip.

includeSystem?boolean

When true, also returns platform-managed system accounts (owners of inbound webhook / MCP keys). They are read-only — cannot be rotated or revoked — and are hidden by default.

Defaultfalse

Response Body

curl -X GET "https://api.fruxon.com/v1/tenants/string/serviceAccounts"
{
  "items": [
    {
      "id": "00000000-0000-0000-0000-000000000000",
      "name": "string",
      "description": "string",
      "scopes": [
        "string"
      ],
      "isActive": false,
      "createdBy": "string",
      "createdAt": 0,
      "modifiedAt": 0,
      "revokedAt": 0,
      "networkId": "00000000-0000-0000-0000-000000000000",
      "defaultEnvironmentSlug": "string",
      "systemPurpose": "INBOUND_DELIVERY",
      "isSystem": false
    }
  ],
  "nextPageToken": "string",
  "totalCount": 0
}
Empty
{
  "type": "string",
  "title": "string",
  "status": 0,
  "detail": "string",
  "instance": "string",
  "property1": null,
  "property2": null
}
{
  "type": "string",
  "title": "string",
  "status": 0,
  "detail": "string",
  "instance": "string",
  "property1": null,
  "property2": null
}

Handles an inbound webhook call authenticated via HMAC signature verification

Variant of `POST WebhookInbound` for providers that sign payloads (Stripe, GitHub, Slack, etc.) — the route does not act as a credential, and instead the provider-specific signature header is verified against the secret stored on the webhook. A failed verification returns 401; a successful one dispatches to subscribers identically to the API-key flow, returning the provider's expected ack body or 204. Anonymous endpoint, since the signature is the authentication.

List a service account's request activity.

Returns the per-request usage stream — which endpoints the account called, when, and with what status — aggregated across every key the account owns, newest-first. Distinct from `/auditEvents`, which is the principal's security lifecycle (provision / rotate / revoke). This is high-volume, hence cursor pagination. Mirrors `/tokens/{id}/activity`, the per-key view a personal access token uses; a service account is a principal that can own several keys, so its activity is the union across them.