FruxonDocs
UsersAPI Access

List service accounts.

Returns every service account in the tenant, newest-first. Secrets are never included — a service account's credentials are ordinary API keys minted through the provision / rotate endpoints, and the plaintext is shown only once at mint time. Each account says how many of its keys still authenticate (`activeKeyCount`) and when the soonest of them expires (`activeKeyExpiresAt`).

GET
/v1/tenants/{tenant}/serviceAccounts

Authorization

Bearer
AuthorizationBearer <token>

JWT Authorization header using the Bearer scheme. Enter 'Bearer' [space] and then your token.

In: header

Path Parameters

tenant*string

The tenant identifier

Query Parameters

PageSize?integer

The maximum number of items to return per page

Formatint32
PageToken.Skip?integer
Formatint32
PageToken.Cursor?string

Opaque pagination token returned by an external service. Pass it back unchanged rather than interpreting it as an offset.

includeSystem?boolean

When true, also returns platform-managed system accounts (owners of inbound webhook / MCP keys). They are read-only — cannot be rotated or revoked — and are hidden by default.

Defaultfalse

Response Body

curl -X GET "https://api.fruxon.com/v1/tenants/string/serviceAccounts"
{
  "items": [
    {
      "id": "00000000-0000-0000-0000-000000000000",
      "name": "string",
      "description": "string",
      "scopes": [
        "string"
      ],
      "isActive": false,
      "createdBy": "string",
      "createdAt": 0,
      "modifiedAt": 0,
      "revokedAt": 0,
      "networkId": "00000000-0000-0000-0000-000000000000",
      "defaultEnvironmentSlug": "string",
      "systemPurpose": "INBOUND_DELIVERY",
      "isSystem": false,
      "activeKeyCount": 0,
      "activeKeyExpiresAt": 0
    }
  ],
  "nextPageToken": "string",
  "totalCount": 0
}
Empty
{
  "type": "string",
  "title": "string",
  "status": 0,
  "detail": "string",
  "instance": "string",
  "property1": null,
  "property2": null
}
{
  "type": "string",
  "title": "string",
  "status": 0,
  "detail": "string",
  "instance": "string",
  "property1": null,
  "property2": null
}

Handles an inbound webhook call authenticated via HMAC signature verification

Variant of `POST WebhookInbound` for providers that sign payloads (Stripe, GitHub, Slack, etc.) — the route does not act as a credential, and instead the provider-specific signature header is verified against the secret stored on the webhook. A failed verification returns 401; a successful one dispatches to subscribers identically to the API-key flow, returning the provider's expected ack body or 204. Anonymous endpoint, since the signature is the authentication.

List a service account's request activity.

Returns the per-request usage stream — which endpoints the account called, when, and with what status — aggregated across every key the account owns, newest-first. Distinct from `/auditEvents`, which is the principal's security lifecycle (provision / rotate / revoke). This is high-volume, hence cursor pagination. Mirrors `/tokens/{id}/activity`, the per-key view a personal access token uses; a service account is a principal that can own several keys, so its activity is the union across them.