Service accounts
A service account gives a CI job its own identity in one workspace, with tokens that survive the person who made them and an optional list of allowed addresses.
On this page
A service account is an identity for a machine: a CI job that runs the checks, a script that exports views for your documentation. It belongs to the organisation, not to a person, so its tokens keep working when the colleague who made them leaves.
Create a service account
Coming soonManage service accounts from your organisation's settings.
There is no screen for service accounts in iyedy yet. An owner or security administrator of the organisation who needs one writes to support@iyedy.com. The rules below hold wherever the account is made.
How a service account works
| Who manages them | owners and security administrators of the organisation, after a recent sign-in |
| What it is | a guest of the organisation, with one role in one workspace: viewer or contributor |
| Where it shows | never in the list of people |
| Tokens | crt_sa_ followed by 16 letters and digits, an underscore, then 43 characters; 10 active per account; 1 to 365 days, 90 by default |
| Addresses | an optional list of allowed address ranges; a token used from elsewhere is refused |
A service-account token carries scopes like a personal one, and its role decides as well: with the viewer role, a cartouche.write scope writes nothing. A contributor can submit proposals, which a person applies in iyedy.
Choose the role and the scopes
| Job | Role | Scopes |
|---|---|---|
| Export views for your documentation | viewer | cartouche.read |
| Run the checks in a pipeline | viewer | cartouche.read |
| Follow dependencies in a release check | viewer | cartouche.read, cartouche.graph |
| Propose a change for a person to review | contributor | cartouche.read, cartouche.propose |
Prefer a proposal over a direct write: the change then waits for a person. See Propose a change through the API.
Disable a service account
Disabling a service account revokes all its tokens and suspends its membership at once. A single token can also be revoked on its own. Both take effect on the next request. In the organisation's audit log, creating, changing and disabling a service account are recorded, and so are its tokens and the writes made with them.
If it doesn't work
401 with reason ip_not_allowed
The job calls from an address outside the account's allowed list. Run it from an allowed address, or ask an owner to change the list.
404 on a workspace or a diagram
A service account reaches one workspace only. A path that names another workspace answers as if it did not exist.
403 when the job tries to propose or write
The account has the viewer role, or its token lacks the scope. Give it the contributor role and the cartouche.propose scope.
All the codes: Rate limits and errors.
Was this page helpful?Your answer is anonymous and counts only if you accepted measurement.
What went wrong?
Don't write personal data.