Complete service-account credential administration

webui/src/api/admin.ts

@@ -204,6 +204,43 @@ export type ApiKeyAdminItem = {
   created_at: string;
 };
 
+export type ServiceAccountItem = {
+  id: string;
+  tenant_id: string;
+  name: string;
+  description?: string | null;
+  scope_ceiling: string[];
+  is_active: boolean;
+  revision: number;
+  credential_count: number;
+  active_credential_count: number;
+  last_credential_used_at?: string | null;
+  retired_at?: string | null;
+  created_at: string;
+  updated_at: string;
+};
+
+export type ServiceAccountCredentialItem = {
+  id: string;
+  name: string;
+  prefix: string;
+  scopes: string[];
+  expires_at?: string | null;
+  last_used_at?: string | null;
+  revoked_at?: string | null;
+  created_at: string;
+};
+
+export type ServiceAccountCredentialListResponse = {
+  service_account_revision: number;
+  items: ServiceAccountCredentialItem[];
+};
+
+export type ServiceAccountCredentialMutationResponse = {
+  service_account_revision: number;
+  credential: ServiceAccountCredentialItem;
+};
+
 export type ExternalFunctionRoleMappingItem = {
   id: string;
   tenant_id: string;
@@ -447,6 +484,79 @@ export function revokeApiKey(settings: ApiSettings, keyId: string): Promise<ApiK
   return apiFetch(settings, `/api/v1/admin/api-keys/${keyId}/revoke`, { method: "POST" });
 }
 
+export async function fetchServiceAccounts(settings: ApiSettings): Promise<ServiceAccountItem[]> {
+  const response = await apiFetch<{ items: ServiceAccountItem[] }>(settings, "/api/v1/admin/service-accounts");
+  return response.items;
+}
+
+export function createServiceAccount(settings: ApiSettings, payload: {
+  name: string;
+  description?: string | null;
+  scope_ceiling: string[];
+}): Promise<ServiceAccountItem> {
+  return apiFetch(settings, "/api/v1/admin/service-accounts", {
+    method: "POST",
+    body: JSON.stringify(payload)
+  });
+}
+
+export function updateServiceAccount(settings: ApiSettings, serviceAccountId: string, payload: {
+  expected_revision: number;
+  name?: string;
+  description?: string | null;
+  scope_ceiling?: string[];
+  is_active?: boolean;
+}): Promise<ServiceAccountItem> {
+  return apiFetch(settings, `/api/v1/admin/service-accounts/${serviceAccountId}`, {
+    method: "PATCH",
+    body: JSON.stringify(payload)
+  });
+}
+
+export function retireServiceAccount(settings: ApiSettings, serviceAccountId: string, expectedRevision: number): Promise<ServiceAccountItem> {
+  return apiFetch(settings, `/api/v1/admin/service-accounts/${serviceAccountId}/retire`, {
+    method: "POST",
+    body: JSON.stringify({ expected_revision: expectedRevision })
+  });
+}
+
+export function fetchServiceAccountCredentials(settings: ApiSettings, serviceAccountId: string, includeRevoked = true): Promise<ServiceAccountCredentialListResponse> {
+  return apiFetch(settings, apiPath(`/api/v1/admin/service-accounts/${serviceAccountId}/credentials`, {
+    include_revoked: includeRevoked
+  }));
+}
+
+export function createServiceAccountCredential(settings: ApiSettings, serviceAccountId: string, payload: {
+  expected_revision: number;
+  name: string;
+  scopes: string[];
+  expires_at?: string | null;
+}): Promise<ServiceAccountCredentialMutationResponse & { secret: string }> {
+  return apiFetch(settings, `/api/v1/admin/service-accounts/${serviceAccountId}/credentials`, {
+    method: "POST",
+    body: JSON.stringify(payload)
+  });
+}
+
+export function rotateServiceAccountCredential(settings: ApiSettings, serviceAccountId: string, credentialId: string, payload: {
+  expected_revision: number;
+  name?: string | null;
+  scopes?: string[] | null;
+  expires_at?: string | null;
+}): Promise<ServiceAccountCredentialMutationResponse & { secret: string }> {
+  return apiFetch(settings, `/api/v1/admin/service-accounts/${serviceAccountId}/credentials/${credentialId}/rotate`, {
+    method: "POST",
+    body: JSON.stringify(payload)
+  });
+}
+
+export function revokeServiceAccountCredential(settings: ApiSettings, serviceAccountId: string, credentialId: string, expectedRevision: number): Promise<ServiceAccountCredentialMutationResponse> {
+  return apiFetch(settings, `/api/v1/admin/service-accounts/${serviceAccountId}/credentials/${credentialId}/revoke`, {
+    method: "POST",
+    body: JSON.stringify({ expected_revision: expectedRevision })
+  });
+}
+
 export function createSystemAccount(settings: ApiSettings, payload: {
   email: string;
   display_name?: string | null;