Skip to main content
POST
Create a service identity

Authorizations

Authorization
string
header
required

The access token received from the authorization server in the OAuth 2.0 flow.

Body

application/json

Make a service identity: a Keycloak service account holding existing realm roles, that crew schedules can run as.

slug
string
required

Lowercase letters, digits and hyphens, up to 40. Names the Keycloak client nx1-agent-<slug>; never reused.

Pattern: ^[a-z0-9](?:[a-z0-9-]{0,38}[a-z0-9])?$
roles
string[]
required

Existing realm roles it reads as. You must hold each one; built-in roles and Ranger super groups are refused.

Required array length: 1 - 20 elements
description
string
default:""
Maximum string length: 2000
allowed_users
string[]

Usernames who may set a schedule to run as it. You are added.

Maximum array length: 100
allowed_roles
string[]

Realm roles whose holders may set a schedule to run as it.

Maximum array length: 50

Response

Successful Response

A service identity.

id
string
required
slug
string
required
description
string
required
roles
string[]
required
allowed_users
string[]
required
allowed_roles
string[]
required
enabled
boolean
required
client_id
string
required

The Keycloak client.

service_account_name
string
required

The name its runs act as in Trino, Ranger and the AI Router.

schedules
integer
required

Crew schedules set to run as it, enabled or not.

can_use
boolean
required

Whether you may set a schedule to run as it.

created_by
string
required

Username of the admin who made it.

created_at
string
required

ISO 8601, UTC.

updated_at
string
required

ISO 8601, UTC.