> ## Documentation Index > Fetch the complete documentation index at: https://docs.cloud.cdata.com/llms.txt > Use this file to discover all available pages before exploring further. # Assign Service Account Role > Assign the account-wide admin system role to a service account. Only the `admin` role is assignable via this endpoint. All other system roles are workspace-scoped and must be assigned via `POST /service-accounts/{id}/workspaces/{workspace_id}/roles`. All service account role assignments are direct; service accounts are not members of SCIM-synced groups. This endpoint is idempotent: if the role is already assigned, the existing assignment is returned with HTTP 200. ## OpenAPI ````yaml en/API/Management-API.yaml POST /service-accounts/{id}/roles openapi: 3.1.0 info: title: CData Connect AI Management API version: v1 description: > The Connect AI Management API provides programmatic control over enterprise platform administration. Base path: /api/v1/admin. Use it to manage users, service accounts, roles, and resource permissions without manual UI operations. The API follows OAS 3.0 standards with OAuth 2.0 scoped authentication. On versioning: the version prefix is incremented when breaking changes require it. A new /api/v2/admin path will be introduced with a 6-month deprecation notice before any v1 endpoint is retired. On human users vs. service accounts: human users are provisioned and lifecycle-managed by SCIM; the Management API handles direct overrides and atomic deprovisioning. Service accounts (CI/CD pipelines, IaC tooling, Terraform) are fully managed via the Management API and are not SCIM-owned. servers: - url: https://cloud.cdata.com/api/v1/admin description: Production base URL security: - oauth2: [] tags: - name: Users description: > Lifecycle management for human users: create, update, deprovision, and manage direct role assignments, workspace-scoped roles, and direct resource permissions. SCIM handles group-based provisioning and user creation at scale; this API handles direct overrides and atomic deprovisioning. - name: Service Accounts description: > Full lifecycle management for machine identities (CI/CD pipelines, IaC tooling, Terraform automation). Service accounts are not SCIM-owned and authenticate via OAuth 2.0 client credentials using the `client_id` returned on creation. paths: /service-accounts/{id}/roles: post: tags: - Service Accounts summary: Assign Service Account Role description: > Assign the account-wide admin system role to a service account. Only the `admin` role is assignable via this endpoint. All other system roles are workspace-scoped and must be assigned via `POST /service-accounts/{id}/workspaces/{workspace_id}/roles`. All service account role assignments are direct; service accounts are not members of SCIM-synced groups. This endpoint is idempotent: if the role is already assigned, the existing assignment is returned with HTTP 200. operationId: assignServiceAccountRole parameters: - name: id in: path required: true description: Service account identifier (UUID). schema: type: string format: uuid requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/AssignRoleRequest' example: role_id: 00000000-0000-0000-0000-000000000010 responses: '200': description: OK. The role is already assigned; returns the existing assignment. content: application/json: schema: $ref: '#/components/schemas/ServiceAccountRoleAssignment' example: id: r2b3c4d5-e6f7-8901-abcd-ef1234567890 service_account_id: c3d4e5f6-a7b8-9012-cdef-123456789012 role_id: 00000000-0000-0000-0000-000000000010 role_name: Admin role_type: system_role grant_type: direct granted_at: '2026-06-02T09:00:00Z' granted_by: 00000000-0000-0000-0000-000000000001 '201': description: Created. Returns the new assignment. content: application/json: schema: $ref: '#/components/schemas/ServiceAccountRoleAssignment' '404': $ref: '#/components/responses/ServiceAccountNotFound' '409': description: Conflict content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: system_role_limit: summary: Service account already holds the admin role value: error: code: SYSTEM_ROLE_LIMIT message: The service account already holds the admin role. '422': description: Unprocessable Entity content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: role_not_found: summary: Role does not exist value: error: code: ROLE_NOT_FOUND message: The specified role does not exist. role_not_assignable: summary: Role is not the admin role value: error: code: ROLE_NOT_ASSIGNABLE message: >- Only the admin role is assignable via this endpoint. For workspace-scoped system roles, use POST /service-accounts/{id}/workspaces/{workspace_id}/roles. security: - oauth2: - management:service-accounts:write components: schemas: AssignRoleRequest: type: object required: - role_id properties: role_id: type: string format: uuid description: Role to assign. Must exist in the organization. ServiceAccountRoleAssignment: type: object description: A direct role assignment made via POST /service-accounts/{id}/roles. properties: id: type: string format: uuid description: Assignment identifier. service_account_id: type: string format: uuid description: The service account this role is assigned to. role_id: type: string format: uuid description: The role identifier. role_name: type: string description: The name of the role. role_type: type: string enum: - system_role description: Always `system_role` (admin) for assignments made via this endpoint. grant_type: type: string enum: - direct description: Always `direct`. granted_at: type: string format: date-time description: ISO 8601 UTC. granted_by: type: string format: uuid description: The user who granted the role. ErrorResponse: type: object properties: error: type: object description: Error details. properties: code: type: string description: SCREAMING_SNAKE_CASE error code. message: type: string description: Human-readable error description. responses: ServiceAccountNotFound: description: Not Found content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: error: code: SERVICE_ACCOUNT_NOT_FOUND message: The specified service account does not exist. securitySchemes: oauth2: type: oauth2 flows: clientCredentials: tokenUrl: https://cloud-login.cdata.com/oauth/token scopes: management:users:read: Read access to user resources. management:users:write: Write access to user resources. management:service-accounts:read: Read access to service account resources. management:service-accounts:write: Write access to service account resources. ````