> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloud.cdata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# List Service Account Roles

> List all roles assigned to a service account with provenance.




## OpenAPI

````yaml en/API/Management-API.yaml GET /service-accounts/{id}/roles
openapi: 3.1.0
info:
  title: CData Connect AI Management API
  version: v1
  description: >
    The Connect AI Management API provides programmatic control over enterprise
    platform administration. Base path: /api/v1/admin. Use it to manage users,
    service accounts, roles, and resource permissions without manual UI
    operations. The API follows OAS 3.0 standards with OAuth 2.0 scoped
    authentication.

    On versioning: the version prefix is incremented when breaking changes
    require it. A new /api/v2/admin path will be introduced with a 6-month
    deprecation notice before any v1 endpoint is retired.

    On human users vs. service accounts: human users are provisioned and
    lifecycle-managed by SCIM; the Management API handles direct overrides and
    atomic deprovisioning. Service accounts (CI/CD pipelines, IaC tooling,
    Terraform) are fully managed via the Management API and are not SCIM-owned.
servers:
  - url: https://cloud.cdata.com/api/v1/admin
    description: Production base URL
security:
  - oauth2: []
tags:
  - name: Users
    description: >
      Lifecycle management for human users: create, update, deprovision, and
      manage direct role assignments, workspace-scoped roles, and direct
      resource permissions. SCIM handles group-based provisioning and user
      creation at scale; this API handles direct overrides and atomic
      deprovisioning.
  - name: Service Accounts
    description: >
      Full lifecycle management for machine identities (CI/CD pipelines, IaC
      tooling, Terraform automation). Service accounts are not SCIM-owned and
      authenticate via OAuth 2.0 client credentials using the `client_id`
      returned on creation.
paths:
  /service-accounts/{id}/roles:
    get:
      tags:
        - Service Accounts
      summary: List Service Account Roles
      description: |
        List all roles assigned to a service account with provenance.
      operationId: listServiceAccountRoles
      parameters:
        - name: id
          in: path
          required: true
          description: Service account identifier (UUID).
          schema:
            type: string
            format: uuid
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceAccountRoleCollection'
              example:
                items:
                  - role_id: 00000000-0000-0000-0000-000000000010
                    role_name: Admin
                    role_type: system_role
                    grant_type: direct
                    group_id: null
                    group_name: null
                    granted_at: '2026-06-02T09:00:00Z'
                limit: 20
                next_cursor: null
        '404':
          $ref: '#/components/responses/ServiceAccountNotFound'
      security:
        - oauth2:
            - management:service-accounts:read
components:
  schemas:
    ServiceAccountRoleCollection:
      allOf:
        - $ref: '#/components/schemas/CollectionEnvelope'
        - type: object
          properties:
            items:
              type: array
              items:
                $ref: '#/components/schemas/ServiceAccountRoleItem'
    CollectionEnvelope:
      type: object
      properties:
        limit:
          type: integer
          description: Maximum number of items per page as requested.
        next_cursor:
          type: string
          nullable: true
          description: >-
            Pagination cursor for the next page. null when no further pages
            exist. Total count is not returned.
    ServiceAccountRoleItem:
      type: object
      description: A role held by a service account, with provenance.
      properties:
        role_id:
          type: string
          format: uuid
          description: The role identifier.
        role_name:
          type: string
          description: The name of the role.
        role_type:
          type: string
          enum:
            - system_role
            - access_role
          description: The type of the role.
        grant_type:
          type: string
          enum:
            - direct
            - group_derived
          description: >
            `direct` for all current assignments. `group_derived` will be added
            when custom group membership for service accounts ships (Non-MVP).
        group_id:
          type: string
          format: uuid
          nullable: true
          description: >-
            Set for `grant_type: group_derived` (Non-MVP): the custom group that
            conferred this role. null for direct grants.
        group_name:
          type: string
          nullable: true
          description: Custom group display name. null for direct grants.
        granted_at:
          type: string
          format: date-time
          description: ISO 8601 UTC.
    ErrorResponse:
      type: object
      properties:
        error:
          type: object
          description: Error details.
          properties:
            code:
              type: string
              description: SCREAMING_SNAKE_CASE error code.
            message:
              type: string
              description: Human-readable error description.
  responses:
    ServiceAccountNotFound:
      description: Not Found
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          example:
            error:
              code: SERVICE_ACCOUNT_NOT_FOUND
              message: The specified service account does not exist.
  securitySchemes:
    oauth2:
      type: oauth2
      flows:
        clientCredentials:
          tokenUrl: https://cloud-login.cdata.com/oauth/token
          scopes:
            management:users:read: Read access to user resources.
            management:users:write: Write access to user resources.
            management:service-accounts:read: Read access to service account resources.
            management:service-accounts:write: Write access to service account resources.

````