Preview — pending review
This reference is generated from the platform API contract and is still under review. Operations, fields, and descriptions can change before publication.
List a service account's role bindings
Lists the role bindings granted to the service account (the detail Bindings tab). A service account is a
principal, so each binding is a role grant at a subscription- or project-level scope, resolved from the
same role-assignment store as human-user role assignments. Returns the bindings newest-grant-first — the same
list embedded in the detail read model's bindings.
Validation: the account must exist and be visible in the scope (else 404 NOT_FOUND); caller must hold a
read role on IAM (else 403 FORBIDDEN).
bearerTokenAuthorizationBearer <token>An API token (pc_live_…) or a service-account key (sak_live_…), created in Identity & Access Management and sent as Authorization: Bearer <token>. Requests are rate limited per credential and per tenant: every response carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset, and a refused request gets 429 RATE_LIMITED with Retry-After.
scopeId*stringOpaque ownership+authorization scope resolving to tenant + subscription + project.
serviceAccountId*stringService account identifier.
page?integer1-based page number.
1 <= value1pageSize?integerItems per page (max 200). Lists that used to return every row default to the maximum, so a client that does not page keeps seeing up to 200 rows; a larger value is refused with 422.
1 <= value <= 200200The service account's role bindings, newest grant first.
application/json- response
[index: integer]?Role grant for the service account at subscription or project scope.
curl -X GET "https://example.com/scopes/string/iam/service-accounts/string/bindings"[ { "id": "string", "roleId": "string", "roleName": "string", "scopeType": "tenant", "scopeName": "string", "grantedBy": "string", "grantedAt": "2019-08-24T14:15:22Z" }]