Create a service account (optionally minting an initial key)

Key scopes: with createKey: true the initial key carries keyScopes (optional; omitted = the default key scopes, i.e. the whole ApiTokenScope catalogue minus iam:write). An explicit empty list is 422 VALIDATION_FAILED (field keyScopes); iam:write is never grantable to a service-account key (422 VALIDATION_FAILED, field keyScopes, details.reason iam_write_not_grantable_to_service_account_key). keyScopes is ignored when createKey is false. Token callers: createKey: true from a pc_live_ token may only request keyScopes (explicit or defaulted) the token holds itself -- otherwise 403 FORBIDDEN TOKEN_SCOPE_MISSING (missingTokenScopes), no account created. A key has no IP allowlist, so a token with an ipAllowlist cannot mint one (403 TOKEN_FENCE_EXCEEDED); a key minted by an expiring token expires with it. Initial roleIds stay capped by the creator's current role. A service-account key calling this operation gets 403 INTERACTIVE_SESSION_REQUIRED (an SA key never performs an IAM write). Creates a new machine identity in the active scope from the service account creation form: a lowercase DNS-label account name (becomes the immutable local part of the email-style ID), an optional description, an optional set of initial role bindings from the role catalog scoped to the current project, and an optional "create a key and download the credential" flag. When createKey is true the response carries the one-time private-key credential exactly once; it can never be retrieved again. On acceptance the account becomes discoverable in the scoped list. Validation: name must match ^[a-z]([a-z0-9-]{1,28}[a-z0-9])?$ (3–30 chars, lowercase DNS label) else 422 VALIDATION_FAILED; name must be unique within the tenant else 409 CONFLICT ("An account with this name already exists"); each entry in roleIds must exist in the role catalog else 422; caller must hold an IAM admin-capable role (owner|admin) in the scope else 403; per-scope service-account quota is enforced → 409 QUOTA_EXCEEDED. Async & state: Asynchronous create — returns 202 with the resource in its transitional enabled state while provisioning completes (or 201 when provisioning is immediate). Emits resource.updated SSE frames (kind: iam.service_account, patch: {status, keyCount, bindingCount}) as the account, optional initial key and bindings materialize. Errors: 401 unauthenticated; 403 caller lacks create permission; 404 scope not found; 409 duplicate name (CONFLICT) or quota exceeded (QUOTA_EXCEEDED); 422 invalid name/description/roleIds; 500 provisioning failure. Idempotency/Concurrency: Idempotency-Key required; replaying the same key returns the original result (including the same one-time credential envelope) without creating a duplicate account.

Step-up: with createKey: true or an owner-ranked roleIds entry, a console session whose account has two-factor authentication needs the factor verified in the last 5 minutes, otherwise 403 MFA_STEP_UP_REQUIRED (verify with POST /auth/step-up, then retry).