Repository navigation
feat(service-accounts): Add an endpoint to list service account tokens - #130483
Merged
Merged
Conversation
github-actions
Bot
added
Scope: Backend
Contributor
Sentry Snapshot Testing
|
sentry-junior Bot
added a commit
that referenced
this pull request
Nov 9, 2026
Frontend half of the service account token endpoints in #130483, split out because frontend and backend deploy separately. It lands first: the patterns are harmless before the backend routes exist, and #130483's test_no_missing_urls passes once this is in. Co-Authored-By: shaun.kaasten <900809+skaasten@users.noreply.github.com>
sentry-junior
Bot
force-pushed
the
feat/service-account-token-endpoints
branch
from
November 9, 2026 20:48
9fe67ed to
7f2622d
Compare
sentry-junior
Bot
changed the title
This was referenced Nov 9, 2026
Contributor
|
🚨 Warning: This pull request contains Frontend and Backend changes! It's discouraged to make changes to Sentry's Frontend and Backend in a single pull request. The Frontend and Backend are not atomically deployed. If the changes are interdependent of each other, they must be separated into two pull requests and be made forward or backwards compatible, such that the Backend or Frontend can be safely deployed independently. Have questions? Please ask in the |
skaasten
force-pushed
the
feat/service-account-token-endpoints
branch
from
November 10, 2026 14:55
78f6a69 to
55189db
Compare
Base automatically changed from
feat/service-account-token-generation
to
master
November 10, 2026 15:33
…okens
GET /organizations/{org}/service-accounts/{id}/tokens/ returns the account's
active tokens, newest first. It never returns token values. Only a person
signed in as themselves can call it, not a service account.
Gated by organizations:service-accounts.
skaasten
force-pushed
the
feat/service-account-token-endpoints
branch
from
November 10, 2026 15:33
55189db to
2cf08eb
Compare
skaasten
marked this pull request as ready for review
November 10, 2026 16:44
gricha
approved these changes
Nov 10, 2026
sentry-junior Bot
added a commit
that referenced
this pull request
Nov 12, 2026
Frontend half of the service account token endpoints in #130483, split out because frontend and backend deploy separately. It lands first: the patterns are harmless before the backend routes exist, and #130483's test_no_missing_urls passes once this is in. Co-Authored-By: shaun.kaasten <900809+skaasten@users.noreply.github.com>
skaasten
added a commit
that referenced
this pull request
Nov 12, 2026
Frontend half of the service account token endpoints in #130483, split out because frontend and backend deploy separately. It lands first: the patterns are harmless before the backend routes exist, and #130483's test_no_missing_urls passes once this is in. Co-Authored-By: shaun.kaasten <900809+skaasten@users.noreply.github.com>
sentry-junior Bot
added a commit
that referenced
this pull request
Nov 12, 2026
Frontend half of the service account token endpoints in #130483, split out because frontend and backend deploy separately. It lands first: the patterns are harmless before the backend routes exist, and #130483's test_no_missing_urls passes once this is in. Co-Authored-By: shaun.kaasten <900809+skaasten@users.noreply.github.com>
skaasten
pushed a commit
that referenced
this pull request
Nov 13, 2026
…ens (#130507) Adds a new endpoint for creating a service account access token We ensure the scopes for the token do not exceed the scopes for the current user. ------------------ Adds `POST /organizations/{org}/service-accounts/{id}/tokens/`. This is the second of three small token endpoint PRs, one per endpoint: 1. List tokens: #130483 2. **Create a token (this PR)** 3. Revoke a token: #130508 The endpoint needs `service_account:write` and takes `{name, scopes, expiresAt}`: - Each scope must already be granted to the account, otherwise it returns 400 with an error on `scopes`. - `expiresAt` defaults to 30 days from now (`DEFAULT_TOKEN_LIFETIME`). A value you set must be in the future, otherwise it returns 400 with an error on `expiresAt`. Send `null` for a token that never expires. - The token is generated with `generate_token(org slug, cell locality URL)`, using the same cell URL lookup as org auth tokens. Only the hash and the last 4 characters are stored. - The 201 response is the list item plus `token`. It's the only response that includes the token value. Seer agent tokens and impersonation sessions can't create tokens (`DisallowAgentTokenWrites`, `DisallowImpersonatedTokenCreation`). A service account gets 403 `user-required`, the same as on the list endpoint. Each create writes a `SERVICE_ACCOUNT_TOKEN_ADD` (226) audit log entry. Its data holds the token name, scopes and account, never the token or its hash. Review notes: - This stores `date_expires` but doesn't enforce it. Nothing authenticates service account tokens on requests yet, so the authenticator that comes later must reject a token once `date_expires` has passed. - `ServiceAccountTokenEndpointBase.permission_classes` is a longer tuple than its parent's, so `OrganizationServiceAccountEndpointBase.permission_classes` now has an explicit `tuple[type[BasePermission], ...]` type for mypy. <!-- junior-request-attribution:start --> via @skaasten. <!-- junior-request-attribution:end --> <!-- junior-session-footer:start --> <!-- junior-conversation-id:slack%3AC0CA89MBDQB%3A1793911581.772709 --> -- [View Session](https://junior-prod.sentry.dev/conversations/slack%3AC0CA89MBDQB%3A1793911581.772709) [[Sentry]](https://sentry.sentry.io/explore/conversations/slack%3AC0CA89MBDQB%3A1793911581.772709/?project=4510944073809921) <!-- junior-session-footer:end --> --------- Co-authored-by: sentry-junior[bot] <264270552+sentry-junior[bot]@users.noreply.github.com>
skaasten
added a commit
that referenced
this pull request
Nov 13, 2026
…ens (#130508) Adds `DELETE /organizations/{org}/service-accounts/{id}/tokens/{token_id}/`. This is the last of three small token endpoint PRs, one per endpoint: 1. List tokens: #130483 2. Create a token: #130507 3. **Revoke a token (this PR)** The endpoint needs `service_account:write`. It locks the token row, sets `date_deactivated` and saves it, so the token's outbox updates the replica in the org's cell. It returns 204. The token must belong to the account in the URL, and the account must be active and in the URL's org. Otherwise, or if the token is already revoked, it returns 404. It uses the same guards as create: only a person signed in as themselves can call it, and Seer agent tokens and impersonation sessions are refused. Each revoke writes a `SERVICE_ACCOUNT_TOKEN_REMOVE` (227) audit log entry. Its data holds the token name, scopes and account, never the token or its hash. The settings UI's Revoke button in #130485 calls this endpoint. **Tests:** the revoke test drains the token's outbox and checks that the cell's `ServiceAccountTokenReplica` gets the token's new `date_deactivated`. This works because #130265, the token replication handler, is merged. <!-- junior-request-attribution:start --> via @skaasten. <!-- junior-request-attribution:end --> <!-- junior-session-footer:start --> <!-- junior-conversation-id:slack%3AC0CA89MBDQB%3A1794494200.498819 --> -- [View Session](https://junior-prod.sentry.dev/conversations/slack%3AC0CA89MBDQB%3A1794494200.498819) [[Sentry]](https://sentry.sentry.io/explore/conversations/slack%3AC0CA89MBDQB%3A1794494200.498819/?project=4510944073809921) <!-- junior-session-footer:end --> --------- Co-authored-by: sentry-junior[bot] <264270552+sentry-junior[bot]@users.noreply.github.com> Co-authored-by: Shaun Kaasten <900809+skaasten@users.noreply.github.com>
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a new endpoint for listing service account tokens, gated by service account feature flag
Adds
GET /organizations/{org}/service-accounts/{id}/tokens/. This is the first of the small token endpoint PRs, one per endpoint. It's stacked on #130456, which adds token generation:The endpoint runs in control, is private, and is gated on
organizations:service-accountslike the other service account endpoints. It needsservice_account:read.It returns the account's active tokens, newest first:
id,name,scopes,tokenLastCharacters,dateCreated,dateLastUsed,dateExpires. Revoked tokens aren't listed, and the response never includes a token's value. Pagination works the same way as the service account list. The account in the URL must be active and in the URL's org, otherwise it returns 404.Only a person signed in as themselves can call it. A service account gets 403
user-required(requires_user).The account lookup from the details endpoint moved into a shared
ServiceAccountScopedEndpointBase. The details endpoint behaves the same.The new URL is added to
static/app/utils/api/knownSentryApiUrls.generated.ts, so the frontend PR (#130485) can type-check against it.via @skaasten.
--
View Session [Sentry]