Repository navigation
feat(service-accounts): Add an endpoint to create service account tokens - #130507
Merged
Merged
Conversation
github-actions
Bot
added
the
Scope: Backend
sentry-junior
Bot
force-pushed
the
feat/service-account-token-create
branch
from
November 9, 2026 21:01
a73fc30 to
1d3ca1c
Compare
Contributor
Sentry Snapshot Testing
|
skaasten
force-pushed
the
feat/service-account-token-create
branch
2 times, most recently
from
November 10, 2026 15:33
8f3e312 to
016d4d5
Compare
![sentry-warden[bot]](https://avatars.githubusercontent.com/in/2755838?s=60&v=4){kind=small}
Base automatically changed from
feat/service-account-token-endpoints
to
master
November 10, 2026 17:18
skaasten
pushed a commit
that referenced
this pull request
Nov 10, 2026
#130483) Adds a new endpoint for listing service account tokens, gated by service account feature flag ------ Adds `GET /organizations/{org}/service-accounts/{id}/tokens/`. This is the first of the small token endpoint PRs, one per endpoint. It's stacked on #130456, which adds token generation: 1. **List tokens (this PR)** 2. Create a token: #130507 3. Revoke a token: #130508 The endpoint runs in control, is private, and is gated on `organizations:service-accounts` like the other service account endpoints. It needs `service_account:read`. It returns the account's active tokens, newest first: `id`, `name`, `scopes`, `tokenLastCharacters`, `dateCreated`, `dateLastUsed`, `dateExpires`. Revoked tokens aren't listed, and the response never includes a token's value. Pagination works the same way as the service account list. The account in the URL must be active and in the URL's org, otherwise it returns 404. Only a person signed in as themselves can call it. A service account gets 403 `user-required` (`requires_user`). The account lookup from the details endpoint moved into a shared `ServiceAccountScopedEndpointBase`. The details endpoint behaves the same. The new URL is added to `static/app/utils/api/knownSentryApiUrls.generated.ts`, so the frontend PR (#130485) can type-check against it. <!-- junior-request-attribution:start --> via @skaasten. <!-- junior-request-attribution:end --> <!-- junior-session-footer:start --> <!-- junior-conversation-id:slack%3AC0CA89MBDQB%3A1793911581.772709 --> -- [View Session](https://junior-prod.sentry.dev/conversations/slack%3AC0CA89MBDQB%3A1793911581.772709) [[Sentry]](https://sentry.sentry.io/explore/conversations/slack%3AC0CA89MBDQB%3A1793911581.772709/?project=4510944073809921) <!-- junior-session-footer:end --> --------- Co-authored-by: sentry-junior[bot] <264270552+sentry-junior[bot]@users.noreply.github.com>
skaasten
force-pushed
the
feat/service-account-token-create
branch
from
November 10, 2026 17:18
3067ad7 to
0f26e00
Compare
skaasten
marked this pull request as ready for review
November 10, 2026 17:25
skaasten
force-pushed
the
feat/service-account-token-create
branch
from
November 12, 2026 14:32
0f26e00 to
277a4e1
Compare
markstory
reviewed
Nov 12, 2026
gricha
removed their request for review
November 12, 2026 18:49
Member
|
I'll remove myself as a reviewer, I'm supportive but I want this to be reviewed by Michelle |
POST /organizations/{org}/service-accounts/{id}/tokens/ mints a token that
acts as the service account and returns its value once. The token's scopes
must already be granted to the account.
expiresAt defaults to 30 days from now. A set value must be in the future,
and null creates a token that never expires.
Seer agent tokens and impersonating admins can't create tokens. Each create
writes a SERVICE_ACCOUNT_TOKEN_ADD audit log entry.
A token is a bearer credential returned to whoever creates it, so a manager could mint a token carrying scopes they lack, such as org:admin, from an account an owner set up. Requested scopes must now be on the account and held by the caller.
The token is committed before replication, so a failed flush shouldn't turn a successful create into a 500 that drops the only copy of the plaintext token. The outbox drains later and the token reaches the cell then.
Turning off the flush stopped a replication failure from returning a 500, but it also left the token waiting for the scheduled outbox drain before it reached the cell. Flush after the commit instead, and log a failure rather than raising it.
Flush in the transaction as usual and catch OutboxDatabaseError and OutboxFlushError once the token is bound, the same way ApiTokensEndpoint.post does, instead of a separate post-commit drain helper.
skaasten
force-pushed
the
feat/service-account-token-create
branch
from
November 13, 2026 14:19
c6bc547 to
41c18dd
Compare
michelletran-sentry
approved these changes
Nov 13, 2026
skaasten
added a commit
that referenced
this pull request
Nov 13, 2026
…ens (#130508) Adds `DELETE /organizations/{org}/service-accounts/{id}/tokens/{token_id}/`. This is the last of three small token endpoint PRs, one per endpoint: 1. List tokens: #130483 2. Create a token: #130507 3. **Revoke a token (this PR)** The endpoint needs `service_account:write`. It locks the token row, sets `date_deactivated` and saves it, so the token's outbox updates the replica in the org's cell. It returns 204. The token must belong to the account in the URL, and the account must be active and in the URL's org. Otherwise, or if the token is already revoked, it returns 404. It uses the same guards as create: only a person signed in as themselves can call it, and Seer agent tokens and impersonation sessions are refused. Each revoke writes a `SERVICE_ACCOUNT_TOKEN_REMOVE` (227) audit log entry. Its data holds the token name, scopes and account, never the token or its hash. The settings UI's Revoke button in #130485 calls this endpoint. **Tests:** the revoke test drains the token's outbox and checks that the cell's `ServiceAccountTokenReplica` gets the token's new `date_deactivated`. This works because #130265, the token replication handler, is merged. <!-- junior-request-attribution:start --> via @skaasten. <!-- junior-request-attribution:end --> <!-- junior-session-footer:start --> <!-- junior-conversation-id:slack%3AC0CA89MBDQB%3A1794494200.498819 --> -- [View Session](https://junior-prod.sentry.dev/conversations/slack%3AC0CA89MBDQB%3A1794494200.498819) [[Sentry]](https://sentry.sentry.io/explore/conversations/slack%3AC0CA89MBDQB%3A1794494200.498819/?project=4510944073809921) <!-- junior-session-footer:end --> --------- Co-authored-by: sentry-junior[bot] <264270552+sentry-junior[bot]@users.noreply.github.com> Co-authored-by: Shaun Kaasten <900809+skaasten@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a new endpoint for creating a service account access token
We ensure the scopes for the token do not exceed the scopes for the current user.
Adds
POST /organizations/{org}/service-accounts/{id}/tokens/. This is the second of three small token endpoint PRs, one per endpoint:The endpoint needs
service_account:writeand takes{name, scopes, expiresAt}:scopes.expiresAtdefaults to 30 days from now (DEFAULT_TOKEN_LIFETIME). A value you set must be in the future, otherwise it returns 400 with an error onexpiresAt. Sendnullfor a token that never expires.generate_token(org slug, cell locality URL), using the same cell URL lookup as org auth tokens. Only the hash and the last 4 characters are stored.token. It's the only response that includes the token value.Seer agent tokens and impersonation sessions can't create tokens (
DisallowAgentTokenWrites,DisallowImpersonatedTokenCreation). A service account gets 403user-required, the same as on the list endpoint.Each create writes a
SERVICE_ACCOUNT_TOKEN_ADD(226) audit log entry. Its data holds the token name, scopes and account, never the token or its hash.Review notes:
date_expiresbut doesn't enforce it. Nothing authenticates service account tokens on requests yet, so the authenticator that comes later must reject a token oncedate_expireshas passed.ServiceAccountTokenEndpointBase.permission_classesis a longer tuple than its parent's, soOrganizationServiceAccountEndpointBase.permission_classesnow has an explicittuple[type[BasePermission], ...]type for mypy.via @skaasten.
--
View Session [Sentry]