API Automation Service Account
The API Automation service account is granted to an application user rather than to a member, so it is the role to use for CI/CD pipelines, orchestrators, and anything else that authenticates to the API instead of signing in. Every resource class is held at run, which lets it start work an organization has already defined and change none of it.
Grant one account per integration. Actions are attributed to the identity that performed them, so a separate account for each system keeps the audit log specific about which one acted.
It holds no permission in the organization family and nothing in the deployment family.
Organization
| Permission | Access |
|---|---|
| Organization | No access |
| Members | No access |
| Audit log | No access |
| Data residency | No access |
| Restore points legal holds | No access |
| Inventory resources legal holds | No access |
Resources
| Permission | Access |
|---|---|
| Inventories | Run |
| Apps | Run |
| Restore point data | Run |
| Secret Providers | Run |
| Integrations | Run |
| Policies | Run |
| Settings | Run |
| Edges | Run |
| Configuration bundles | Run |
| Data classes | Run |
| Environments | Run |
| Schedules | Run |
Deployment
| Permission | Access |
|---|---|
| Control plane | No access |
| License | No access |