curl --request DELETE \
--url https://cockroachlabs.cloud/api/v1/service-accounts/{service_account_id}/credentials/{credential_id} \
--header 'Authorization: Bearer REPLACE_BEARER_TOKEN'{
"algorithm": "RS256",
"client_id": "crl-sa_abc123",
"created_at": "2022-03-22T20:23:11.285067Z",
"credential_type": "JWT_BEARER",
"expires_at": "2023-03-22T20:23:11.285067Z",
"id": "1234abcd-1234-1234-abcd-12345678abcd",
"name": "ci signer",
"service_account_id": "abcd1234-abcd-abcd-1234-abcdef123456"
}{
"code": 123,
"details": [
{
"@type": "<string>"
}
],
"message": "<string>"
}Delete a service account's OAuth credential
Can be used by the following roles assigned at the organization scope:
- ORG_ADMIN
curl --request DELETE \
--url https://cockroachlabs.cloud/api/v1/service-accounts/{service_account_id}/credentials/{credential_id} \
--header 'Authorization: Bearer REPLACE_BEARER_TOKEN'{
"algorithm": "RS256",
"client_id": "crl-sa_abc123",
"created_at": "2022-03-22T20:23:11.285067Z",
"credential_type": "JWT_BEARER",
"expires_at": "2023-03-22T20:23:11.285067Z",
"id": "1234abcd-1234-1234-abcd-12345678abcd",
"name": "ci signer",
"service_account_id": "abcd1234-abcd-abcd-1234-abcdef123456"
}{
"code": 123,
"details": [
{
"@type": "<string>"
}
],
"message": "<string>"
}Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Path Parameters
The ID of the service account the credential belongs to.
The ID of the credential to delete.
Response
A successful response.
ServiceAccountCredential is an OAuth 2.0 jwt-bearer credential a service account uses to obtain short-lived access tokens. CockroachDB Cloud stores only the public key and signature algorithm; it never holds a secret on the customer's behalf.
- RS256: RS256 (RSASSA-PKCS1-v1_5 using SHA-256).
- PS256: PS256 (RSASSA-PSS using SHA-256).
- ES256: ES256 (ECDSA using P-256 and SHA-256).
- ES384: ES384 (ECDSA using P-384 and SHA-384).
RS256, PS256, ES256, ES384 The public OAuth client identifier; also the iss and sub a signed assertion must carry.
"crl-sa_abc123"
When the credential was created.
"2022-03-22T20:23:11.285067Z"
- JWT_BEARER: JWT_BEARER authenticates with a client-held private key via an OAuth 2.0 jwt-bearer assertion (RFC 7523).
JWT_BEARER When the credential expires. Always set; a credential cannot be created without an expiry.
"2023-03-22T20:23:11.285067Z"
The unique ID of the credential.
"1234abcd-1234-1234-abcd-12345678abcd"
A human-readable name for the credential.
"ci signer"
The ID of the service account the credential belongs to.
"abcd1234-abcd-abcd-1234-abcdef123456"
An optional longer description.
When the credential was disabled; unset if active.