serviceaccount

cpln serviceaccount — Manage service accounts used for programmatic API access.

Manage service accounts

For a detailed overview, please visit the service account’s reference page.

cpln serviceaccount [SUBCOMMAND]

Commands:
  cpln serviceaccount access-report <ref>  Show the access report for the referenced service account
  cpln serviceaccount add-key <ref>        Add a key to the reference service account
  cpln serviceaccount audit [ref]          Retrieve audit trail events for the referenced service account
  cpln serviceaccount clone <ref>          Create a clone of the referenced service account; this will only duplicate its spec.  [aliases: copy]
  cpln serviceaccount create               Create a new service account
  cpln serviceaccount delete <ref...>      Delete one or more referenced service accounts
  cpln serviceaccount edit <ref>           Edit the referenced service account, as YAML, within an editor
  cpln serviceaccount eventlog <ref>       Show the event log of the referenced service account  [aliases: log]
  cpln serviceaccount get [ref...]         Retrieve one or more referenced service accounts
  cpln serviceaccount patch <ref>          Update the referenced service account's metadata using an input file
  cpln serviceaccount permissions          Show the grantable permissions for a service account object type
  cpln serviceaccount query                Find all the service accounts based on the given query
  cpln serviceaccount remove-key <ref>     Remove a key from the reference service account
  cpln serviceaccount tag <ref...>         Manage the tags belonging to one or more referenced service accounts

Options:
  --help  Show help  [boolean]

---

serviceaccount access-report

Show the access report for the referenced service account

Usage

cpln serviceaccount access-report <ref> [OPTIONS]

Reference

Positionals:
  ref  The resource reference. Usually it is the name of the resource.  [required]

Context options:
  --profile  Override the profile. The default profile can be set using the `cpln profile set-default` command or by setting the CPLN_PROFILE environment variable
  --org      Override the organization. The default organization can be set in your profile by using the `cpln profile update` command

Format options:
  --output, -o  Set the output format  [choices: "text", "json", "yaml", "json-slim", "yaml-slim", "tf", "crd", "names"]
  --color       Colorize the output  [boolean] [default: true]
  --ts          Timestamp format if the output format is text (e.g., --output=text)  [choices: "iso", "local", "age"]
  --max         Maximum number of records to show. A value less than 1 will return all records.  [number] [default: 50]

Request options:
  --token         Override the authorization token
  --endpoint      Override the API URL
  --insecure, -k  Ignore TLS errors  [boolean]

Debug options:
  --verbose, -v  Enable verbose output to stderr  [boolean] [default: false]
  --debug, -d    Show all HTTP communications  [boolean] [default: false]

Options:
  --help  Show help  [boolean]

Common Options Reference

Example

Command

cpln serviceaccount access-report demo-service-account --org demo-cpln-organization

---

serviceaccount add-key

Add a key to the reference service account

Usage

cpln serviceaccount add-key <ref> --description KEY_DESCRIPTION [OPTIONS]

Reference

Positionals:
  ref  The resource reference. Usually it is the name of the resource.  [required]

Command options:
  --description, --desc  Short description for the new key  [required]

Context options:
  --profile  Override the profile. The default profile can be set using the `cpln profile set-default` command or by setting the CPLN_PROFILE environment variable
  --org      Override the organization. The default organization can be set in your profile by using the `cpln profile update` command

Format options:
  --output, -o  Set the output format  [choices: "text", "json", "yaml", "json-slim", "yaml-slim", "tf", "crd", "names"]
  --color       Colorize the output  [boolean] [default: true]
  --ts          Timestamp format if the output format is text (e.g., --output=text)  [choices: "iso", "local", "age"]
  --max         Maximum number of records to show. A value less than 1 will return all records.  [number] [default: 50]

Request options:
  --token         Override the authorization token
  --endpoint      Override the API URL
  --insecure, -k  Ignore TLS errors  [boolean]

Debug options:
  --verbose, -v  Enable verbose output to stderr  [boolean] [default: false]
  --debug, -d    Show all HTTP communications  [boolean] [default: false]

Options:
  --help  Show help  [boolean]

Common Options Reference

Example

The ‘key’ property returned from the add-key command will only be displayed once. There is no way to retrieve the key in the future.

Command

cpln serviceaccount add-key demo-service-account --desc demo-key --org demo-cpln-organization

---

serviceaccount audit

Retrieve audit trail events for the referenced service account

Usage

cpln serviceaccount audit [ref] [OPTIONS]

Reference

Positionals:
  ref  The resource reference. Usually it is the name of the resource.

Command options:
  --subject  Filter by subject (serviceaccount name or user email)  [string]
  --context  Audit context name (the 'cpln' context displays Control Plane actions)  [string] [default: "cpln"]
  --since    Relative lookback window from now (e.g., 1h, 24h, 7d). Mutually exclusive with --from/--to  [string] [default: "7d"]
  --from     Start time for audit events (ISO 8601 format or relative duration, e.g., 2025-10-23T07:00:00Z, 7d, 1h). Cannot be used with --since  [string]
  --to       End time for audit events (ISO 8601 format or relative duration, e.g., 2025-10-23T07:00:00Z, 1d, 30m)  [string]

Context options:
  --profile  Override the profile. The default profile can be set using the `cpln profile set-default` command or by setting the CPLN_PROFILE environment variable
  --org      Override the organization. The default organization can be set in your profile by using the `cpln profile update` command

Format options:
  --output, -o  Set the output format  [choices: "text", "json", "yaml", "json-slim", "yaml-slim", "tf", "crd", "names"]
  --color       Colorize the output  [boolean] [default: true]
  --ts          Timestamp format if the output format is text (e.g., --output=text)  [choices: "iso", "local", "age"]
  --max         Maximum number of records to show. A value less than 1 will return all records.  [number] [default: 50]

Request options:
  --token         Override the authorization token
  --endpoint      Override the API URL
  --insecure, -k  Ignore TLS errors  [boolean]

Debug options:
  --verbose, -v  Enable verbose output to stderr  [boolean] [default: false]
  --debug, -d    Show all HTTP communications  [boolean] [default: false]

Options:
  --help  Show help  [boolean]

Common Options Reference

---

serviceaccount clone

Create a clone of the referenced service account; this will only duplicate its spec.

Usage

cpln serviceaccount clone <ref> --name CLONE_NAME [OPTIONS]

Reference

Positionals:
  ref  The resource reference. Usually it is the name of the resource.  [required]

Command options:
  --name         Set the name for the clone  [required]
  --description  Optional description, defaults to the name if not set
  --tag          Attach tags (e.g., --tag drink=water)

Context options:
  --profile  Override the profile. The default profile can be set using the `cpln profile set-default` command or by setting the CPLN_PROFILE environment variable
  --org      Override the organization. The default organization can be set in your profile by using the `cpln profile update` command

Format options:
  --output, -o  Set the output format  [choices: "text", "json", "yaml", "json-slim", "yaml-slim", "tf", "crd", "names"]
  --color       Colorize the output  [boolean] [default: true]
  --ts          Timestamp format if the output format is text (e.g., --output=text)  [choices: "iso", "local", "age"]
  --max         Maximum number of records to show. A value less than 1 will return all records.  [number] [default: 50]

Request options:
  --token         Override the authorization token
  --endpoint      Override the API URL
  --insecure, -k  Ignore TLS errors  [boolean]

Debug options:
  --verbose, -v  Enable verbose output to stderr  [boolean] [default: false]
  --debug, -d    Show all HTTP communications  [boolean] [default: false]

Options:
  --help  Show help  [boolean]

Common Options Reference

Example

Command

cpln serviceaccount clone demo-service-account --name demo-service-account-clone --org demo-cpln-organization

---

serviceaccount create

Create a new service account

Usage

cpln serviceaccount create --name SERVICE_ACCOUNT_NAME [OPTIONS]

Reference

Command options:
  --name                 Name of the new secret  [required]
  --description, --desc  Optional description, defaults to the name if not set
  --tag                  Attach tags (e.g., --tag drink=water)

Context options:
  --profile  Override the profile. The default profile can be set using the `cpln profile set-default` command or by setting the CPLN_PROFILE environment variable
  --org      Override the organization. The default organization can be set in your profile by using the `cpln profile update` command

Format options:
  --output, -o  Set the output format  [choices: "text", "json", "yaml", "json-slim", "yaml-slim", "tf", "crd", "names"]
  --color       Colorize the output  [boolean] [default: true]
  --ts          Timestamp format if the output format is text (e.g., --output=text)  [choices: "iso", "local", "age"]
  --max         Maximum number of records to show. A value less than 1 will return all records.  [number] [default: 50]

Request options:
  --token         Override the authorization token
  --endpoint      Override the API URL
  --insecure, -k  Ignore TLS errors  [boolean]

Debug options:
  --verbose, -v  Enable verbose output to stderr  [boolean] [default: false]
  --debug, -d    Show all HTTP communications  [boolean] [default: false]

Options:
  --help  Show help  [boolean]

Common Options Reference

Example

Command

cpln serviceaccount create --name demo-service-account --desc demo-service-account --tag drink=water --org demo-cpln-organization

---

serviceaccount delete

Delete one or more referenced service accounts

Usage

cpln serviceaccount delete <ref...> [OPTIONS]

Deleting a service account will remove all associated keys

Reference

Positionals:
  ref  One or more resource references. Usually it is the name of the resource.  [array] [required] [default: []]

Context options:
  --profile  Override the profile. The default profile can be set using the `cpln profile set-default` command or by setting the CPLN_PROFILE environment variable
  --org      Override the organization. The default organization can be set in your profile by using the `cpln profile update` command

Format options:
  --output, -o  Set the output format  [choices: "text", "json", "yaml", "json-slim", "yaml-slim", "tf", "crd", "names"]
  --color       Colorize the output  [boolean] [default: true]
  --ts          Timestamp format if the output format is text (e.g., --output=text)  [choices: "iso", "local", "age"]
  --max         Maximum number of records to show. A value less than 1 will return all records.  [number] [default: 50]

Request options:
  --token         Override the authorization token
  --endpoint      Override the API URL
  --insecure, -k  Ignore TLS errors  [boolean]

Debug options:
  --verbose, -v  Enable verbose output to stderr  [boolean] [default: false]
  --debug, -d    Show all HTTP communications  [boolean] [default: false]

Options:
  --help  Show help  [boolean]

Common Options Reference

Example

Command

cpln serviceaccount delete demo-service-account --org demo-cpln-organization

---

serviceaccount edit

Edit the referenced service account, as YAML, within an editor

Usage

cpln serviceaccount edit <ref> [OPTIONS]

The default editor can be set by using the EDITOR environment variable.

Reference

Positionals:
  ref  The resource reference. Usually it is the name of the resource.  [required]

Command options:
  --replace, -r  Replace instead of patch/merge  [boolean] [default: false]

Context options:
  --profile  Override the profile. The default profile can be set using the `cpln profile set-default` command or by setting the CPLN_PROFILE environment variable
  --org      Override the organization. The default organization can be set in your profile by using the `cpln profile update` command

Format options:
  --output, -o  Set the output format  [choices: "text", "json", "yaml", "json-slim", "yaml-slim", "tf", "crd", "names"]
  --color       Colorize the output  [boolean] [default: true]
  --ts          Timestamp format if the output format is text (e.g., --output=text)  [choices: "iso", "local", "age"]
  --max         Maximum number of records to show. A value less than 1 will return all records.  [number] [default: 50]

Request options:
  --token         Override the authorization token
  --endpoint      Override the API URL
  --insecure, -k  Ignore TLS errors  [boolean]

Debug options:
  --verbose, -v  Enable verbose output to stderr  [boolean] [default: false]
  --debug, -d    Show all HTTP communications  [boolean] [default: false]

Options:
  --help  Show help  [boolean]

Common Options Reference

Example

Command

cpln serviceaccount edit demo-service-account --org demo-cpln-organization

---

serviceaccount eventlog

Show the event log of the referenced service account

Usage

cpln serviceaccount eventlog <ref> [OPTIONS]

Reference

Positionals:
  ref  The resource reference. Usually it is the name of the resource.  [required]

Context options:
  --profile  Override the profile. The default profile can be set using the `cpln profile set-default` command or by setting the CPLN_PROFILE environment variable
  --org      Override the organization. The default organization can be set in your profile by using the `cpln profile update` command

Format options:
  --output, -o  Set the output format  [choices: "text", "json", "yaml", "json-slim", "yaml-slim", "tf", "crd", "names"]
  --color       Colorize the output  [boolean] [default: true]
  --ts          Timestamp format if the output format is text (e.g., --output=text)  [choices: "iso", "local", "age"]
  --max         Maximum number of records to show. A value less than 1 will return all records.  [number] [default: 50]

Request options:
  --token         Override the authorization token
  --endpoint      Override the API URL
  --insecure, -k  Ignore TLS errors  [boolean]

Debug options:
  --verbose, -v  Enable verbose output to stderr  [boolean] [default: false]
  --debug, -d    Show all HTTP communications  [boolean] [default: false]

Options:
  --help  Show help  [boolean]

Common Options Reference

Example

Command

cpln serviceaccount eventlog demo-service-account --org demo-cpln-organization

---

serviceaccount get

Retrieve one or more referenced service accounts

Usage

cpln serviceaccount get [ref...] [OPTIONS]

An empty reference will return all references

Reference

Positionals:
  ref  One or more resource references. Usually it is the name of the resource.  [array] [default: []]

Context options:
  --profile  Override the profile. The default profile can be set using the `cpln profile set-default` command or by setting the CPLN_PROFILE environment variable
  --org      Override the organization. The default organization can be set in your profile by using the `cpln profile update` command

Format options:
  --output, -o  Set the output format  [choices: "text", "json", "yaml", "json-slim", "yaml-slim", "tf", "crd", "names"]
  --color       Colorize the output  [boolean] [default: true]
  --ts          Timestamp format if the output format is text (e.g., --output=text)  [choices: "iso", "local", "age"]
  --max         Maximum number of records to show. A value less than 1 will return all records.  [number] [default: 50]

Request options:
  --token         Override the authorization token
  --endpoint      Override the API URL
  --insecure, -k  Ignore TLS errors  [boolean]

Debug options:
  --verbose, -v  Enable verbose output to stderr  [boolean] [default: false]
  --debug, -d    Show all HTTP communications  [boolean] [default: false]

Options:
  --help  Show help  [boolean]

Common Options Reference

Example

• Get all service accounts

Command

cpln serviceaccount get --org demo-cpln-organization

• Get one service account

Command

cpln serviceaccount get demo-service-account-get-1 --org demo-cpln-organization

• Get multiple service accounts

Command

cpln serviceaccount get demo-service-account-get-1 demo-service-account-get-2 --org demo-cpln-organization

---

serviceaccount patch

Update the referenced service account’s metadata using an input file

Usage

cpln serviceaccount patch <ref> --file FILE_NAME [OPTIONS]

Running this command with the option --file - sets the input to stdin. The input is required to be a valid JSON or YAML string (e.g., {"description": "My new description"} or description: My new description). To complete the update, press Control-D (or Control-Z if you are using Windows).

Reference

Positionals:
  ref  The resource reference. Usually it is the name of the resource.  [required]

Command options:
  --file, -f  File to load the patch from. Use `--file -` to enable input from stdin.  [required]

Context options:
  --profile  Override the profile. The default profile can be set using the `cpln profile set-default` command or by setting the CPLN_PROFILE environment variable
  --org      Override the organization. The default organization can be set in your profile by using the `cpln profile update` command

Format options:
  --output, -o  Set the output format  [choices: "text", "json", "yaml", "json-slim", "yaml-slim", "tf", "crd", "names"]
  --color       Colorize the output  [boolean] [default: true]
  --ts          Timestamp format if the output format is text (e.g., --output=text)  [choices: "iso", "local", "age"]
  --max         Maximum number of records to show. A value less than 1 will return all records.  [number] [default: 50]

Request options:
  --token         Override the authorization token
  --endpoint      Override the API URL
  --insecure, -k  Ignore TLS errors  [boolean]

Debug options:
  --verbose, -v  Enable verbose output to stderr  [boolean] [default: false]
  --debug, -d    Show all HTTP communications  [boolean] [default: false]

Options:
  --help  Show help  [boolean]

Common Options Reference

Example

Command

cpln serviceaccount patch demo-service-account --file update.json --org demo-cpln-organization

---

serviceaccount permissions

Show the grantable permissions for a service account object type

Usage

cpln serviceaccount permissions [OPTIONS]

Reference

Context options:
  --profile  Override the profile. The default profile can be set using the `cpln profile set-default` command or by setting the CPLN_PROFILE environment variable
  --org      Override the organization. The default organization can be set in your profile by using the `cpln profile update` command

Format options:
  --output, -o  Set the output format  [choices: "text", "json", "yaml", "json-slim", "yaml-slim", "tf", "crd", "names"]
  --color       Colorize the output  [boolean] [default: true]
  --ts          Timestamp format if the output format is text (e.g., --output=text)  [choices: "iso", "local", "age"]
  --max         Maximum number of records to show. A value less than 1 will return all records.  [number] [default: 50]

Request options:
  --token         Override the authorization token
  --endpoint      Override the API URL
  --insecure, -k  Ignore TLS errors  [boolean]

Debug options:
  --verbose, -v  Enable verbose output to stderr  [boolean] [default: false]
  --debug, -d    Show all HTTP communications  [boolean] [default: false]

Options:
  --help  Show help  [boolean]

Common Options Reference

Example

Command

cpln serviceaccount permissions --org demo-cpln-organization

---

serviceaccount query

Find all the service accounts based on the given query

Usage

cpln serviceaccount query QUERY_OPTIONS [OPTIONS]

Reference

Query options:
  --match             Query filter type  [choices: "all", "none", "any"] [default: "all"]
  --property, --prop  Property to query
  --tag               Tag to query
  --rel               Relation to query

Context options:
  --profile  Override the profile. The default profile can be set using the `cpln profile set-default` command or by setting the CPLN_PROFILE environment variable
  --org      Override the organization. The default organization can be set in your profile by using the `cpln profile update` command

Format options:
  --output, -o  Set the output format  [choices: "text", "json", "yaml", "json-slim", "yaml-slim", "tf", "crd", "names"]
  --color       Colorize the output  [boolean] [default: true]
  --ts          Timestamp format if the output format is text (e.g., --output=text)  [choices: "iso", "local", "age"]
  --max         Maximum number of records to show. A value less than 1 will return all records.  [number] [default: 50]

Request options:
  --token         Override the authorization token
  --endpoint      Override the API URL
  --insecure, -k  Ignore TLS errors  [boolean]

Debug options:
  --verbose, -v  Enable verbose output to stderr  [boolean] [default: false]
  --debug, -d    Show all HTTP communications  [boolean] [default: false]

Options:
  --help  Show help  [boolean]

Common Options Reference

Example

Use the --match option to display all, none, or any of the results based on a given property or tag

• Search for a service account based on the name property

Command

cpln serviceaccount query --match any --prop name=demo-service-account --org demo-cpln-organization

• Search for a service account based on the description property

Command

cpln serviceaccount query --match any --prop description="demo-service-account" --org demo-cpln-organization

• Search for a service account based on a tag

Command

cpln serviceaccount query --match any --tag drink=water --org demo-cpln-organization

• Search for a service account based on a property and tag

Command

cpln serviceaccount query --match any --prop description="demo-service-account" --tag drink=water --org demo-cpln-organization

---

serviceaccount remove-key

Remove a key from the reference service account

Usage

cpln serviceaccount remove-key <ref> --key KEY_TO_REMOVE [OPTIONS]

Reference

Positionals:
  ref  The resource reference. Usually it is the name of the resource.  [required]

Command options:
  --key  Name of the key to remove. Can be repeated.  [required]

Context options:
  --profile  Override the profile. The default profile can be set using the `cpln profile set-default` command or by setting the CPLN_PROFILE environment variable
  --org      Override the organization. The default organization can be set in your profile by using the `cpln profile update` command

Format options:
  --output, -o  Set the output format  [choices: "text", "json", "yaml", "json-slim", "yaml-slim", "tf", "crd", "names"]
  --color       Colorize the output  [boolean] [default: true]
  --ts          Timestamp format if the output format is text (e.g., --output=text)  [choices: "iso", "local", "age"]
  --max         Maximum number of records to show. A value less than 1 will return all records.  [number] [default: 50]

Request options:
  --token         Override the authorization token
  --endpoint      Override the API URL
  --insecure, -k  Ignore TLS errors  [boolean]

Debug options:
  --verbose, -v  Enable verbose output to stderr  [boolean] [default: false]
  --debug, -d    Show all HTTP communications  [boolean] [default: false]

Options:
  --help  Show help  [boolean]

Common Options Reference

Example

• For the example below, the created service account key is:

+---------------------+---------------------+--------+--------+-----+--------------+
|NAME                 |DESCRIPTION          |CREATED |ORIGIN  |KEYS |TAGS          |
|---------------------|---------------------|--------|--------|-----|--------------|
|demo-service-account |demo-service-account |Now     |default |     |drink="water" |
+---------------------+---------------------+--------+--------+-----+--------------+

• Remove key

Command

cpln serviceaccount remove-key demo-service-account --key sASZzPsODwqBITpY --org demo-cpln-organization

---

serviceaccount tag

Manage the tags belonging to one or more referenced service accounts

Usage

cpln serviceaccount tag <ref...> --tag KEY=VALUE [OPTIONS]

Built-in tags, which begin with cpln/*, can’t be modified.

Reference

Positionals:
  ref  One or more resource references. Usually it is the name of the resource.  [array] [required] [default: []]

Command options:
  --tag         Attach tags (e.g., --tag drink=water)
  --remove-tag  Remove tags (e.g., --remove-tag tagname)

Context options:
  --profile  Override the profile. The default profile can be set using the `cpln profile set-default` command or by setting the CPLN_PROFILE environment variable
  --org      Override the organization. The default organization can be set in your profile by using the `cpln profile update` command

Format options:
  --output, -o  Set the output format  [choices: "text", "json", "yaml", "json-slim", "yaml-slim", "tf", "crd", "names"]
  --color       Colorize the output  [boolean] [default: true]
  --ts          Timestamp format if the output format is text (e.g., --output=text)  [choices: "iso", "local", "age"]
  --max         Maximum number of records to show. A value less than 1 will return all records.  [number] [default: 50]

Request options:
  --token         Override the authorization token
  --endpoint      Override the API URL
  --insecure, -k  Ignore TLS errors  [boolean]

Debug options:
  --verbose, -v  Enable verbose output to stderr  [boolean] [default: false]
  --debug, -d    Show all HTTP communications  [boolean] [default: false]

Options:
  --help  Show help  [boolean]

Common Options Reference

Example

• Add a tag to a service account

Command

cpln serviceaccount tag demo-service-account-tag-1 --tag drink=water --org demo-cpln-organization

• Update same tag (after running the example above)

Command

cpln serviceaccount tag demo-service-account-tag-1 --tag drink=coffee --org demo-cpln-organization

• Remove tag (after running the example above)

Command

cpln serviceaccount tag demo-service-account-tag-1 --remove drink --org demo-cpln-organization

• Add same tag to multiple service accounts

Command

cpln serviceaccount tag demo-service-account-tag-1 demo-service-account-tag-2 --tag multiple-serviceaccounts=true --org demo-cpln-organization

• Update same tag on multiple service accounts (after running the example above)

Command

cpln serviceaccount tag demo-service-account-tag-1 demo-service-account-tag-2 --tag multiple-serviceaccounts=demo-serviceaccount --org demo-cpln-organization

• Remove same tag from multiple service accounts (after running the example above)

Command

cpln serviceaccount tag demo-service-account-tag-1 demo-service-account-tag-2 --remove multiple-serviceaccounts --org demo-cpln-organization

---