Create and manage service users

Service users are managed in the admin console, next to the people of your organization. This page walks you through each step. No programming is needed; your developers will only need the credentials you create afterwards.

Before you start

Permissions. You need permission to manage service users in your organization. If you don’t see the Service Users tab, or can’t create or edit service users, ask an administrator of your organization.
Know what the integration needs. Find out which data the integration reads or changes. You will use that to choose the role with the least access that still lets it work.

Find the service users of your organization

Sign in to the admin console.
In the sidebar, select Users.
Select the Service Users tab.

The list shows every service user with its Administrative role, Status and creation date. You can search by name and filter by role or status. Select a row to open the service user.

Create a service user

In the sidebar, select Users, then New user.
In User type, choose Service user.
Enter a Name that identifies the integration, for example “HR sync” or “Backup Service”. Names must be unique in the organization.
Choose an Administrative role (see below).
Select Create service user.

The service user is created as Active, without credentials. Next, create a credential so the integration can authenticate.

Choose a role

Like people, service users have an administrative role that defines what they can do in the organization. Choose the role with the least access that still covers what the integration does. Service users can have any role except Owner.

Role	What it allows	Typical integration
Auditor	Read-only access to the organization, including audit logs.	Reporting, compliance exports, reacting to webhooks
SCIM Provisioner	Create, update and remove users and groups, and manage group members. Nothing else.	HR platform or directory that provisions users
Helpdesk	View users and groups, and handle managed users’ MFA and sessions.	Internal support tools
Billing	Manage billing.	Finance tools
Administrator	Manage the organization, users, groups, applications, billing and audit logs.	Only when nothing narrower works

To see exactly what each role can do, select View role definitions in the form.

Tip: if you have several integrations, create one service user for each. Each one then has only the access it needs, and you can deactivate one without affecting the others.

Edit a service user

Open the service user from the Service Users tab.
Select Edit.
Change the name, role or status, then select Save changes.

A new role applies to the service user’s next API request.

Deactivate or reactivate a service user

To stop an integration immediately, deactivate its service user:

Open the service user from the Service Users tab.
On the Overview tab, select Change status and choose Inactive.

While a service user is Inactive:

it can’t obtain new access tokens, whatever the state of its credentials;
the API refuses requests made with tokens it already holds, even if they have not expired.

Its credentials are kept. When you set the status back to Active, the integration can authenticate again with its active credentials, without any change on its side.

Note: to stop just one deployment of an integration, such as a test environment, deactivate one of its credentials instead of the whole service user.

Delete a service user

Open the service user from the Service Users tab.
Select Delete.
In the Delete service user dialog, enter your current password to confirm.

Important: deleting a service user cannot be undone. All its credentials stop working, and any integration using them loses access immediately. If you may need it again, deactivate it instead.

Changes are audited

Creating, updating and deleting service users and their credentials are recorded in your organization’s Audit Logs, as is every access token a service user obtains. Actions a service user performs through the API are recorded under its name.