| Dev PortalService accounts for Polaris
Learn how to create and manage service accounts for Polaris.
Overview
Service accounts are a type of account used to perform automated tasks on behalf of a user or application. They are typically used in scenarios where a user is not present to provide authentication, such as in CI/CD pipelines or automated scripts.
Service accounts have their own set of credentials (tokens) that can be used for authentication.
In Polaris, service accounts are managed by Organization Administrators, who can create and delete service accounts as needed.
Service account token expiration
Service account tokens expire after one year from the creation date, and will also expire if unused for 30 days. You'll need to create new tokens before expiration to ensure your automated processes continue to function without interruption.
Monitor service account usage
Organization Administrators can monitor service account activity on the Audit Logs page (). When an action is performed using a service account token, the service account's friendly name appears in the Token Name column. Select Service Account Tokens using the Event Type dropdown to view events related to service accounts.
Using service account tokens
Service account tokens function identically to user access tokens for authentication purposes. After you create a service account and assign it a global or application-level role, you can use the service account's token for:
- Authentication in requests made to Polaris APIs.
- Authentication in CI pipelines that use the Bridge CLI (and Black Duck Security Scan plugins).
Create a service account
To create a service account, follow these steps:
By default, service accounts are created without permissions. Before the account can be used, you must assign it a role. See Assign a role to a service account for more information.
Assign a role to a service account
To grant a service account access to all of the applications in your portfolio, assign the service account a global (organization-level) role.
Alternatively, you can grant a service account access to specific applications in your portfolio, and assign the service account an application-level role (including custom roles) for each application.
Assign a global role to a service account
To assign a global role to a service account, follow these steps:
Assign application-level roles to a service account
Get a service account's metadata
Get a service account's metadata using the GET /api/auth/service-account-tokens/{tokenId} endpoint.
curl --location 'https://polaris.blackduck.com/api/auth/service-account-tokens/04f59be3-de78-4c2a-bfed-22fabc6975da' \
--header 'accept: application/vnd.polaris.auth.service-account-token-1+json' \
--header 'Api-Token: {polarisAccessToken}'The service account ID (token ID) is passed as a path parameter, after service-account-tokens/.
The response will include details about the token, including its expiration date.
{
"id": "04f59be3-de78-4c2a-bfed-22fabc6975da",
"name": "exampleServiceAccount",
"expiryDate": "2026-09-16T18:44:01.687Z",
"lastAccessed": null,
"_type": "service-account-token",
"_links": [
{
"href": "https://polaris.blackduck.com/service-account-tokens/04f59be3-de78-4c2a-bfed-22fabc6975da",
"rel": "self",
"method": "GET"
}
]
}Delete a service account
To delete a service account, follow these steps:
DELETE /api/auth/service-account-tokens/{tokenId} endpoint.
curl --location --request DELETE 'https://polaris.blackduck.com/api/auth/service-account-tokens/04f59be3-de78-4c2a-bfed-22fabc6975da' \
--header 'accept: */*' \
--header 'Api-Token: {polarisAccessToken}'The service account ID (token ID) is passed as a path parameter, after service-account-tokens/.
A successful delete operation will return a 204 No Content response.