Changes

Extends service account support to cover all API levels and adds missing CRUD operations. Closes #2812. Supersedes #3109.

Instance-level service accounts (gl.service_accounts)

• List: GET /service_accounts
• Create: POST /service_accounts
• Update: PATCH /service_accounts/:id (via .update() or .save())

Group-level service accounts (group.service_accounts)

• Added update support: PATCH /groups/:id/service_accounts/:user_id
• Added email parameter to create/update
• Added order_by / sort list filters
• Added personal access token sub-resource (service_account.access_tokens):
  list, create, delete, rotate — mirrors group access tokens

Project-level service accounts (project.service_accounts)

• Full CRUD: list, create, update (PATCH), delete
• Personal access token sub-resource (service_account.access_tokens): list, create, delete, rotate

Usage

# Instance level
sa = gl.service_accounts.create({"name": "bot", "username": "my-bot"})
sa.name = "renamed-bot"
sa.save()

# Group level
sa = group.service_accounts.create({"name": "ci-bot"})
token = sa.access_tokens.create({"name": "ci-token", "scopes": ["api"], "expires_at": "2026-01-01"})
token.rotate()
sa.delete()

# Project level
sa = project.service_accounts.create({"name": "deploy-bot"})
token = sa.access_tokens.create({"name": "deploy-bot-token", "scopes": ["read_repository"]})
project.service_accounts.delete(sa.id)

Notes

• No GetMixin is added at any level. The API exposes list-only, not fetch-by-id.
• Subgroup-level is covered by the group-level implementation (subgroups are groups in GitLab's data model).

Documentation and testing

• Documentation in the matching docs section
• Unit tests and/or functional tests