Service Accounts

You can use Censys Platform service accounts to connect applications with Platform APIs without using a personal user account.

In contrast with Personal Access Tokens and Connected Apps, Platform service accounts are managed at the organization level. Service accounts have API access to the module roles you explicitly grant to them. Service accounts do not consume a seat.

Platform service accounts use the OAuth 2 standard client credentials flow.

Service accounts are only available to organizations on the Censys Search or Censys Core plans.

Create a service account

To create a service account, your account must have the Platform Admin role.

1. In the Censys Platform web console, go to Organization Settings > Service Accounts.

2. Click + Create service account.

3. On the New Service Account panel, enter a name for your service account and select the module roles for it. Assign the minimum permissions necessary for the account’s scope. At least one module role is required.

   

4. Click Create service account.

5. Copy the Client Secret and store it in a secure location. It will not be shown again.

   

6. Note the Access Token URL and Client ID. These can be retrieved from the Service Accounts page at any time.

Use a service account

The configuration process for adding a service account to another app varies. Typically, when configuring an API conection, you must configure OAuth as the authentication type, client credentials as the grant type, and provide your service account's client ID, client secret, and the access token URL.

Some integrations or use-cases require you to manually define the grant type, scope, and audience for a service account. The values for these parameters are provided in the table below.

Service accounts and organization ID

Many Censys API endpoints require an organization ID as a query parameter. You may need to configure your organization ID to be passed as a query parameter when using a service account. For use with integrations like the Platform integration with SentinelOne, you can add your organization ID as a global variable that is passed as a query parameter.

To obtain your organization ID:

1. Open the Platform web console and ensure that your organization account is selected. Go to Settings > Account Management > Personal Access Tokens.

2. The ID for your organization is shown in the "Current Organization" box. Click Copy to copy it to your clipboard.

   

Service account management

To manage existing sevice accounts, your account must have the Platform Admin role.

1. In the Censys Platform web console, go to Organization Settings > Service Accounts.

2. On the row for a service account, click the three-dot menu icon.

   
   • Click the edit icon to change the account's name or module rules.
   • Click the rotate icon to rotate the account's secret. Any existing configuration using the old secret will stop working. Save the new secret in a secure location.
   • Click the trash icon to delete the account.

Service account activity in the audit log

All service account activity is added to the audit log.

Service account credit usage is not shown on the Credit Management page. To retrieve it, call the get organization credit usage API endpoint with include_consumer_breakdown=true. Each service account's usage appears under credits_consumed_by_consumer, keyed by its service account ID.