> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pctx.ai/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Use the exact commands, endpoints, and product terms in these docs. Commands that start with `pctx` mean the Port of Context platform CLI installed from pctx.ai, not the open-source tool of the same name.

# Service accounts

> Give scripts and CI scoped API access to your workspace.

A service account is a machine identity with its own API keys. Use one to publish indexed sources or sync the context map from CI. It acts with a member's access, narrowed to the permissions you pick.

## Create one

1. Open **Admin** → **Service accounts** and select **New service account**.
2. Give it a name and description, and tick the permissions it needs.
3. Select **Add** and copy the key. It is shown once.

## Permissions

| Permission | Allows |
| - | - |
| `org:context:read` | Read the context map and its rules |
| `org:context:write` | Add and edit entities, connections, domains, and map rules |
| `org:context:propose` | Submit map changes for a person to review |
| `org:context:restrict` | Restrict sharing on nodes it is allowed to manage |
| `org:corpus:read` | List indexed sources and their index status |
| `org:corpus:write` | Publish and manage indexed sources |
| `org:mcp:write` | Register and remove custom MCP servers |
| `org:connections:write` | Store credentials for connected services |
| `org:insights:read` | Read usage insights and gateway call logs |

Give an account the narrowest set that does its job. An account that should only suggest map changes needs `org:context:propose`, not `org:context:write`.

## Let it publish to a source

A key with `org:corpus:write` is not enough on its own. Open the source, select **Manage access**, and tick the account under **Publishers**.

## Rotate a key

1. Select **Add key** on the account. Existing keys keep working.
2. Update your script or CI secret with the new key.
3. Select **Revoke key** on the old one.

A revoked key can then be deleted. To retire an account, select **Revoke account**, then **Delete account**.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.