Service Accounts

---

Service Accounts are designed for non-interactive, programmatic access to WebAccess/DMP, such as automation scripts and API integrations. They bypass two-factor authentication (2FA), allowing them to operate autonomously without human intervention. A Service Account can be granted access to multiple companies while maintaining a strict ownership model, where only the owner company can manage the account's credentials and description.

Key Characteristics

No UI Access: Service accounts cannot sign in to the web user interface or the Swagger UI. They are used exclusively for authenticated API calls and automated scripts.

Bypass 2FA: Because service accounts are intended for non-interactive, machine-to-machine communication, they bypass two-factor authentication (2FA). This allows scripts to run autonomously without requiring a human to provide a secondary authentication code.

User Roles: Service accounts support the same permission model as regular users. You can assign permissions to them individually or assign them to a Role to inherit a predefined set of permissions.

Authenticating from scripts

The python API client can authenticate only as a Service Account. Interactive user accounts can no longer be used to authenticate from scripts.

Ownership and Cross-Company Access

Service accounts can manage resources across company boundaries while maintaining a strict ownership model.

Owner Company

Each service account is owned by exactly one company. Only users with the appropriate permission in the owner company can:

• Modify the account description.
• Reset or change the password (credentials).
• Delete the service account.

Cross-Company Permissions

A service account can be granted access to multiple companies. This is useful, for example, for managed service providers (MSPs) that use a single automation script to manage routers across several customer environments.

Managing Service Accounts in the UI

The Service Accounts page provides a centralized table of all service accounts for the currently active company. This section is available under User Management in the context menu.

Visual Distinction

The interface distinguishes between accounts owned by your company and accounts that only have access to it:

• Owned Accounts: Full management capabilities are available.
• External Accounts: Accounts owned by another company that have been granted access to your resources.

Permission Management

If your active company is not the owner of a service account, management is limited to your own scope. You can:

• Edit Permissions: Change what the service account is allowed to do within your company.
• Remove Access: Revoke the account’s permissions for your company entirely.

You cannot delete the account or change its credentials unless your company is the owner.

Create a New Service Account

• Enter a Service Account name.
• Set a password that meets the security requirements (at least 8 characters, including one uppercase letter, one number, and one special character).
• Optionally provide a description.
• Select the companies the Service Account will belong to.
• Assign the required permissions.