opschain admin service-accounts disable
Included from Basic tier
opschain admin service-accounts disable <username>
Disables a service account: every trigger and scheduled activity that runs
as it refuses firing-time identity resolution until the
account is re-enabled or the automations are reassigned. The verb rides the
shared v2 UserService.DisableUser lifecycle lane (admin-gated, step-up
floor) with the provider pinned to service_account, so a same-named human
row can never be addressed by mistake. A service account holds no
credentials, so there is nothing to revoke — the disable is purely the
firing-time refusal.
After the disable the verb warns which standing automations are now
stranded, exactly like admin users disable:
opschain admin service-accounts disable deploy-bot
Disabled deploy-bot (provider service_account)
Warning: deploy-bot's standing automations will refuse firing until reassigned (see 'opschain admin users reassign-automations'):
triggers (1): nightly-deploy
-o json|yaml prints the updated user document, owned_automations
included.
Flags
| Flag | Meaning |
|---|---|
--server <url> | Server base URL (default: the active context / OPSCHAIN_SERVER). |
--auth-token <token> | Admin bearer token override (default: your opschain login session, then $OPSCHAIN_ADMIN_TOKEN, then the token stored by opschain admin login). |
Exit codes: 0 on success, 1 when the service account does not exist or the token is rejected, 2 for the connection usage errors.
See also
opschain docs cli/admin-service-accounts-enable— the inverse.opschain docs cli/admin-users-reassign-automations— repoint its automations onto another service account.