Service Identities

package goodmem // import "fury.io/pairsys/goodmem"

Production service identity creation, ownership, and lifecycle.

Methods are called as client.ServiceIdentities().<Method>(ctx, ...) on a *goodmem.Client. Service: ServiceIdentitiesService.

Index

type ServiceIdentitiesService
type CreateServiceIdentityRequest
type ServiceIdentityResponse
type ListServiceIdentitiesResponse
type TransferServiceIdentityOwnershipResponse
type UpdateServiceIdentityRequest

type ServiceIdentitiesService

type ServiceIdentitiesService struct{ … }

Access this service as client.ServiceIdentities() on a *goodmem.Client. Its methods follow.

func (s *ServiceIdentitiesService) Create

func (s *ServiceIdentitiesService) Create(ctx context.Context, req *models.CreateServiceIdentityRequest) (*models.ServiceIdentityResponse, error)

Creates one production-workload identity owned by the authenticated human. No API key, role, grant, or authentication mapping is created implicitly.

HTTP — POST /v1/service-identities

Parameters

ctx (context.Context) — carries the deadline and cancellation signal for the call.
req (*models.CreateServiceIdentityRequest) — the request payload. The linked type documents every field and its JSON wire name.

Returns — (*models.ServiceIdentityResponse, error)

Example

identity, err := client.ServiceIdentities().Create(ctx, &models.CreateServiceIdentityRequest{
	DisplayName: "production-indexer",
	Description: goodmem.Ptr("Indexes newly uploaded memories"),
	Labels:      map[string]string{"environment": "production"},
})
if err != nil {
	log.Fatal(err)
}
_ = identity.ServiceIdentityID

func (s *ServiceIdentitiesService) Get

func (s *ServiceIdentitiesService) Get(ctx context.Context, id string, params *ServiceIdentitiesGetParams) (*models.ServiceIdentityResponse, error)

Returns a service identity after applying READ_SERVICE_IDENTITY authority. includeDeleted permits an authorized caller to inspect a permanent tombstone; it does not grant additional authority.

HTTP — GET /v1/service-identities/{id}

Parameters

ctx (context.Context) — carries the deadline and cancellation signal for the call.
id (string) — Service-identity UUID
params (*ServiceIdentitiesGetParams, optional) — typed query parameters; pass nil for an empty filter set. The linked pkg.go.dev page lists every field.

Returns — (*models.ServiceIdentityResponse, error)

Example

fetchedIdentity, err := client.ServiceIdentities().Get(
	ctx,
	"your-service-identity-id",
	nil,
)
if err != nil {
	log.Fatal(err)
}
_ = fetchedIdentity.DisplayName

func (s *ServiceIdentitiesService) List

func (s *ServiceIdentitiesService) List(ctx context.Context, params *ServiceIdentitiesListParams) (*Page[models.ServiceIdentityResponse], error)

Requires LIST_SERVICE_IDENTITY on the GoodMem instance and READ_SERVICE_IDENTITY on each returned row. Owner and label filters, lifecycle filtering, authorization, and keyset pagination execute in PostgreSQL. LABEL FILTERS: Label filters accept either label.<key>=<value> or label[key]=value (for example, label.environment=production or label[environment]=production).

HTTP — GET /v1/service-identities

Parameters

ctx (context.Context) — carries the deadline and cancellation signal for the call.
params (*ServiceIdentitiesListParams, optional) — typed query parameters; pass nil for an empty filter set. The linked pkg.go.dev page lists every field.

Returns — (*Page[models.ServiceIdentityResponse], error)

Example

identities, err := client.ServiceIdentities().List(
	ctx,
	&goodmem.ServiceIdentitiesListParams{MaxResults: goodmem.Ptr(int32(25))},
)
if err != nil {
	log.Fatal(err)
}
for _, item := range identities.Items() {
	_ = item.DisplayName
}

func (s *ServiceIdentitiesService) Update

func (s *ServiceIdentitiesService) Update(ctx context.Context, id string, req *models.UpdateServiceIdentityRequest) (*models.ServiceIdentityResponse, error)

Updates only fields present in the request. Empty description clears that optional field. Ownership changes use the dedicated transfer endpoint.

HTTP — PUT /v1/service-identities/{id}

Parameters

ctx (context.Context) — carries the deadline and cancellation signal for the call.
id (string) — Service-identity UUID
req (*models.UpdateServiceIdentityRequest) — the request payload. The linked type documents every field and its JSON wire name.

Returns — (*models.ServiceIdentityResponse, error)

Example

updatedIdentity, err := client.ServiceIdentities().Update(
	ctx,
	"your-service-identity-id",
	&models.UpdateServiceIdentityRequest{
		Description: goodmem.Ptr("Indexes production knowledge sources"),
	},
)
if err != nil {
	log.Fatal(err)
}
_ = updatedIdentity.Description

func (s *ServiceIdentitiesService) Delete

func (s *ServiceIdentitiesService) Delete(ctx context.Context, id string) error

Permanently soft-deletes the principal. Its stored credentials remain audit records but can no longer authenticate because their subject is deleted. Repeating an authorized delete succeeds without rewriting audit data.

HTTP — DELETE /v1/service-identities/{id}

Parameters

ctx (context.Context) — carries the deadline and cancellation signal for the call.
id (string) — Service-identity UUID

Returns — error — nil on success.

Example

deleteIdentityErr := client.ServiceIdentities().Delete(
	ctx,
	"your-service-identity-id",
)
if deleteIdentityErr != nil {
	log.Fatal(deleteIdentityErr)
}

func (s *ServiceIdentitiesService) TransferOwnership

func (s *ServiceIdentitiesService) TransferOwnership(ctx context.Context, id string, req *models.TransferOwnershipRequest) (*models.TransferServiceIdentityOwnershipResponse, error)

Transfers administrative ownership to another active principal. A service identity cannot own itself. The service identity's subject, immutable creator, credentials, grants, and roles are unchanged.

HTTP — POST /v1/service-identities/{id}:transferOwnership

Parameters

ctx (context.Context) — carries the deadline and cancellation signal for the call.
id (string) — Service-identity UUID
req (*models.TransferOwnershipRequest) — the request payload. The linked type documents every field and its JSON wire name.

Returns — (*models.TransferServiceIdentityOwnershipResponse, error)

Example

transferred, err := client.ServiceIdentities().TransferOwnership(
	ctx,
	"your-service-identity-id",
	&models.TransferOwnershipRequest{
		NewOwnerID: "70e025f6-76ca-4cbe-b8fc-7dab8e84590a",
	},
)
if err != nil {
	log.Fatal(err)
}
_ = transferred.ServiceIdentity.OwnerPrincipalID

type CreateServiceIdentityRequest

type CreateServiceIdentityRequest struct{ … }

Creates a service identity owned by the authenticated human. It does not create credentials, roles, or grants.

ServiceIdentityID (string, optional, wire serviceIdentityId) — Optional client-provided UUID; generated by the server when omitted.
DisplayName (string, wire displayName) — Globally unique, nonblank operator-facing name.
Description (string, optional, wire description) — Optional operator description.
Labels (map[string]string, optional, wire labels) — Optional labels for organization and filtering. At most 20 entries; keys and values contain at most 255 characters; keys use [a-z0-9._-].

type ServiceIdentityResponse

type ServiceIdentityResponse struct{ … }

A durable production workload identity. Credentials, grants, and roles are separate resources and are not included.

ServiceIdentityID (string, wire serviceIdentityId) — OUTPUT_ONLY; immutable service-identity UUID.
DisplayName (string, wire displayName) — OUTPUT_ONLY; unique operator-facing display name.
Description (string, optional, wire description) — OUTPUT_ONLY; optional operator description.
OwnerPrincipalID (string, wire ownerPrincipalId) — OUTPUT_ONLY; current administrative owner principal UUID.
CreatorPrincipalID (string, wire creatorPrincipalId) — OUTPUT_ONLY; immutable HUMAN creator-principal UUID.
Labels (map[string]string, wire labels) — OUTPUT_ONLY; mutable labels. At most 20 entries; keys and values contain at most 255 characters; keys use [a-z0-9._-].
DeletedAt (int64, optional, wire deletedAt) — OUTPUT_ONLY; permanent deletion time in milliseconds, absent while active.
DeletedByID (string, optional, wire deletedById) — OUTPUT_ONLY; exact deleting actor UUID, absent while active.
CreatedAt (int64, wire createdAt) — OUTPUT_ONLY; creation time in milliseconds since the epoch.
UpdatedAt (int64, wire updatedAt) — OUTPUT_ONLY; most recent mutation time in milliseconds since the epoch.
CreatedByID (string, wire createdById) — OUTPUT_ONLY; exact creating actor UUID.
UpdatedByID (string, wire updatedById) — OUTPUT_ONLY; exact actor UUID for the most recent mutation.

type ListServiceIdentitiesResponse

type ListServiceIdentitiesResponse struct{ … }

One authorization-filtered page of service identities.

ServiceIdentities ([]models.ServiceIdentityResponse, wire serviceIdentities) — OUTPUT_ONLY; service identities in stable keyset order.
NextToken (string, optional, wire nextToken) — OUTPUT_ONLY; opaque continuation token, omitted after the final page.

type TransferServiceIdentityOwnershipResponse

type TransferServiceIdentityOwnershipResponse struct{ … }

The service identity after its administrative ownership transfer.

ServiceIdentity (models.ServiceIdentityResponse, wire serviceIdentity) — OUTPUT_ONLY; updated service identity.

type UpdateServiceIdentityRequest

type UpdateServiceIdentityRequest struct{ … }

Updates explicitly present profile fields. Empty description clears it; omitted fields remain unchanged. Ownership is changed only through the transfer endpoint.

DisplayName (string, optional, wire displayName) — Replacement display name. A present blank value is invalid.
Description (string, optional, wire description) — Replacement description. An empty string clears the description.
ReplaceLabels (map[string]string, optional, wire replaceLabels) — Complete replacement label map; an empty map clears all labels and is mutually exclusive with mergeLabels. At most 20 entries; keys and values contain at most 255 characters; keys use [a-z0-9._-].
MergeLabels (map[string]string, optional, wire mergeLabels) — Labels to upsert; must contain at least one entry and is mutually exclusive with replaceLabels. The final stored map may contain at most 20 entries; keys and values contain at most 255 characters; keys use [a-z0-9._-].

Service Identities

Equivalent REST call

Equivalent REST call

Equivalent REST call

Equivalent REST call

Equivalent REST call

Equivalent REST call

On this page