Overview

Unique has always supported service users at the Zitadel/API level, but until now they had no presence in the actual application — they didn't appear in Access Management, couldn't be assigned to spaces or knowledge base folders through the UI, and had no path to holding their own scoped personal API key. This feature brings service users into the application itself: they can now be synced into Unique's user system, made visible in Access Management, and issued a personal API key scoped to their assigned access.

Released in 2026.32.

How It Works

1. Service user creation happens in Zitadel, same as today — no change to how service users are created at the identity-provider level.

2. Syncing into Unique: when the feature flag is on, a service user is automatically synced into Unique's internal user system (the same system regular users are synced into). Once synced, the service user:

   • Appears in Access Management, shown separately from regular users

   • Can be added to spaces and knowledge base folders, just like a regular user

   • Can hold its own personal API key, scoped to whatever roles/resource access it's been granted

3. API key lifecycle: any user — including a synced service user — can generate, regenerate, or revoke their own personal API key via the Unique API. This is currently API-only; there is no key-management UI yet.

Feature Flag

FEATURE_FLAG_ENABLE_SERVICE_USER_API_KEY_UN_22696

More details: 2026.32 Infrastructure Changes

Migrating Existing Service Users

The automatic sync applies to service users created after the feature is enabled. An opt-in migration is available to sync service users that already exist in Zitadel into Unique's user system.

Run the following GraphQL mutation as a user with user-management administration permissions after enabling FEATURE_FLAG_ENABLE_SERVICE_USER_API_KEY_UN_22696:

mutation SyncServiceUsersFromZitadel {
  syncServiceUsersFromZitadel
}

Example

curl --url 'https://gateway.qa.unique.app/scope-management/graphql' \
  -H 'accept: */*' \
  -H 'authorization: Bearer <TOKEN>' \
  -H 'content-type: application/json' \
  -H 'origin: https://next.qa.unique.app' \
  --data-raw '{"query":"mutation SyncServiceUsersFromZitadel {\n  syncServiceUsersFromZitadel\n}","variables":{},"operationName":"SyncServiceUsersFromZitadel"}'

The migration is scoped to the authenticated administrator's company and writes the existing Zitadel service users to Unique immediately.

Unique API Endpoints

Available only under the new Unique API. Full reference: 2026.32 Public API/SDK Changes.