Feat: System account access token resource support

[mheap]

https://developer.konghq.com/api/konnect/identity/v3/#/operations/post-system-accounts-id-access-tokens

[rspurgeon]

/triage

[github-actions]

✅ Requested Issue Triage completed successfully!

[github-actions]

🎯 Agentic Issue Triage

This is a feature request to add support for managing System Account Access Tokens through the Konnect Identity v3 API.

Summary

The issue requests implementation of CLI commands to manage system account access tokens, specifically referencing the Konnect Identity v3 API endpoint: POST /system-accounts/{id}/access-tokens.

Currently, kongctl has support for:

• ✅ Listing and getting system accounts (kongctl get system-accounts)
• ❌ Managing system account access tokens (requested feature)

📋 Implementation Details

Current State

• System account commands exist at internal/cmd/root/products/konnect/organization/systemaccount/
• Helper interface exists at internal/konnect/helpers/system_accounts.go
• Currently supports: ListSystemAccounts, GetSystemAccount

Required Changes

1. Update SDK Helper Interface

File: internal/konnect/helpers/system_accounts.go

Add access token operations to the SystemAccountAPI interface:

• CreateSystemAccountAccessToken(ctx, systemAccountID, request)
• ListSystemAccountAccessTokens(ctx, systemAccountID, request)
• GetSystemAccountAccessToken(ctx, systemAccountID, tokenID)
• DeleteSystemAccountAccessToken(ctx, systemAccountID, tokenID)

2. Create Access Token Command Files

New directory: internal/cmd/root/products/konnect/organization/systemaccount/accesstoken/

Files to create (following existing patterns):

• accesstoken.go - Main command registration
• getAccessToken.go - List/get operations
• createAccessToken.go - Create operation
• deleteAccessToken.go - Delete operation
• interactive_children.go - Interactive UI support

3. Wire Up Commands

Update internal/cmd/root/products/konnect/organization/systemaccount/systemaccount.go to support child resource commands for access tokens.

4. Command Pattern

Following the kongctl verb-noun pattern:

# List all access tokens for a system account
kongctl get system-account (id|name) access-tokens

# Get specific access token
kongctl get system-account (id|name) access-token (token-id)

# Create new access token
kongctl create system-account (id|name) access-token --name "my-token" [--expires-at "2026-12-31"]

# Delete access token
kongctl delete system-account (id|name) access-token (token-id)

🔍 Similar Implementation Examples

Reference these existing nested resource implementations:

• Gateway Services/Routes: internal/cmd/root/products/konnect/gateway/service/
• Gateway Plugins: internal/cmd/root/products/konnect/gateway/plugin/
• Team management: internal/cmd/root/products/konnect/organization/team/

Key patterns to follow:

1. Helper interface defines SDK operations
2. Command files handle CLI logic and output formatting
3. Parent command wires up child resources
4. Interactive children support for TUI navigation

🧪 Testing Strategy

• Unit tests: Command logic and output formatting
• Integration tests: SDK interactions (with -tags=integration)
• E2E tests: Full CLI workflow (with -tags=e2e)

Test files should follow pattern: *_test.go in same directory as implementation.

📚 Resources

• [Konnect Identity v3 API Docs]((developer.konghq.com/redacted)
• Repository Guidelines
• SDK Module (v0.19.0)
• Existing system account implementation: internal/cmd/root/products/konnect/organization/systemaccount/

✅ Implementation Checklist

• Verify SDK v0.19.0 includes access token operations for system accounts
• Update SystemAccountAPI helper interface with access token methods
• Implement helper interface methods in SystemAccountAPIImpl
• Create accesstoken/ directory with command files
• Implement get (list/get) command for access tokens
• Implement create command for access tokens
• Implement delete command for access tokens
• Add interactive children support for TUI
• Wire up commands in parent system account command
• Add unit tests for command logic
• Add integration tests for SDK calls
• Update documentation if needed
• Run quality gates: make format && make build && make lint && make test

---

@mheap - Could you confirm the desired command structure and any specific requirements for the access token management? Specifically:

1. Should we support all CRUD operations (Create, Read, Delete)?
2. Are there any specific flags or options needed (e.g., token expiration, scopes)?
3. Should the output format follow the same pattern as other resources (text/json/yaml)?

AI generated by Requested Issue Triage