Hi, with prefect service account admin role, can someone do all API actions

That’s correct. But if you are asking to set up permissions for a Prefect agent, then USER-scoped permissions are enough