If in doubt as to what’s available, make a REST “OPTIONS” call to the collection, which will list all of the available attributes, virtual attributes, relationships, and subcollections. In the case of vms, “service” is a relationship, for example:
OPTIONS https://<miq>/api/vms
...
"relationships": [
"accounts",
"advanced_settings",
"all_relationships",
"child_resources",
"cloud_tenant",
"compliances",
"connected_shares",
"conversion_host",
"counterparts",
"custom_action_buttons",
"custom_actions",
"custom_attributes",
"custom_button_events",
"custom_button_sets",
"custom_buttons",
"debris_files",
"direct_service",
"direct_services",
"directories",
"disk_files",
"disks",
"drift_states",
"ems_cluster",
"ems_custom_attributes",
"ems_events",
"ems_events_dest",
"ems_events_src",
"event_logs",
"evm_owner",
"ext_management_system",
"external_urls",
"files",
"filesystem_drivers",
"filesystems",
"first_drift_state",
"first_drift_state_timestamp_rec",
"flavor",
"groups",
"guest_applications",
"hardware",
"host",
"kernel_drivers",
"labels",
"lans",
"last_compliance",
"last_drift_state",
"last_drift_state_timestamp_rec",
"lifecycle_events",
"linux_initprocesses",
"metric_rollups",
"metrics",
"miq_alert_statuses",
"miq_custom_attributes",
"miq_events",
"miq_group",
"miq_provision",
"miq_provision_requests",
"miq_provision_template",
"miq_provision_vms",
"miq_provisions_from_template",
"miq_server",
"networks",
"nics",
"openscap_result",
"operating_system",
"parent_resource",
"parent_resource_pool",
"patches",
"policy_events",
"processes",
"registry_items",
"resource_group",
"scan_histories",
"service",
...
(see also https://www.manageiq.org/docs/reference/latest/api/appendices/collection_metadata.html)
Hope this helps,
pemcg