Admin API surface¶

Admin routes used by the Operator Console for Bucket A tasks. Base path is under the server’s /v1/admin namespace. Authentication follows the same Keycloak SSO session / token model as the console.

Not a full OpenAPI dump

This list is the customer-relevant surface from capability truth. It is not an exhaustive server catalogue.

Connectors¶

Method	Path	Purpose
`GET`	`/v1/admin/connectors`	Connector status
`POST`	`/v1/admin/connectors`	Trigger ingestion job → `{accepted, job_id}`

Channels¶

Method	Path	Purpose
`PUT`	`/v1/admin/channels`	Enable / disable agent channels

API gateway keys¶

Method	Path	Purpose
`POST`	`/v1/admin/gateway/keys`	Create key
`POST`	`/v1/admin/gateway/keys/{id}/revoke`	Revoke key
`PUT`	`/v1/admin/gateway/keys/{id}/quota`	Set per-key quota
`GET`	`/v1/admin/gateway/usage`	Usage

Models & routing¶

Method	Path	Purpose
`GET`	`/v1/admin/models`	List models
`POST`	`/v1/admin/models/activate`	Activate model
`GET`	`/v1/admin/routing`	List routing
`PUT`	`/v1/admin/routing/{workload}`	Set workload routing

Governance¶

Method	Path	Purpose
`GET`	`/v1/admin/audit`	Audit trail
`GET`	`/v1/admin/audit/export?format=`	Export audit
`GET`	`/v1/admin/agent/journal`	Agent journal
`GET`	`/v1/admin/agent/journal/export`	Export journal
`PUT`	`/v1/admin/agent/budgets`	Set agent budgets

Deployment & settings¶

Method	Path	Purpose
`GET`	`/v1/admin/deployment`	Deployment status
`GET`	`/v1/admin/deployment/install-plan`	Install plan
`GET`	`/v1/admin/settings`	Settings

Identity test (not federation save)¶

Method	Path	Purpose
`POST`	`/v1/admin/identity/test`	IdP connectivity pre-check only

Errors operators should recognise¶

Code	Meaning
`403` / `RES-ADMIN-403`	Mutation denied — typically `auditor`
`422` / `RES-BOUNDARY-1`	Cloud plane rejected a content-bearing payload (metadata boundary)