Admin API

Odudu admin API. Every operation is a JSON request under /admin/tenants. The pages are generated from the OpenAPI document the server itself serves at /admin/openapi.json, so they list exactly the routes the build serves.

Authentication

An access token whose "aud" claim names urn:odudu:params:admin-api. A token minted for another audience, including the protocol surface itself, is refused with 401.

Each operation names the capability it needs. A caller without it is refused with 403; a missing or wrong token with 401.

Text values in a request may not contain the NUL character.

The tenant in the path

The tenant being administered, addressed by name.

Areas

• Whoami: 1 operation.
• Subjects: 34 operations.
• Sessions: 3 operations.
• Tenants: 8 operations.
• Settings: 2 operations.
• Clients: 12 operations.
• Registration tokens: 3 operations.
• Roles: 10 operations.
• Groups: 9 operations.
• Scopes: 16 operations.
• Keys: 5 operations.
• Lockouts: 1 operation.
• SMTP: 4 operations.
• Mail: 1 operation.
• Flow: 2 operations.
• Audit: 3 operations.

Problem details

A refusal is an application/problem+json document (RFC 9457) with these fields.

Field	Type	Required	Details
type	string	yes
title	string	yes
status	integer	yes
instance	string	yes
detail	string	no
errors	array of object	no
errors[]	object	yes
errors[].path	string	yes
errors[].message	string	yes
errors[].code	string	no