Aller au contenu
Odysseus/docs

Tenants, users and access

Ce contenu n’est pas encore disponible dans votre langue.

Signing in, the people in a tenant, the tenants themselves, their plans and their settings.

Every address below is served under the control plane’s base URL. Permission is the guard the route is registered with; who holds it is read from the control plane’s own grant, so it cannot drift from what the server does. A dash means the route carries no permission guard of its own — the access tier below the table is then the whole of what stands in front of it.

Generated from Route. Hand edits to this table are overwritten on the next build — change the Go doc comment, or the generator.

Route Permission Who holds it Body
ANY /api/billing/ — — —
ANY /api/billing/admin — — —
GET /api/v1/admin/system-plans — — —
POST /api/v1/admin/system-plans — — —
DELETE /api/v1/admin/system-plans/{slug} — — —
GET /api/v1/admin/system-plans/{slug} — — —
PUT /api/v1/admin/system-plans/{slug} — — —
PUT /api/v1/admin/system-plans/{slug}/link-billing — — —
DELETE /api/v1/admin/tenants/{id}/athena-usage — — —
GET /api/v1/admin/tenants/{id}/athena-usage — — —
GET /api/v1/admin/tenants/{id}/plan — — —
PUT /api/v1/admin/tenants/{id}/plan — — —
GET /api/v1/auth/invites/validate — — —
POST /api/v1/auth/login — — —
POST /api/v1/auth/logout — — —
POST /api/v1/auth/migrate — — —
GET /api/v1/auth/oauth/{provider} — — —
GET /api/v1/auth/oauth/{provider}/callback — — —
POST /api/v1/auth/refresh — — —
POST /api/v1/auth/resend-verification — — —
POST /api/v1/auth/signup — — —
GET /api/v1/auth/signup/config — — —
GET /api/v1/auth/user config:read developer, operator, readonly, support —
POST /api/v1/auth/verify-email — — —
GET /api/v1/auth/whoami — — —
GET /api/v1/billing/status — — —
GET /api/v1/billing/system-plans config:read developer, operator, readonly, support —
GET /api/v1/bootstrap/agent-bundle — — —
POST /api/v1/bootstrap/complete — — —
POST /api/v1/bootstrap/register-wireguard — — —
GET /api/v1/bootstrap/script — — —
POST /api/v1/bootstrap/validate — — —
GET /api/v1/invites admin an administrator only, through the wildcard grant —
POST /api/v1/invites admin an administrator only, through the wildcard grant —
DELETE /api/v1/invites/{code} admin an administrator only, through the wildcard grant —
GET /api/v1/plan — — —
GET /api/v1/plans — — —
GET /api/v1/settings/backup config:read developer, operator, readonly, support —
PUT /api/v1/settings/backup — — —
DELETE /api/v1/settings/billing — — —
GET /api/v1/settings/billing — — —
PUT /api/v1/settings/billing — — —
POST /api/v1/settings/billing/enroll — — —
POST /api/v1/settings/billing/renew — — —
POST /api/v1/settings/billing/sync-tenants — — —
POST /api/v1/settings/billing/test — — —
GET /api/v1/settings/chat-provider/models admin an administrator only, through the wildcard grant —
POST /api/v1/settings/chat-provider/validate admin an administrator only, through the wildcard grant —
DELETE /api/v1/settings/notifications admin an administrator only, through the wildcard grant —
GET /api/v1/settings/notifications admin an administrator only, through the wildcard grant —
PUT /api/v1/settings/notifications admin an administrator only, through the wildcard grant —
POST /api/v1/settings/notifications/test/email admin an administrator only, through the wildcard grant —
POST /api/v1/settings/notifications/test/slack admin an administrator only, through the wildcard grant —
GET /api/v1/settings/oauth — — —
DELETE /api/v1/settings/oauth/{provider} — — —
PUT /api/v1/settings/oauth/{provider} — — —
GET /api/v1/settings/usage/cost config:read developer, operator, readonly, support —
GET /api/v1/settings/usage/cost/export config:read developer, operator, readonly, support —
GET /api/v1/settings/wireguard admin an administrator only, through the wildcard grant —
PUT /api/v1/settings/wireguard admin an administrator only, through the wildcard grant —
GET /api/v1/tenants — — —
POST /api/v1/tenants — — —
DELETE /api/v1/tenants/{id} — — —
GET /api/v1/tenants/{id} — — —
PUT /api/v1/tenants/{id} — — —
POST /api/v1/tenants/{id}/activate — — —
GET /api/v1/tenants/{id}/children — — —
POST /api/v1/tenants/{id}/children — — —
GET /api/v1/tenants/{id}/hierarchy — — —
GET /api/v1/tenants/{id}/quota — — —
PUT /api/v1/tenants/{id}/quota — — —
POST /api/v1/tenants/{id}/suspend — — —
GET /api/v1/users admin an administrator only, through the wildcard grant —
POST /api/v1/users admin an administrator only, through the wildcard grant —
GET /api/v1/users/me/onboarding config:read developer, operator, readonly, support —
PUT /api/v1/users/me/onboarding config:write an administrator only, through the wildcard grant —
POST /api/v1/users/me/onboarding/reset config:write an administrator only, through the wildcard grant —
GET /api/v1/users/me/tenants config:read developer, operator, readonly, support —
DELETE /api/v1/users/{id} admin an administrator only, through the wildcard grant —
GET /api/v1/users/{id} admin an administrator only, through the wildcard grant —
PUT /api/v1/users/{id} admin an administrator only, through the wildcard grant —

Who can reach these at all

Section titled “Who can reach these at all”

authenticated — Behind authentication, cross-site-request-forgery validation and tenant extraction. Every call acts inside exactly one tenant.

platform-operator — Platform-operator surface, across tenants. Not part of a tenant’s own API.

unauthenticated — No authentication middleware on the router. The handler is responsible for whatever verification it needs.

Reachable only by an administrator

Section titled “Reachable only by an administrator”

No role holds the permissions below explicitly. They are satisfied by the administrator’s wildcard grant and by nothing else, so an operator or a developer cannot call these routes however their tenant is configured. That is a role-model question rather than a documentation one; it is recorded here because a reader planning around it needs to know before they try.

  • GET /api/v1/invites — needs admin
  • POST /api/v1/invites — needs admin
  • DELETE /api/v1/invites/{code} — needs admin
  • GET /api/v1/settings/chat-provider/models — needs admin
  • POST /api/v1/settings/chat-provider/validate — needs admin
  • DELETE /api/v1/settings/notifications — needs admin
  • GET /api/v1/settings/notifications — needs admin
  • PUT /api/v1/settings/notifications — needs admin
  • POST /api/v1/settings/notifications/test/email — needs admin
  • POST /api/v1/settings/notifications/test/slack — needs admin
  • GET /api/v1/settings/wireguard — needs admin
  • PUT /api/v1/settings/wireguard — needs admin
  • GET /api/v1/users — needs admin
  • POST /api/v1/users — needs admin
  • PUT /api/v1/users/me/onboarding — needs config:write
  • POST /api/v1/users/me/onboarding/reset — needs config:write
  • DELETE /api/v1/users/{id} — needs admin
  • GET /api/v1/users/{id} — needs admin
  • PUT /api/v1/users/{id} — needs admin

Declared in the source and served by nothing

Section titled “Declared in the source and served by nothing”

The addresses below are written into the control plane’s source and are registered on no router: the type that would register them is constructed nowhere, so a walk of the live router does not see them and a caller gets a 404. They are listed so that reading the source does not suggest a surface that is not there.

  • DELETE /api/v1/tenants/{tenant}/backups/{backup_id} — declared at pkg/api/minio_handlers.go:71, mounted nowhere
  • DELETE /api/v1/tenants/{tenant}/seaweedfs/mounts/{volume} — declared at pkg/api/seaweedfs_handlers.go:68, mounted nowhere
  • DELETE /api/v1/tenants/{tenant}/wireguard/mesh/peers/{node} — declared at pkg/api/wireguard_handlers.go:50, mounted nowhere
  • GET /api/v1/tenants/{tenant}/backups — declared at pkg/api/minio_handlers.go:69, mounted nowhere
  • GET /api/v1/tenants/{tenant}/backups/stats — declared at pkg/api/minio_handlers.go:81, mounted nowhere
  • GET /api/v1/tenants/{tenant}/backups/{backup_id} — declared at pkg/api/minio_handlers.go:70, mounted nowhere
  • GET /api/v1/tenants/{tenant}/minio/credentials — declared at pkg/api/minio_handlers.go:63, mounted nowhere
  • GET /api/v1/tenants/{tenant}/minio/status — declared at pkg/api/minio_handlers.go:58, mounted nowhere
  • GET /api/v1/tenants/{tenant}/seaweedfs/mounts — declared at pkg/api/seaweedfs_handlers.go:66, mounted nowhere
  • GET /api/v1/tenants/{tenant}/seaweedfs/status — declared at pkg/api/seaweedfs_handlers.go:56, mounted nowhere
  • GET /api/v1/tenants/{tenant}/tiering/policy — declared at pkg/api/minio_handlers.go:76, mounted nowhere
  • GET /api/v1/tenants/{tenant}/tiering/stats — declared at pkg/api/minio_handlers.go:78, mounted nowhere
  • GET /api/v1/tenants/{tenant}/wireguard/mesh — declared at pkg/api/wireguard_handlers.go:43, mounted nowhere
  • GET /api/v1/tenants/{tenant}/wireguard/mesh/connectivity — declared at pkg/api/wireguard_handlers.go:53, mounted nowhere
  • GET /api/v1/tenants/{tenant}/wireguard/mesh/peers — declared at pkg/api/wireguard_handlers.go:48, mounted nowhere
  • POST /api/v1/tenants/{tenant}/backups/{backup_id}/restore — declared at pkg/api/minio_handlers.go:72, mounted nowhere
  • POST /api/v1/tenants/{tenant}/backups/{backup_id}/verify — declared at pkg/api/minio_handlers.go:73, mounted nowhere
  • POST /api/v1/tenants/{tenant}/minio/credentials/rotate — declared at pkg/api/minio_handlers.go:64, mounted nowhere
  • POST /api/v1/tenants/{tenant}/minio/disable — declared at pkg/api/minio_handlers.go:60, mounted nowhere
  • POST /api/v1/tenants/{tenant}/minio/enable — declared at pkg/api/minio_handlers.go:59, mounted nowhere
  • POST /api/v1/tenants/{tenant}/seaweedfs/disable — declared at pkg/api/seaweedfs_handlers.go:58, mounted nowhere
  • POST /api/v1/tenants/{tenant}/seaweedfs/enable — declared at pkg/api/seaweedfs_handlers.go:57, mounted nowhere
  • POST /api/v1/tenants/{tenant}/seaweedfs/mounts/{volume} — declared at pkg/api/seaweedfs_handlers.go:67, mounted nowhere
  • POST /api/v1/tenants/{tenant}/wireguard/mesh/disable — declared at pkg/api/wireguard_handlers.go:45, mounted nowhere
  • POST /api/v1/tenants/{tenant}/wireguard/mesh/enable — declared at pkg/api/wireguard_handlers.go:44, mounted nowhere
  • POST /api/v1/tenants/{tenant}/wireguard/mesh/peers — declared at pkg/api/wireguard_handlers.go:49, mounted nowhere
  • PUT /api/v1/tenants/{tenant}/tiering/policy — declared at pkg/api/minio_handlers.go:77, mounted nowhere