Admin endpoints
Every internal endpoint the Account Platform panel calls under /api/admin/* — path, method, what it does, owner-only or not. Not the public API.
This is not the public API
Everything below lives under /api/admin/* and authenticates with the same
session cookie as the rest of the admin panel. See
API Reference for TEASE's actual public,
key-authenticated API. This page exists so an engineer or support person
can find what a given panel screen actually calls, at a glance. Platform's
own product-facing API (/api/connect, /api/platform/v1/*,
/api/browser-runtime/v1/* and siblings) is documented on its own
API-reference pages, listed in this section's sidebar, not here.
Owner-only means the router's own module docstring, or the route's own
docstring/comment, states the endpoint is restricted to the workspace owner
(or, for the operator-triage routes below, to the platform owner
specifically). Where nothing says so, the route authenticates with
require_admin_principal/require_admin alone — reachable by any team
member whose access grant reaches it (see
Who needs it).
Auth — sign-in and session identity
app/api/admin/auth.py, mounted as admin_auth_router. Not owner-only —
/auth/timezone's own comment states it's self-service for "ANY panel
principal — owner, creator, team member."
| Method | Path | What it does |
|---|---|---|
| POST | /api/admin/auth/login | Signs in with username + password, sets the admin session cookie. |
| POST | /api/admin/auth/logout | Clears both the admin session cookie and a lingering creator user_session cookie. |
| GET | /api/admin/auth/whoami | Identifies the authenticated principal for the SPA's own auth gate. |
| POST | /api/admin/auth/timezone | Sets the caller's own IANA timezone ('' resets to browser-local). Display setting only, no capability gate. |
| POST | /api/admin/auth/display-name | Sets the caller's own display name. |
Team — members, roles, devices
app/api/admin/team.py, mounted as team_router. Owner-only — the
file's own module docstring states team access can only be managed by the
workspace owner. Full behavior (validation rules, error codes, the
role/rank model) is on
API — Team access; this table is
just the route list.
| Method | Path | What it does |
|---|---|---|
| GET | /api/admin/team/members | List active grants in the workspace. |
| GET | /api/admin/team/assignable-accounts | What can be scoped to a member. |
| POST | /api/admin/team/members | Create a login. |
| PATCH | /api/admin/team/members/{member_id} | Update a member's permissions/scope. |
| DELETE | /api/admin/team/members/{member_id} | Revoke a member, killing their sessions immediately. |
| GET | /api/admin/team/roles | List role presets. |
| POST | /api/admin/team/roles | Create a role. |
| PATCH | /api/admin/team/roles/{role_id} | Update or archive a role. |
| DELETE | /api/admin/team/roles/{role_id} | Delete a role (409 if any member holds it). |
| GET | /api/admin/team/devices | List devices seen for the workspace. |
| PATCH | /api/admin/team/devices/{device_id} | Approve, revoke, or rename a device. |
Problem reports — filing and owner triage
app/api/problem_reports.py. Two different routers under /api/admin/*,
with two different auth levels:
| Method | Path | What it does | Owner-only |
|---|---|---|---|
| POST | /api/admin/reports | File a problem report from the panel — any admin-session principal, creator or owner (the route's own docstring says so explicitly). | No |
| GET | /api/admin/platform/reports | Every report across every tenant, newest first, with per-status counts. | Yes — require_platform_admin |
| PATCH | /api/admin/platform/reports/{report_id} | Update a report's triage status. | Yes — require_platform_admin |
| GET | /api/admin/platform/reports/{report_id}/attachments/{att_id} | Read one report's attachment. | Yes — require_platform_admin |
The three /api/admin/platform/* routes sit under a section literally
headed "Owner triage" in the source. require_platform_admin accepts the
same principal require_owner does — a deliberately distinct gate name for
a distinct class of door, per the gate function's own docstring, not a
different set of people. See
Who needs it for how this compares
to a regular workspace owner's reach (their own tenant only, not every
tenant).
What's next
Troubleshooting — real, specific snags from Account Platform's own operation: symptom, cause, how to check.