Admin applications Docs

DOC

/docs

Roles

Membership is per application. The creator becomes owner automatically.

`owner`	Full control, including deleting the application and transferring ownership. Only one owner at a time.
`admin`	Everything a moderator can do, plus managing members.
`moderator`	Can change flag settings: create/update/archive flags, configs, rules, and experiments.
`viewer`	Read-only access to the application, its flags, and configuration.

DOC

/docs

Application endpoints

Creating and listing applications only requires a valid JWT for the tenant; every other endpoint requires application membership at the noted role or higher.

GET

/admin/applications

List my applications

Lists applications the caller is a member of, including their role.

Request

X-Tenant-ID: tenant-uuid
Authorization: Bearer <admin-jwt>

Response

{
  "applications": [
    {
      "id": 3,
      "key": "storefront",
      "name": "Storefront",
      "role": "owner"
    }
  ]
}

POST

/admin/applications

Create application

Creates an application. The caller becomes its owner.

Request

X-Tenant-ID: tenant-uuid
Authorization: Bearer &lt;admin-jwt&gt;

{
  "key": "storefront",
  "name": "Storefront",
  "description": "Customer-facing web app"
}

Response

{
  "application": {
    "id": 3,
    "key": "storefront",
    "name": "Storefront",
    "ownerUserSub": "user_123",
    "role": "owner"
  }
}

GET

/admin/applications/:applicationId

Get application

Returns an application. Requires viewer role or higher.

Request

X-Tenant-ID: tenant-uuid
Authorization: Bearer <admin-jwt>

Response

{
  "application": {
    "id": 3,
    "key": "storefront",
    "name": "Storefront",
    "role": "viewer"
  }
}

PATCH

/admin/applications/:applicationId

Update application

Updates name or description. Requires admin role or higher.

Request

X-Tenant-ID: tenant-uuid
Authorization: Bearer &lt;admin-jwt&gt;

{ "description": "Updated description" }

Response

{
  "application": {
    "id": 3,
    "description": "Updated description"
  }
}

DELETE

/admin/applications/:applicationId

Delete application

Deletes the application and its flags, configs, and rules. Owner only.

Request

X-Tenant-ID: tenant-uuid
Authorization: Bearer <admin-jwt>

Response

204 No Content

DOC

/docs

Member endpoints

GET

/admin/applications/:applicationId/members

List members

Lists members and their roles. Requires viewer role or higher.

Request

X-Tenant-ID: tenant-uuid
Authorization: Bearer <admin-jwt>

Response

{
  "members": [
    {
      "userSub": "user_123",
      "role": "owner"
    }
  ]
}

POST

/admin/applications/:applicationId/members

Add member

Adds a member with role admin, moderator, or viewer. Requires admin role or higher.

Request

X-Tenant-ID: tenant-uuid
Authorization: Bearer &lt;admin-jwt&gt;

{ "userSub": "user_456", "role": "moderator" }

Response

{
  "member": {
    "userSub": "user_456",
    "role": "moderator"
  }
}

PATCH

/admin/applications/:applicationId/members/:userSub

Update member role

Changes a member role to admin, moderator, or viewer. Requires admin role or higher.

Request

X-Tenant-ID: tenant-uuid
Authorization: Bearer &lt;admin-jwt&gt;

{ "role": "admin" }

Response

{
  "member": {
    "userSub": "user_456",
    "role": "admin"
  }
}

DELETE

/admin/applications/:applicationId/members/:userSub

Remove member

Removes a member. The owner cannot be removed. Requires admin role or higher.

Request

X-Tenant-ID: tenant-uuid
Authorization: Bearer <admin-jwt>

Response

204 No Content

POST

/admin/applications/:applicationId/members/owner

Transfer ownership

Transfers ownership to an existing member; the previous owner becomes admin. Owner only.

Request

X-Tenant-ID: tenant-uuid
Authorization: Bearer &lt;admin-jwt&gt;

{ "userSub": "user_456" }

Response

{
  "ownerUserSub": "user_456"
}

DOC

/docs

API keys

Runtime callers (POST /flags/:flagKey/evaluate and POST /events/:eventKey) authenticate with an API key instead of a tenant id, so internal ids are never exposed to client applications. The server looks up the tenant and application from the key on every request.

GET

/admin/applications/:applicationId/api-keys

List API keys

Lists keys with a masked prefix only. Requires viewer role or higher.

Request

X-Tenant-ID: tenant-uuid
Authorization: Bearer <admin-jwt>

Response

{
  "apiKeys": [
    {
      "id": 1,
      "name": "Production runtime key",
      "keyPrefix": "ak_3f9a2b",
      "isActive": true,
      "lastUsedAt": null
    }
  ]
}

POST

/admin/applications/:applicationId/api-keys

Create API key

Creates a read-only runtime key. The plaintext key is only ever returned in this response; store it immediately. Requires admin role or higher.

Request

X-Tenant-ID: tenant-uuid
Authorization: Bearer &lt;admin-jwt&gt;

{ "name": "Production runtime key" }

Response

{
  "apiKey": {
    "id": 1,
    "name": "Production runtime key",
    "keyPrefix": "ak_3f9a2b",
    "isActive": true,
    "key": "ak_3f9a2b7c1d..."
  }
}

DELETE

/admin/applications/:applicationId/api-keys/:keyId

Revoke API key

Permanently revokes a key; runtime calls using it immediately start failing with 401. Requires admin role or higher.

Request

X-Tenant-ID: tenant-uuid
Authorization: Bearer <admin-jwt>

Response

204 No Content