Administration Reference
Two scopes
| Scope | Operates on | Reachable by |
|---|---|---|
| Platform | All tenants | Platform administrators only |
| Tenant | One tenant's own configuration and users | That tenant's administrators |
Platform operations cross tenant boundaries and therefore run under a different authorization scope entirely. A tenant administrator cannot reach them.
Tenant states
| State | Access | Data | Reversible |
|---|---|---|---|
| Active | Normal | Retained | — |
| Suspended | Blocked | Retained | Yes |
| Deleted | Blocked | Retained, soft-deleted | Yes |
Machine credentials
Long-lived credentials for system-to-system integration, distinct from user tokens.
| Property | Behaviour |
|---|---|
| Revocation | Checked on every request — takes effect immediately |
| Scope | Tenant tokens are bound to their tenant. Platform-level system tokens carry no tenant and operate across all of them — treat those as the most sensitive credential the platform issues. |
User tokens are checked against the same revocation list. The difference is failure behaviour: machine credentials fail closed if the list cannot be reached, user tokens fail open.
Configuration snapshots
A snapshot stores a configuration payload supplied by the caller, retrievable later.
| Operation | Available |
|---|---|
| Create, list, read, update, delete a snapshot | Yes |
| Apply, restore, or roll back a snapshot | No |
| Diff two snapshots | No |
Snapshots are a record, not a recovery mechanism. Reverting a configuration change means making the reverse change. Do not build a recovery procedure around them.
Identity administration
Users and groups originate in your identity provider and are mirrored. There is no path that creates one without a corresponding identity there.
| Path | Creates |
|---|---|
| Sign-in | A user, on first successful authentication into a tenant they can reach |
| Administrative mirror | A user, from a named provider identity |
| Group sync | Groups, from the provider |
A user or group cannot be created from arbitrary input. This is enforced at the database level, not only in application code.