Administration

These routes are administrative application operations. Use a session with the necessary tenant and team permissions. Scoped API tokens do not provide a general substitute for this session.

Settings and credentials

The service applies additional key and tenant restrictions. Do not assume that an admin session can edit arbitrary platform-wide settings. All settings and credential routes are denied to API tokens.

Jobs

GET /api/admin/jobs accepts status, type, and limit and returns jobs. The default limit is 100 and the maximum is 500; this endpoint does not use the common offset/count pagination envelope.

Each record includes queue_name, job_type, status, attempts, max_attempts, last_error, and timestamps.

POST /api/admin/jobs/:id/retry resets the job to pending, clears locks/error state, resets attempts, and schedules it immediately. DELETE /api/admin/jobs/:id removes a job. Check the operation's external effects before repeating a completed action.

Audit log

GET /api/admin/audit-log reads administrative activity; GET /api/admin/audit-log/categories returns categories for filtering.

Resource-specific order and customer audit routes are documented with those resources. The existence of a resource audit read scope does not grant a token access to the complete administrative log.

Users and team members

Team management uses /api/admin/members. GET lists members and POST adds one. Member-specific routes manage grants, channels, and membership.

Account actions include POST /api/admin/users/:id/reset-2fa, /:id/trigger-password-reset, and /:id/force-password. These require an authorized session and are excluded from token access.

Partner self-service uses the vendor and affiliate APIs, rather than administrative team-management credentials.