API Reference
Identity API
API surface for SOIT authentication, tenants, workspaces, users, and membership context.
Identity APIs resolve the context that every scoped SOIT operation depends on: tenant, workspace, user, membership, and role. Identity routes are mounted under the v1 API root.
Prefix
/api/v1Endpoint families
| Method | Path | Purpose |
|---|---|---|
| POST | /register, /login | User registration and authentication |
| GET / PATCH | /me | Current user profile |
| POST | /me/password | Change password |
| POST / GET | /tenants (+ /{tenant_id}, /{tenant_id}/members) | Tenant management and membership |
| POST / GET | /workspaces | Create and list workspaces |
| GET / PATCH | /workspaces/{workspace_id} | Workspace detail and settings |
| GET / POST / PATCH / DELETE | /workspaces/{workspace_id}/members (+ /{user_id}) | Workspace membership and roles |
| POST / GET | /api-keys (+ /{key_id}/revoke, /{key_id}/rotate) | API key lifecycle; a key is shown once, at creation or rotation |
| PATCH | /api-keys/{key_id} | Set a key's limits: calls per minute and per 24 hours, tokens per UTC day, allowed addresses, models, and tools, and run content capture |
| GET / POST | /service-principals | List and create service principals (workspace owners and admins) |
| GET / PATCH / DELETE | /service-principals/{principal_id} | Read, update, or delete a service principal |
| POST / GET / DELETE | /resource-grants | Resource-level permission grants |
Related prefixes
/api/v1/security— egress and usage policy/api/v1/secrets— secret inventory
Notes
- Business APIs never accept
tenant_id/workspace_idas free parameters — scope resolves from the authenticated context. See Identity and Access. - Roles are
Owner / Admin / Dev / Viewerat both tenant and workspace level. - An API key carries scopes (
read,write,admin) that cap what it may do below its owner's role. A key issued to a service principal (principal_idonPOST /api-keys) authenticates as the principal — see Service principals.