Use the HTTPS Web origin for the `/api/v1` routes. The stock Web deployment does not forward the legacy `/oauth/token` route; see the integration limitation below. URL-encode environment, VPN, queue and identifier path segments. Swagger is disabled outside development/test; do not expect `/api/docs` on a production installation.

## Authentication and permission model

Use a `sop_` token for integrations through the public Web origin. [Service Accounts](https://portal.cjcit.io/knowledge-base/message_ops/1.7/administration/service-accounts/) require their own scoped roles and an existing matching service policy for broker operations; v1.7.1 has no customer UI/API to provision that policy. Personal tokens require administrator-enabled API access and use manual assignments only, never SSO-derived grants. A manual Queue Viewer/Queue Operator assignment supplies human queue access; see [queue access and policy limits](https://portal.cjcit.io/knowledge-base/message_ops/1.7/administration/users-and-access/#queue-access-and-policy-limits). Both use `Authorization: Bearer sop_...`; tokens are shown once, expire after the configured period (default 90 days) and are invalidated by regeneration. A valid token does not bypass environment/queue policies, content permissions, license limits or safety controls.

Browser sign-in uses Secure/HttpOnly session cookies in production. Explicit Bearer credentials take precedence over cookies. Sensitive administrative operations require a human session with recent MFA; possession of a long-lived token alone cannot satisfy interactive step-up. Cookie-authenticated writes are subject to origin/CSRF checks.

The API contains a legacy `POST /oauth/token` endpoint, but it is **unavailable through the stock public Web route**. The API backend is internal, and there is no `/api/v1/oauth/token` alias. Do not expose the entire API to make this route reachable. Legacy client credentials also lack environment role assignments, so their scopes alone cannot authorize broker operations. Public integrations should use the token paths and policy prerequisites above.

## Search and inspect messages

For broker examples, use a personal token with manual queue assignments or a service account whose required persisted policy has already been provisioned and verified. For the shell examples, set `WEB_URL` to your public HTTPS origin without a trailing slash and supply `TOKEN` from your approved credential store. Examples use illustrative environment `production`, VPN `default` and queue `DMQ.EXAMPLE`; substitute a scope your account may access. Do not paste token values into shared scripts or logs.

```
curl --fail-with-body --silent --show-error "$WEB_URL/api/v1/environments" \
  -H "Authorization: Bearer $TOKEN"
curl --fail-with-body --silent --show-error \
  "$WEB_URL/api/v1/environments/production/vpns/default/queues?includeStats=true" \
  -H "Authorization: Bearer $TOKEN"
```

Search has a flat JSON body. A metadata-only example avoids assuming content-read permission:

```
curl --fail-with-body --silent --show-error -X POST "$WEB_URL/api/v1/messages/search" \
  -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' \
  --data '{
    "environmentId": "production",
    "vpnName": "default",
    "queueName": "DMQ.EXAMPLE",
    "searchTerm": "order-123",
    "searchFields": ["messageId", "correlationId"],
    "maxMessagesToScan": 1000,
    "maxResults": 25,
    "includePayloadPreview": false
  }'
```

HTTP 202 returns `{"searchId":"...","status":"accepted"}`. Set `SEARCH_ID` from that response and poll at a reasonable interval until `completed` or `failed`:

```
curl --fail-with-body --silent --show-error "$WEB_URL/api/v1/messages/searches/$SEARCH_ID" \
  -H "Authorization: Bearer $TOKEN"
curl --fail-with-body --silent --show-error "$WEB_URL/api/v1/messages/searches/$SEARCH_ID/results" \
  -H "Authorization: Bearer $TOKEN"
```

Results contain `searchId`, `status` and `results`. Use a returned `messageRef` with `GET /api/v1/messages/{messageRef}`; full payload is `GET /api/v1/messages/{messageRef}/payload` with payload permission. Search resources are distinct from operation jobs.

<table><caption class="sr-only">Search and inspect messages</caption><thead><tr><th scope="col">Search field</th><th scope="col">v1.7.1 behavior</th></tr></thead><tbody><tr><td><code>environmentId</code>, <code>vpnName</code>, <code>queueName</code></td><td>Required nonempty strings.</td></tr><tr><td><code>searchTerm</code></td><td>Nonblank, maximum 4,096 characters; case-insensitive substring match across selected fields.</td></tr><tr><td><code>searchFields</code></td><td>Nonempty unique list of <code>messageId</code>, <code>correlationId</code>, <code>destination</code>, <code>properties</code>, <code>payload</code>; omission selects all.</td></tr><tr><td><code>destination</code>, <code>messageId</code>, <code>correlationId</code>, <code>replicationGroupMessageId</code></td><td>Optional exact filters.</td></tr><tr><td><code>timeWindow</code></td><td>Optional <code>from</code>/<code>to</code> date-time strings; from must not exceed to.</td></tr><tr><td><code>properties</code>, <code>payloadContains</code></td><td>Exact property map or payload substring; content-read permission required.</td></tr><tr><td><code>transactionId</code>, <code>senderSystem</code>, <code>receiverSystem</code>, <code>senderInterfaceName</code>, <code>receiverInterfaceName</code>, <code>sapDocumentNumber</code>, <code>shipmentNumber</code></td><td>Optional business-key filters; content-read permission required.</td></tr><tr><td><code>maxMessagesToScan</code></td><td>Integer 1–500,000; deployment default 100,000.</td></tr><tr><td><code>maxResults</code></td><td>Integer 1–10,000; default 100.</td></tr><tr><td><code>includePayloadPreview</code></td><td>Default false; forced off without payload-read permission.</td></tr><tr><td><code>payloadPreviewBytes</code></td><td>Integer 1–65,536; Worker default 1,024.</td></tr></tbody></table>

Content-bearing unified searches, including omitted `searchFields`, require source-queue content-read permission. Stored content searches remain protected on later status/result reads. A 256 MiB aggregate browse-buffer bound can stop a search before its requested count. Unknown search fields are rejected. See [Queues and Messages](https://portal.cjcit.io/knowledge-base/message_ops/1.7/usage/messages/) for masking and reference expiry.

## Submit an operation and read its outcome

`POST /api/v1/resubmissions`, `/moves` and `/deletions` accept explicit `environmentId` and a selection. Use either `selection.messageRefs` or `selection.criteria` with `vpnName` and `queueName`, plus search predicates. Reference selections must resolve to the expected scope. Criteria are resolved against the live queue and the bulk limit applies; no matches produce `CRITERIA_NO_MATCHES`.

Resubmit/move also require `target.type` (`queue` or `topic`) and `target.destination`. Destination permissions are checked separately. Move also requires source-delete authority. Direct move/delete require `reason` and always require `changeReference` in production. The following **dry-run move** uses a live reference obtained from your search; replace `msgref-from-your-search` before submission:

```
{
  "environmentId": "production",
  "selection": {"messageRefs": ["msgref-from-your-search"]},
  "target": {"type": "queue", "destination": "RETRY.QUEUE"},
  "options": {"dryRun": true},
  "reason": "Verify retry selection",
  "changeReference": "CHG-12345",
  "idempotencyKey": "unique-key-for-this-dry-run"
}
```

Save the edited request as `move-request.json` and submit:

```
curl --fail-with-body --silent --show-error -X POST "$WEB_URL/api/v1/moves" \
  -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' \
  --data-binary @move-request.json
```

The HTTP 202 response is a public job object with `id` and `status`. Follow `GET /api/v1/jobs/{id}`, `/events` and `/report`. Dry run does not mutate the broker and does not guarantee a later live result. Use a new idempotency key if changing from dry run to a real request.

For **move and delete**, `idempotencyKey` is an optional **JSON body field**. Reuse it with the same request to retrieve the existing job after an uncertain submission response; a different request with the same key conflicts. Keys are scoped to authenticated identity kind and ID, and normal access checks still apply. Do not rely on an `Idempotency-Key` HTTP header in v1.7.1; it is not read by these handlers. Resubmission does not cache idempotent responses. Check existing jobs before resubmitting a possibly accepted request.

Resubmit options include `dryRun`, `preserveHeaders`, `preserveProperties` and `addResubmissionMetadata`. The API accepts `maxRatePerSecond`, but the v1.7.1 Worker does not enforce it; do not use it as a rate limit. Move supports dry run and header/property preservation; delete supports dry run. Resubmit leaves the original in place; use move when source removal is intended. Broker acknowledgement is required before move removes the source. Cancellation is cooperative and does not undo completed items.

## Schedule an operation

`POST /api/v1/schedules` accepts `name`, `operation` (`resubmit`, `move`, `delete`) and `request_template`, using the corresponding operation body. In production, **every** `request_template` must include `changeReference`, including resubmit; move/delete also require `reason`. For one-time work, set `schedule_type: "once"` and a future ISO 8601 `run_at` with year and UTC offset. For recurring work, set `schedule_type: "cron"` and a five-field UTC `schedule_expression`. Do not provide both timing fields.

This recurring **dry-run** example resolves a fresh bounded selection at 02:00 UTC daily:

```
{
  "name": "Daily retry review",
  "operation": "move",
  "schedule_type": "cron",
  "schedule_expression": "0 2 * * *",
  "request_template": {
    "environmentId": "production",
    "selection": {"criteria": {"vpnName": "default", "queueName": "DMQ.EXAMPLE", "maxResults": 25}},
    "target": {"type": "queue", "destination": "RETRY.QUEUE"},
    "options": {"dryRun": true},
    "reason": "Scheduled retry review",
    "changeReference": "CHG-12345"
  }
}
```

Review and disable/delete a test schedule after validation. Editing/enabling transfers execution ownership to the manager. Use criteria rather than expiring references for recurring work. [Schedules](https://portal.cjcit.io/knowledge-base/message_ops/1.7/usage/schedules/) explains timing, consumed one-time runs and recovery.

## Errors

Most errors use an `error` object containing `code`, `message`, `correlationId` and `details`. Validation messages can be arrays. Server failures return a generic message; use the correlation ID with sanitized service logs. Typical HTTP outcomes are 400 invalid input, 401 missing/expired credentials, 403 policy/license/MFA denial, 404 missing resource, 409 state/idempotency conflict, 410 expired reference and 429 throttling.

The legacy OAuth route instead returns OAuth JSON such as `{"error":"invalid_request"}` (400), `unsupported_grant_type` (400) or `invalid_client` (401). An accepted job can fail later; HTTP submission status is not its terminal result. See [Troubleshooting](https://portal.cjcit.io/knowledge-base/message_ops/1.7/troubleshooting/) for recovery actions.

## Endpoint directory

Paths below are complete HTTP paths. Every protected operation enforces its applicable permission, scope, license and MFA checks; the presence of a route does not grant access. Request bodies for operational workflows are described above; administrator task guides explain the corresponding settings and controls. For generated clients, obtain the release-matched OpenAPI contract from your supplier and validate these v1.7.1 limits and authentication requirements when integrating.

### Authentication and profile

<table><caption class="sr-only">Authentication and profile</caption><thead><tr><th scope="col">Method</th><th scope="col">Path</th><th scope="col">Purpose</th></tr></thead><tbody><tr><td>POST</td><td><code>/api/v1/auth/change-password</code></td><td>Change the current user’s local password</td></tr><tr><td>POST</td><td><code>/api/v1/auth/login</code></td><td>Local email/password sign-in</td></tr><tr><td>POST</td><td><code>/api/v1/auth/logout</code></td><td>Clear the current browser/API session</td></tr><tr><td>GET</td><td><code>/api/v1/auth/methods</code></td><td>List available authentication methods</td></tr><tr><td>POST</td><td><code>/api/v1/auth/methods/resolve</code></td><td>Resolve available authentication methods for a login hint</td></tr><tr><td>POST</td><td><code>/api/v1/auth/mfa/challenge/options</code></td><td>Get MFA challenge options for the pending sign-in</td></tr><tr><td>POST</td><td><code>/api/v1/auth/mfa/recovery-code/verify</code></td><td>Verify a recovery code using a pre-MFA token</td></tr><tr><td>GET</td><td><code>/api/v1/auth/mfa/status</code></td><td>Authenticated user MFA status</td></tr><tr><td>POST</td><td><code>/api/v1/auth/mfa/step-up/recovery-code/verify</code></td><td>Verify a recovery code for a step-up MFA challenge</td></tr><tr><td>POST</td><td><code>/api/v1/auth/mfa/step-up/totp/verify</code></td><td>Verify a TOTP code for a step-up MFA challenge</td></tr><tr><td>POST</td><td><code>/api/v1/auth/mfa/step-up/webauthn/start</code></td><td>Start a passkey step-up challenge</td></tr><tr><td>POST</td><td><code>/api/v1/auth/mfa/step-up/webauthn/verify</code></td><td>Verify a passkey step-up challenge</td></tr><tr><td>POST</td><td><code>/api/v1/auth/mfa/totp/challenge/verify</code></td><td>Verify a TOTP code using a pre-MFA token</td></tr><tr><td>POST</td><td><code>/api/v1/auth/mfa/totp/enroll/confirm</code></td><td>Confirm TOTP enrollment for the authenticated user</td></tr><tr><td>POST</td><td><code>/api/v1/auth/mfa/totp/enroll/start</code></td><td>Start TOTP enrollment for the authenticated user</td></tr><tr><td>POST</td><td><code>/api/v1/auth/mfa/webauthn/challenge/start</code></td><td>Start a passkey authentication challenge using a pre-MFA token</td></tr><tr><td>POST</td><td><code>/api/v1/auth/mfa/webauthn/challenge/verify</code></td><td>Verify a passkey authentication challenge using a pre-MFA token</td></tr><tr><td>POST</td><td><code>/api/v1/auth/mfa/webauthn/enroll/confirm</code></td><td>Confirm passkey enrollment for the authenticated user</td></tr><tr><td>POST</td><td><code>/api/v1/auth/mfa/webauthn/enroll/start</code></td><td>Start passkey enrollment for the authenticated user</td></tr><tr><td>GET</td><td><code>/api/v1/auth/session</code></td><td>Get the current session</td></tr><tr><td>GET</td><td><code>/api/v1/auth/sso/callback</code></td><td>OIDC callback endpoint</td></tr><tr><td>POST</td><td><code>/api/v1/auth/sso/callback</code></td><td>SAML callback endpoint</td></tr><tr><td>POST</td><td><code>/api/v1/auth/sso/start</code></td><td>Start an SSO sign-in flow</td></tr><tr><td>GET</td><td><code>/api/v1/me</code></td><td>Current authenticated user profile</td></tr><tr><td>GET</td><td><code>/api/v1/me/mfa</code></td><td>Current authenticated user MFA status</td></tr><tr><td>DELETE</td><td><code>/api/v1/me/mfa/credentials/{credentialId}</code></td><td>Delete a current user MFA credential</td></tr><tr><td>POST</td><td><code>/api/v1/me/mfa/recovery-codes/regenerate</code></td><td>Regenerate current user recovery codes</td></tr><tr><td>PATCH</td><td><code>/api/v1/me/preferences</code></td><td>Update current authenticated user profile preferences</td></tr><tr><td>POST</td><td><code>/api/v1/users/me/api-token</code></td><td>Generate or regenerate personal API token</td></tr><tr><td>POST</td><td><code>/oauth/token</code></td><td>Legacy backend endpoint; unavailable through stock public Web ingress</td></tr></tbody></table>

### Broker operations and schedules

<table><caption class="sr-only">Broker operations and schedules</caption><thead><tr><th scope="col">Method</th><th scope="col">Path</th><th scope="col">Purpose</th></tr></thead><tbody><tr><td>POST</td><td><code>/api/v1/messages/search</code></td><td>Search/browse messages on a queue</td></tr><tr><td>GET</td><td><code>/api/v1/messages/searches/{searchId}</code></td><td>Get search status</td></tr><tr><td>GET</td><td><code>/api/v1/messages/searches/{searchId}/results</code></td><td>Get search results</td></tr><tr><td>GET</td><td><code>/api/v1/messages/{messageRef}</code></td><td>Get message metadata, headers, properties and payload preview</td></tr><tr><td>GET</td><td><code>/api/v1/messages/{messageRef}/payload</code></td><td>Get full payload where authorised</td></tr><tr><td>GET</td><td><code>/api/v1/audit/events</code></td><td>Search audit events</td></tr><tr><td>GET</td><td><code>/api/v1/audit/events/{eventId}</code></td><td>Get a single audit event</td></tr><tr><td>POST</td><td><code>/api/v1/deletions</code></td><td>Create a delete/clean job</td></tr><tr><td>POST</td><td><code>/api/v1/deletions/preview</code></td><td>Preview a deletion (dry run)</td></tr><tr><td>GET</td><td><code>/api/v1/deletions/{jobId}</code></td><td>Get a deletion job</td></tr><tr><td>POST</td><td><code>/api/v1/deletions/{jobId}/cancel</code></td><td>Cancel a deletion job</td></tr><tr><td>GET</td><td><code>/api/v1/deletions/{jobId}/report</code></td><td>Get a deletion outcome report</td></tr><tr><td>GET</td><td><code>/api/v1/environments</code></td><td>List environments visible to the caller</td></tr><tr><td>POST</td><td><code>/api/v1/environments</code></td><td>Create environment profile</td></tr><tr><td>POST</td><td><code>/api/v1/environments/resolve-targets</code></td><td>Resolve environments by tags and labels</td></tr><tr><td>DELETE</td><td><code>/api/v1/environments/{environmentId}</code></td><td>Disable/delete environment profile</td></tr><tr><td>GET</td><td><code>/api/v1/environments/{environmentId}</code></td><td>Get environment profile</td></tr><tr><td>PATCH</td><td><code>/api/v1/environments/{environmentId}</code></td><td>Update environment profile</td></tr><tr><td>GET</td><td><code>/api/v1/environments/{environmentId}/queue-inventory/status</code></td><td>Get queue inventory refresh status</td></tr><tr><td>POST</td><td><code>/api/v1/environments/{environmentId}/queue-inventory/sync</code></td><td>Trigger asynchronous queue inventory sync</td></tr><tr><td>POST</td><td><code>/api/v1/environments/{environmentId}/test-connection</code></td><td>Test SEMP and messaging connectivity</td></tr><tr><td>GET</td><td><code>/api/v1/environments/{environmentId}/vpns</code></td><td>List message VPNs visible to the caller</td></tr><tr><td>GET</td><td><code>/api/v1/environments/{environmentId}/vpns/{vpnName}/queues</code></td><td>List queues visible to the caller</td></tr><tr><td>GET</td><td><code>/api/v1/environments/{environmentId}/vpns/{vpnName}/queues/{queueName}</code></td><td>Get queue details</td></tr><tr><td>GET</td><td><code>/api/v1/environments/{environmentId}/vpns/{vpnName}/queues/{queueName}/stats</code></td><td>Get queue statistics</td></tr><tr><td>GET</td><td><code>/api/v1/jobs</code></td><td>List jobs visible to the caller</td></tr><tr><td>GET</td><td><code>/api/v1/jobs/{jobId}</code></td><td>Get job</td></tr><tr><td>POST</td><td><code>/api/v1/jobs/{jobId}/cancel</code></td><td>Cancel job where supported</td></tr><tr><td>GET</td><td><code>/api/v1/jobs/{jobId}/events</code></td><td>Get job event stream/history</td></tr><tr><td>GET</td><td><code>/api/v1/jobs/{jobId}/report</code></td><td>Get job report</td></tr><tr><td>POST</td><td><code>/api/v1/moves</code></td><td>Create a move job; publish to target then remove original after success</td></tr><tr><td>POST</td><td><code>/api/v1/moves/preview</code></td><td>Preview a move (dry run)</td></tr><tr><td>GET</td><td><code>/api/v1/moves/{jobId}</code></td><td>Get a move job</td></tr><tr><td>POST</td><td><code>/api/v1/moves/{jobId}/cancel</code></td><td>Cancel a move job</td></tr><tr><td>GET</td><td><code>/api/v1/moves/{jobId}/report</code></td><td>Get a move outcome report</td></tr><tr><td>POST</td><td><code>/api/v1/resubmissions</code></td><td>Create a resubmission job</td></tr><tr><td>POST</td><td><code>/api/v1/resubmissions/preview</code></td><td>Preview a resubmission (dry run)</td></tr><tr><td>GET</td><td><code>/api/v1/resubmissions/{jobId}</code></td><td>Get a resubmission job</td></tr><tr><td>POST</td><td><code>/api/v1/resubmissions/{jobId}/cancel</code></td><td>Cancel a resubmission job</td></tr><tr><td>GET</td><td><code>/api/v1/resubmissions/{jobId}/report</code></td><td>Get a resubmission outcome report</td></tr><tr><td>GET</td><td><code>/api/v1/schedules</code></td><td>List schedules</td></tr><tr><td>POST</td><td><code>/api/v1/schedules</code></td><td>Create scheduled batch job</td></tr><tr><td>DELETE</td><td><code>/api/v1/schedules/{id}</code></td><td>Delete a schedule</td></tr><tr><td>GET</td><td><code>/api/v1/schedules/{id}</code></td><td>Get a schedule</td></tr><tr><td>PATCH</td><td><code>/api/v1/schedules/{id}</code></td><td>Update a schedule</td></tr><tr><td>POST</td><td><code>/api/v1/schedules/{id}/disable</code></td><td>Disable a schedule</td></tr><tr><td>POST</td><td><code>/api/v1/schedules/{id}/enable</code></td><td>Enable a schedule</td></tr><tr><td>GET</td><td><code>/api/v1/schedules/{id}/executions</code></td><td>List a schedule’s execution history</td></tr></tbody></table>

### Administration and integrations

<table><caption class="sr-only">Administration and integrations</caption><thead><tr><th scope="col">Method</th><th scope="col">Path</th><th scope="col">Purpose</th></tr></thead><tbody><tr><td>GET</td><td><code>/api/v1/admin/api-clients</code></td><td>List machine API clients</td></tr><tr><td>POST</td><td><code>/api/v1/admin/api-clients</code></td><td>Create a machine API client</td></tr><tr><td>DELETE</td><td><code>/api/v1/admin/api-clients/{clientId}</code></td><td>Delete a machine API client</td></tr><tr><td>PATCH</td><td><code>/api/v1/admin/api-clients/{clientId}</code></td><td>Update a machine API client</td></tr><tr><td>GET</td><td><code>/api/v1/admin/auth-policy</code></td><td>Get the global authentication policy</td></tr><tr><td>PUT</td><td><code>/api/v1/admin/auth-policy</code></td><td>Update the global authentication policy</td></tr><tr><td>POST</td><td><code>/api/v1/admin/auth/login-throttle/reset</code></td><td>Reset password attempt budgets for a resolved client IP</td></tr><tr><td>GET</td><td><code>/api/v1/admin/auth/settings</code></td><td>Get global auth settings</td></tr><tr><td>PUT</td><td><code>/api/v1/admin/auth/settings</code></td><td>Update global auth settings</td></tr><tr><td>GET</td><td><code>/api/v1/admin/environment-groups</code></td><td>List accessible environment groups</td></tr><tr><td>POST</td><td><code>/api/v1/admin/environment-groups</code></td><td>Create an environment group</td></tr><tr><td>DELETE</td><td><code>/api/v1/admin/environment-groups/{groupId}</code></td><td>Delete an environment group</td></tr><tr><td>GET</td><td><code>/api/v1/admin/environment-groups/{groupId}</code></td><td>Get environment group detail</td></tr><tr><td>PATCH</td><td><code>/api/v1/admin/environment-groups/{groupId}</code></td><td>Update an environment group</td></tr><tr><td>GET</td><td><code>/api/v1/admin/environment-groups/{groupId}/assignments</code></td><td>List role assignments referencing this group</td></tr><tr><td>PUT</td><td><code>/api/v1/admin/environment-groups/{groupId}/members</code></td><td>Replace group members</td></tr><tr><td>GET</td><td><code>/api/v1/admin/group-sync</code></td><td>List group sync mappings</td></tr><tr><td>POST</td><td><code>/api/v1/admin/group-sync</code></td><td>Create group sync mapping</td></tr><tr><td>DELETE</td><td><code>/api/v1/admin/group-sync/{mappingId}</code></td><td>Delete group sync mapping</td></tr><tr><td>PATCH</td><td><code>/api/v1/admin/group-sync/{mappingId}</code></td><td>Update group sync mapping</td></tr><tr><td>GET</td><td><code>/api/v1/admin/roles</code></td><td>List RBAC roles</td></tr><tr><td>POST</td><td><code>/api/v1/admin/roles</code></td><td>Create custom role</td></tr><tr><td>DELETE</td><td><code>/api/v1/admin/roles/{roleId}</code></td><td>Delete custom role</td></tr><tr><td>PATCH</td><td><code>/api/v1/admin/roles/{roleId}</code></td><td>Update custom role</td></tr><tr><td>GET</td><td><code>/api/v1/admin/settings/api-token</code></td><td>Get platform API token settings</td></tr><tr><td>PATCH</td><td><code>/api/v1/admin/settings/api-token</code></td><td>Update platform API token settings</td></tr><tr><td>PUT</td><td><code>/api/v1/admin/settings/dashboard</code></td><td>Update the dashboard configuration</td></tr><tr><td>GET</td><td><code>/api/v1/admin/settings/observability</code></td><td>Get observability settings</td></tr><tr><td>PUT</td><td><code>/api/v1/admin/settings/observability</code></td><td>Update observability settings</td></tr><tr><td>POST</td><td><code>/api/v1/admin/settings/observability/test</code></td><td>Test a saved observability endpoint</td></tr><tr><td>GET</td><td><code>/api/v1/admin/settings/retention</code></td><td>Get platform data-retention settings</td></tr><tr><td>PATCH</td><td><code>/api/v1/admin/settings/retention</code></td><td>Update platform data-retention settings</td></tr><tr><td>GET</td><td><code>/api/v1/admin/settings/semp-traffic</code></td><td>Read SEMP background cadence and shared cache settings</td></tr><tr><td>PATCH</td><td><code>/api/v1/admin/settings/semp-traffic</code></td><td>Replace SEMP background cadence and shared cache settings</td></tr><tr><td>GET</td><td><code>/api/v1/admin/settings/semp-usage</code></td><td>Read near-real-time per-environment physical SEMP usage</td></tr><tr><td>GET</td><td><code>/api/v1/admin/sso/provider-presets</code></td><td>List SSO provider presets</td></tr><tr><td>GET</td><td><code>/api/v1/admin/sso/providers</code></td><td>List SSO providers</td></tr><tr><td>POST</td><td><code>/api/v1/admin/sso/providers</code></td><td>Create an SSO provider</td></tr><tr><td>POST</td><td><code>/api/v1/admin/sso/providers/parse-metadata</code></td><td>Parse uploaded IdP metadata into provider fields</td></tr><tr><td>DELETE</td><td><code>/api/v1/admin/sso/providers/{providerId}</code></td><td>Archive an SSO provider</td></tr><tr><td>GET</td><td><code>/api/v1/admin/sso/providers/{providerId}</code></td><td>Get an SSO provider</td></tr><tr><td>PATCH</td><td><code>/api/v1/admin/sso/providers/{providerId}</code></td><td>Update an SSO provider</td></tr><tr><td>POST</td><td><code>/api/v1/admin/sso/providers/{providerId}/disable</code></td><td>Disable an SSO provider</td></tr><tr><td>POST</td><td><code>/api/v1/admin/sso/providers/{providerId}/enable</code></td><td>Enable an SSO provider</td></tr><tr><td>POST</td><td><code>/api/v1/admin/sso/providers/{providerId}/test</code></td><td>Test an SSO provider configuration</td></tr><tr><td>GET</td><td><code>/api/v1/admin/users</code></td><td>List managed users</td></tr><tr><td>POST</td><td><code>/api/v1/admin/users</code></td><td>Create managed user</td></tr><tr><td>GET</td><td><code>/api/v1/admin/users/sponsor-candidates</code></td><td>Search for sponsor candidates</td></tr><tr><td>DELETE</td><td><code>/api/v1/admin/users/{userId}</code></td><td>Delete managed user</td></tr><tr><td>GET</td><td><code>/api/v1/admin/users/{userId}</code></td><td>Get managed user</td></tr><tr><td>PATCH</td><td><code>/api/v1/admin/users/{userId}</code></td><td>Update managed user</td></tr><tr><td>PATCH</td><td><code>/api/v1/admin/users/{userId}/api-access</code></td><td>Enable or disable API access for a managed user</td></tr><tr><td>POST</td><td><code>/api/v1/admin/users/{userId}/api-token</code></td><td>Admin — generate or regenerate API token for a user or Service Account</td></tr><tr><td>GET</td><td><code>/api/v1/admin/users/{userId}/ip-allowlist</code></td><td>Get IP allowlist for a Service Account</td></tr><tr><td>PUT</td><td><code>/api/v1/admin/users/{userId}/ip-allowlist</code></td><td>Replace IP allowlist for a Service Account</td></tr><tr><td>POST</td><td><code>/api/v1/admin/users/{userId}/reset-mfa</code></td><td>Reset MFA for a managed user</td></tr><tr><td>POST</td><td><code>/api/v1/admin/users/{userId}/revoke-sessions</code></td><td>Revoke all of a user’s active sessions</td></tr><tr><td>PATCH</td><td><code>/api/v1/admin/users/{userId}/sponsor</code></td><td>Change the Sponsor for a Service Account</td></tr><tr><td>GET</td><td><code>/api/v1/compliance/evidence</code></td><td>List compliance-evidence bundles</td></tr><tr><td>POST</td><td><code>/api/v1/compliance/evidence</code></td><td>Generate a compliance-evidence bundle</td></tr><tr><td>GET</td><td><code>/api/v1/compliance/evidence/{id}</code></td><td>Get a compliance-evidence bundle</td></tr><tr><td>GET</td><td><code>/api/v1/compliance/evidence/{id}/export</code></td><td>Export a compliance-evidence bundle</td></tr><tr><td>POST</td><td><code>/api/v1/license</code></td><td>Upload and activate a signed JSON license</td></tr><tr><td>GET</td><td><code>/api/v1/license/status</code></td><td>Get platform license status</td></tr><tr><td>GET</td><td><code>/api/v1/observability/browser-config</code></td><td>Get browser telemetry configuration</td></tr><tr><td>POST</td><td><code>/api/v1/observability/browser-traces</code></td><td>Browser OTLP trace proxy</td></tr><tr><td>GET</td><td><code>/api/v1/platform-info</code></td><td>Get public platform/dashboard configuration</td></tr><tr><td>POST</td><td><code>/api/v1/service-accounts/{serviceAccountId}/api-token</code></td><td>Sponsor — generate or regenerate API token for a Service Account</td></tr><tr><td>GET</td><td><code>/api/v1/service-accounts/{serviceAccountId}/ip-allowlist</code></td><td>Sponsor — get IP allowlist for a Service Account</td></tr></tbody></table>