Module admin_api 

Remote administration: /admin/*.

A plain JSON API, deliberately not MCP tools. Administration must not appear in any agent’s tool catalogue, and an agent token must never be able to mint a credential — not even for its own agent. The only bearer this surface accepts is an administrative credential (AdminCtx), which in turn cannot do anything on /mcp.

Every permission decision is made here, from the credential alone. The team in a path is a slug the credential must be allowed to administer; the request body, a UUID or a query string can never widen that.

Same shape as the MCP surface: stateless, one bearer header, so a bare curl always works.

Structs

AdminApiState

Enums

ApiError

Errors on this surface, rendered as {"error": "..."} with a status.

Constants

ADMIN_RATE_LIMIT_DIVISOR

The /admin rate limit is this fraction of the MCP one (BUS_RATE_LIMIT_PER_MINUTE): 600/min for agents means 60/min for administration. Administration is a handful of calls a day, so a leaked or looping credential cannot mint at speed, and there is no second knob to forget. Setting the MCP limit to 0 disables both.

MAX_ADMIN_REQUEST_BYTES

Largest /admin request body. Names and labels; nothing here is a document.

Functions

router

The /admin router, to be nested at that path. Generic over the outer state so it merges into the main router whatever that carries; it needs none of it.