Module admin 

The admin API (18.10.0, #29): change and inspect a running server on a listener of its own, never on the public routes.

[admin]
listen          = "127.0.0.1:9901"     # off when unset
token_env       = "RWS_ADMIN_TOKEN"    # env var holding the bearer token (this is the default)
allowed_origins = ["https://ops.example.com"]   # browsers on other origins (the UI's own is always allowed)

Every request needs Authorization: Bearer <token>, on loopback too; without a token the listener doesn’t start (and rws --check says so). A browser request from an origin other than the listener’s own or one in allowed_origins is refused, so a page elsewhere can’t drive it with a token it learned.

The API lives under /admin/api/v1/; AdminApi is an Application, so tests and embedders can drive it without a socket. Requests are served one thread per connection (at most MAX_CONNECTIONS at once), apart from the server’s own workers, so a saturated server can still be administered.

Modules

ops

What the admin API and the rws binary’s MCP tools both do, as JSON. One implementation, so the two can’t drift apart.

Structs

AdminApi

The admin API. See the module docs.

AdminConfig

[admin] from the environment (RWS_CONFIG_ADMIN_*).

Constants

API_PREFIX

Path prefix of the API.

DEFAULT_TOKEN_ENV

The token’s environment variable when token_env is unset.

MAX_CONNECTIONS

Admin connections served at once; more are closed at accept.

Functions

features

Compile-time features of this build that matter to an operator.

start

Start the admin listener config describes, on a thread of its own. Ok(None) when it is off.

start_from_env

start from RWS_CONFIG_ADMIN_*, reporting the outcome: the binary’s entry point. A misconfigured admin API is logged, not fatal.