pub struct TenantsApi { /* private fields */ }Expand description
Tenant management and API keys
Implementations§
Source§impl TenantsApi
impl TenantsApi
Sourcepub async fn accept_invite_from_picker(
&self,
tenant_id: &str,
invite_id: &str,
body: &AcceptInviteFromPickerRequest,
) -> Result<AcceptInviteFromPickerResponse>
pub async fn accept_invite_from_picker( &self, tenant_id: &str, invite_id: &str, body: &AcceptInviteFromPickerRequest, ) -> Result<AcceptInviteFromPickerResponse>
Accept a pending invite from the tenant picker
The tenant is in the PATH, and that is the whole reason this route exists beside POST /api/v1/users/invites/{inviteId}/accept. The older route resolves the invite against the
caller’s active tenant, which cannot work here: the caller is not a member of the inviting
tenant yet — making them one is what the call is for. Without a tenant-in-path route the
picker’s Accept button can never succeed for a cross-tenant invite.
Semantics are otherwise identical to the older route: the same atomic create-user + email
index + membership index + invite.status = accepted write.
Four refusals, and they are different questions: 403 the invite is addressed to another
email, or the token does not match; 409 the invite is not pending (already accepted,
revoked, declined) or the email already belongs to a member; 410 the invite has expired;
404 no such invite, or the caller has no user record.
POST /api/v1/me/invites/{tenantId}/{inviteId}/accept
Sourcepub async fn create_api_key(
&self,
body: &CreateAPIKeyRequest,
) -> Result<APIKeyResponse>
pub async fn create_api_key( &self, body: &CreateAPIKeyRequest, ) -> Result<APIKeyResponse>
Create a new API key
POST /api/v1/tenants/me/keys
Required scopes: tenants:write.
Sourcepub async fn create_my_tenant(
&self,
body: &CreateMyTenantRequest,
) -> Result<CreateMyTenantResponse>
pub async fn create_my_tenant( &self, body: &CreateMyTenantRequest, ) -> Result<CreateMyTenantResponse>
Create a new tenant with the caller as owner
Provisions a brand-new tenant on the free plan (or enterprise for super-admin). The
caller becomes the founding owner. Onboarding wizard auto-runs on /browser to provision the
Head Agent.
POST /api/v1/me/tenants/create
Sourcepub async fn decline_invite_from_picker(
&self,
tenant_id: &str,
invite_id: &str,
) -> Result<DeclineInviteFromPickerResponse>
pub async fn decline_invite_from_picker( &self, tenant_id: &str, invite_id: &str, ) -> Result<DeclineInviteFromPickerResponse>
Decline a pending invite
Deliberately distinct from an admin’s revoke, so the audit trail and the Members page can tell “the invitee said no” from “an admin pulled it”. The caller’s email must match the invite’s — without that check anyone with a current session could decline someone else’s invites.
No token is required here, unlike accept: declining grants nothing.
POST /api/v1/me/invites/{tenantId}/{inviteId}/decline
Sourcepub async fn get_current_tenant(&self) -> Result<Tenant>
pub async fn get_current_tenant(&self) -> Result<Tenant>
Get current tenant
Returns the calling tenant’s profile. Any authenticated key passes — no scope required.
GET /api/v1/tenants/me
Required scopes: api_keys:read.
Sourcepub async fn get_my_head_agent_template(
&self,
) -> Result<GetMyHeadAgentTemplateResponse>
pub async fn get_my_head_agent_template( &self, ) -> Result<GetMyHeadAgentTemplateResponse>
Tiered Head Agent template for the onboarding wizard
Returns Basic/Standard/Full tier metadata for the current tenant under the Variant-A
SPEC-driven contract. Each tier names the @platform/* SPECs the wizard installs (via
install_specs) plus an auto_approve_tools HITL list. Availability is a plan-rank check
(required_plan); locked tiers ship empty install_specs.
GET /api/v1/me/head-agent-template
Sourcepub async fn get_tenant_domain_health(
&self,
) -> Result<GetTenantDomainHealthResponse>
pub async fn get_tenant_domain_health( &self, ) -> Result<GetTenantDomainHealthResponse>
DNS and certificate state for this tenant’s custom domain
Two different 404s, and a client should tell them apart: no such tenant, and a tenant with no custom domain configured. The second is the ordinary state of most tenants and is not an error condition — a UI that renders both as a failure will report a fault to every customer who has not set up a vanity domain.
Records written before the lifecycle schema are lifted on read, so dns and cert are
present here even for a domain added under the old flat fields.
GET /api/v1/tenants/me/domain/health
Required scopes: api_keys:read.
Sourcepub async fn leave_tenant(&self, tenant_id: &str) -> Result<LeaveTenantResponse>
pub async fn leave_tenant(&self, tenant_id: &str) -> Result<LeaveTenantResponse>
Leave a tenant
Removes the caller’s own membership. The user-record cascade matches an admin-driven removal.
Two refusals, both 409, and both name a specific thing to do first. The caller is the
only ACTIVE owner: transfer ownership before leaving. Or the caller is the only veto-holding
ambassador: rotate the founder ambassador via /api/v1/governance/ambassadors first. The
second check is skipped entirely when governance is not enabled, so its absence is not a
promise that no such constraint exists.
DELETE /api/v1/me/memberships/{tenantId}
Sourcepub async fn list_api_keys(&self) -> Result<ListAPIKeysResponse>
pub async fn list_api_keys(&self) -> Result<ListAPIKeysResponse>
List API keys
GET /api/v1/tenants/me/keys
Required scopes: api_keys:read.
Sourcepub async fn list_my_tenants(&self) -> Result<ListMyTenantsResponse>
pub async fn list_my_tenants(&self) -> Result<ListMyTenantsResponse>
List the caller’s tenant memberships + pending invites
Returns every tenant the calling user is a member of, plus any pending invites addressed to their email. Used by the Netflix-style picker (/browser/tenants).
GET /api/v1/me/tenants
Sourcepub async fn locate_my_agent(
&self,
agent_id: &str,
) -> Result<LocateMyAgentResponse>
pub async fn locate_my_agent( &self, agent_id: &str, ) -> Result<LocateMyAgentResponse>
Find which tenant owns the given agent across caller’s memberships
Used by the chat layout fallback when the URL points at an agent under a different active tenant. Returns the owning tenant_id in one round-trip; the alternative was N client-side probes that surfaced expected 404s in the browser console.
GET /api/v1/me/agents/{agentId}/locate
Sourcepub async fn patch(
&self,
body: &Map<String, Value>,
) -> Result<Map<String, Value>>
pub async fn patch( &self, body: &Map<String, Value>, ) -> Result<Map<String, Value>>
Partial update tenant
Partial update of tenant settings. Requires the tenants:write scope and role owner.
PATCH /api/v1/tenants/me
Required scopes: tenants:write.
Sourcepub async fn revoke_api_key(&self, key_id: &str) -> Result<RevokeAPIKeyResponse>
pub async fn revoke_api_key(&self, key_id: &str) -> Result<RevokeAPIKeyResponse>
Revoke an API key
DELETE /api/v1/tenants/me/keys/{keyId}
Required scopes: tenants:write.
Sourcepub async fn update(&self, body: &UpdateTenantRequest) -> Result<Value>
pub async fn update(&self, body: &UpdateTenantRequest) -> Result<Value>
Update current tenant settings
PUT /api/v1/tenants/me
Required scopes: tenants:write.
Sourcepub async fn verify_tenant_domain(
&self,
body: &Map<String, Value>,
) -> Result<VerifyTenantDomainResponse>
pub async fn verify_tenant_domain( &self, body: &Map<String, Value>, ) -> Result<VerifyTenantDomainResponse>
Verify domain
POST /api/v1/tenants/me/domain/verify
Required scopes: tenants:write.
Trait Implementations§
Source§impl Clone for TenantsApi
impl Clone for TenantsApi
Source§fn clone(&self) -> TenantsApi
fn clone(&self) -> TenantsApi
1.0.0 (const: unstable) · Source§fn clone_from(&mut self, source: &Self)
fn clone_from(&mut self, source: &Self)
source. Read more