Admin APIs
REST API reference for the admin dashboard — devices, groups, policies, alerts, users.
Base URL
https://your-server:5100/api/adminAll endpoints require JWT authentication via Authorization: Bearer <token>.
Pagination
All list endpoints support pagination:
page— Page number (default: 1)per_page— Items per page (default: 20, max: 100)
---
Devices
GET /devices
List all devices in the current tenant.
Filters: group_id, status, os, search (hostname/username/serial/email)
Min role: viewer
GET /devices/{id}
Get device details including guard status, alerts, and command history.
Min role: viewer
PUT /devices/{id}
Update device properties (group assignment, status, notes).
Min role: tenant_manager
POST /devices/{id}/command
Send a remote command to a device.
Min role: tenant_manager
---
Groups
GET /groups
List all device groups with hierarchy.
Min role: viewer
POST /groups
Create a new device group.
Min role: tenant_manager
PUT /groups/{id}
Update group name, parent, or policy assignment.
Min role: tenant_manager
DELETE /groups/{id}
Delete a device group.
Min role: tenant_admin
---
Policies
GET /policies
List all policies in the current tenant.
Min role: viewer
POST /policies
Create a new policy.
Min role: tenant_admin
GET /policies/{id}
Get policy details with all guard configurations.
Min role: viewer
PUT /policies/{id}
Update a policy. Automatically increments the version number.
Min role: tenant_admin
POST /policies/{id}/clone
Clone an existing policy.
Min role: tenant_admin
---
Exceptions
GET /exceptions
List all user exceptions.
Min role: viewer
POST /exceptions
Create a user exception. Types: disable, whitelist, mode.
Min role: tenant_admin
PUT /exceptions/{id}
Update an exception.
Min role: tenant_admin
DELETE /exceptions/{id}
Delete an exception.
Min role: tenant_admin
---
Alerts
GET /alerts
List alerts with filtering.
Filters: severity, guard, device_id, acknowledged, date_from, date_to
Min role: viewer
PUT /alerts/{id}/ack
Acknowledge a single alert.
Min role: viewer
PUT /alerts/bulk-ack
Acknowledge multiple alerts at once.
Min role: viewer
---
Enrollment Tokens
GET /enrollment-tokens
List all enrollment tokens.
Min role: viewer
POST /enrollment-tokens
Generate a new enrollment token.
Min role: tenant_manager
---
USB Device Registry
GET /usb-devices
List whitelisted USB devices.
Min role: viewer
POST /usb-devices
Add a USB device to the whitelist.
Min role: tenant_manager
---
Reports
GET /reports/compliance
Device compliance report.
Min role: viewer
GET /reports/alerts-trend
Alert volume trend over time.
Min role: viewer
GET /reports/guard-stats
Guard activity breakdown.
Min role: viewer
---
Users
GET /users
List admin users.
Min role: tenant_admin
POST /users
Create a new admin user.
Min role: tenant_admin
---
Other
GET /settings
Get tenant settings.
Min role: viewer
GET /audit-log
View admin audit log.
Min role: tenant_admin
GET /recovery-keys/{device_id}
View device recovery keys.
Min role: tenant_admin
---
Audit Logging
All mutating admin actions (POST, PUT, DELETE) are automatically logged in the admin_audit_log table with the action type, target, and full details payload.
Tenant Isolation
Every query is automatically scoped to the current user's tenant_id. Super admins can override this by passing tenant_id as a query parameter to access other tenants' data.