Stable API tag

console

Console admin operations (secrets, sources, connectors, SSO, license)

53 paths · 75 operations

/v1/console/activation

get

The edition's activation view: current edition and preset, each add-on's state and each preset's add-on keys

Operation ID: getActivationStatus
Authentication: Bearer token
Request body: None

Parameters: none declared.

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 429

/v1/console/activation/apply

post

Enable or disable a preset or one family, or promote one add-on (AAL3 step-up; 501 without the activation service)

Operation ID: applyActivation
Authentication: Bearer token
Request body: Present · required

Parameters: none declared.

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 429

/v1/console/activation/preview

post

Preview a preset change as a per-add-on diff (activate, stage, unchanged or console) without applying it

Operation ID: previewActivation
Authentication: Bearer token
Request body: Present · required

Parameters: none declared.

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 429

/v1/console/bus

get

Event-bus subscriber, saturation, loss, and optional bridge snapshot

Operation ID: getBusSnapshot
Authentication: Bearer token
Request body: None

Parameters: none declared.

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 429

/v1/console/config/effective

get

Live effective configuration with secret-bearing values redacted

Operation ID: getEffectiveConfig
Authentication: Bearer token
Request body: None

Parameters: none declared.

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 429

/v1/console/connectors

get

List available connector types with their configuration fields

Operation ID: listConnectorCatalog
Authentication: Bearer token
Request body: None

Parameters: none declared.

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 429

put

Onboard or update a connector instance

Operation ID: putConnector
Authentication: Bearer token
Request body: Present · required

Parameters: none declared.

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 429

delete

Remove a connector instance

Operation ID: deleteConnector
Authentication: Bearer token
Request body: Present · required

Parameters: none declared.

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 429

/v1/console/connectors/test

post

Test connectivity for a connector configuration

Operation ID: testConnector
Authentication: Bearer token
Request body: Present · required

Parameters: none declared.

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 429

/v1/console/dr/backup

post

Start an encrypted disaster-recovery backup and return its job id (501 without the DR service)

Operation ID: triggerBackup
Authentication: Bearer token
Request body: Present · required

Parameters: none declared.

Response codes

202 · 400 · 401 · 403 · 404 · 409 · 429

/v1/console/dr/backups

get

List the backup directory's .drbundle files, newest first, with each bundle's manifest summary

Operation ID: listBackups
Authentication: Bearer token
Request body: None

Parameters: none declared.

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 429

/v1/console/dr/backups/{id}

get

One backup's manifest and size by bundle id

Operation ID: getBackup
Authentication: Bearer token
Request body: None

Parameters
Name	In	Required	Type
id	path	yes	string

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 429

delete

Delete one backup bundle by id

Operation ID: deleteBackup
Authentication: Bearer token
Request body: None

Parameters
Name	In	Required	Type
id	path	yes	string

Response codes

204 · 400 · 401 · 403 · 404 · 409 · 429

/v1/console/dr/backups/{id}/download

get

Download one backup bundle's verbatim bytes (.drbundle)

Operation ID: downloadBackup
Authentication: Bearer token
Request body: None

Parameters
Name	In	Required	Type
id	path	yes	string

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 429

/v1/console/dr/jobs

get

The DR job list (backup and restore) with phase and progress

Operation ID: listDRJobs
Authentication: Bearer token
Request body: None

Parameters: none declared.

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 429

/v1/console/dr/jobs/{id}/stream

get

Server-Sent Events stream of one DR job's progress: event: job frames with the DRJob payload, heartbeats as comments, until the job completes or fails

Operation ID: streamDRJob
Authentication: Bearer token
Request body: None

Parameters: none declared.

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 429

/v1/console/dr/restore/pending

get

Restore requests awaiting a second approver, newest first, so a distinct admin can find and approve one

Operation ID: listPendingRestores
Authentication: Bearer token
Request body: None

Parameters: none declared.

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 429

/v1/console/dr/restore/upload

post

Upload a raw .drbundle file for restore pre-flight (the body is the file's verbatim bytes, at most 10 GiB); the manifest is inspected and returned with the upload id

Operation ID: uploadRestore
Authentication: Bearer token
Request body: Present · required

Parameters: none declared.

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 429

/v1/console/dr/restore/{id}/apply

post

Apply an uploaded bundle: with the dual-control gate armed this records an intent for a second administrator to approve (request_id); otherwise it starts the restore job (job_id)

Operation ID: applyRestore
Authentication: Bearer token
Request body: Present · required

Parameters
Name	In	Required	Type
id	path	yes	string

Response codes

202 · 400 · 401 · 403 · 404 · 409 · 429

/v1/console/dr/restore/{id}/approve

post

Approve a dual-control restore as a DISTINCT administrator account (403 when the requester self-approves)

Operation ID: approveRestore
Authentication: Bearer token
Request body: Present · required

Parameters
Name	In	Required	Type
id	path	yes	string

Response codes

202 · 400 · 401 · 403 · 404 · 409 · 429

/v1/console/dr/schedule

get

The scheduled-backup configuration and its last run's outcome

Operation ID: getDRSchedule
Authentication: Bearer token
Request body: None

Parameters: none declared.

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 429

put

Save the schedule (enabled, cron, retention); the dual-control restore gate's armed state is preserved, and server-owned bookkeeping fields are ignored

Operation ID: putDRSchedule
Authentication: Bearer token
Request body: Present · required

Parameters: none declared.

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 429

/v1/console/health-summary

get

Operational health summary for the console dashboard

Operation ID: getHealthSummary
Authentication: Bearer token
Request body: None

Parameters: none declared.

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 429

/v1/console/keys

get

Non-secret signing-key and sealer custody inventory

Operation ID: getKeyCustody
Authentication: Bearer token
Request body: None

Parameters: none declared.

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 429

/v1/console/license

get

Current license status and entitlements

Operation ID: getLicenseStatus
Authentication: Bearer token
Request body: None

Parameters: none declared.

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 429

post

Install a commercial license

Operation ID: installLicense
Authentication: Bearer token
Request body: Present · required

Parameters: none declared.

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 429

delete

Remove the installed license (revert to community)

Operation ID: uninstallLicense
Authentication: Bearer token
Request body: None

Parameters: none declared.

Response codes

204 · 400 · 401 · 403 · 404 · 409 · 429

/v1/console/logs/buffer

get

The engine log's ring-buffer snapshot, newest last, with the match total and whether older matches were left out

Operation ID: getLogBuffer
Authentication: Bearer token
Request body: None

Parameters
Name	In	Required	Type
module	query	no	string
levels	query	no	string
level	query	no	string
limit	query	no	integer

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 429

/v1/console/logs/stream

get

Server-Sent Events stream of the engine log: event: log frames with one entry's payload, heartbeats as comments; filtered by the same parameters as the buffer

Operation ID: streamLogs
Authentication: Bearer token
Request body: None

Parameters
Name	In	Required	Type
module	query	no	string
levels	query	no	string
level	query	no	string

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 429

/v1/console/mcp-gateway

get

Read the effective MCP gateway configuration and governance.

Operation ID: getMCPGateway
Authentication: Bearer token
Request body: None

Parameters
Name	In	Required	Type
X-Olivares-Tenant	header	no	string · uuid

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 503

/v1/console/mcp-gateway/servers

post

Add a disabled upstream using tenant secret references (AAL3).

Operation ID: addMCPGatewayServer
Authentication: Bearer token
Request body: Present · required

Parameters
Name	In	Required	Type
X-Olivares-Tenant	header	no	string · uuid

Response codes

201 · 400 · 401 · 403 · 404 · 409 · 503

/v1/console/mcp-gateway/servers/{id}

put

Update or explicitly enable a tested upstream (AAL3).

Operation ID: updateMCPGatewayServer
Authentication: Bearer token
Request body: Present · required

Parameters
Name	In	Required	Type
X-Olivares-Tenant	header	no	string · uuid

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 503

delete

Remove an upstream from the tenant gateway (AAL3).

Operation ID: removeMCPGatewayServer
Authentication: Bearer token
Request body: Present · required

Parameters
Name	In	Required	Type
X-Olivares-Tenant	header	no	string · uuid

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 503

/v1/console/mcp-gateway/servers/{id}/test

post

Initialize and list tools without calling them; record a bounded verdict (AAL3).

Operation ID: testMCPGatewayServer
Authentication: Bearer token
Request body: Present · required

Parameters
Name	In	Required	Type
X-Olivares-Tenant	header	no	string · uuid

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 503

/v1/console/mcp-gateway/session-tools

put

Set the default-off session MCP switch for this tenant (AAL3).

Operation ID: setMCPGatewaySessionTools
Authentication: Bearer token
Request body: Present · required

Parameters
Name	In	Required	Type
X-Olivares-Tenant	header	no	string · uuid

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 503

/v1/console/modules

get

The module catalog and, for each module, whether it is selected, running, always-on, holds data, and who keeps it on

Operation ID: getModuleSelection
Authentication: Bearer token
Request body: None

Parameters: none declared.

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 429

put

Set which optional modules the engine runs; the engine restarts itself to apply the change (AAL3 step-up)

Operation ID: selectModules
Authentication: Bearer token
Request body: Present · required

Parameters: none declared.

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 429

/v1/console/notify-destinations

get

List notification destinations and the kinds the console can create

Operation ID: listNotifyDestinations
Authentication: Bearer token
Request body: None

Parameters: none declared.

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 429

put

Create or update a Slack or Teams notification destination

Operation ID: putNotifyDestination
Authentication: Bearer token
Request body: Present · required

Parameters: none declared.

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 429

delete

Remove a console notification destination

Operation ID: deleteNotifyDestination
Authentication: Bearer token
Request body: Present · required

Parameters: none declared.

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 429

/v1/console/notify-destinations/test

post

Send a test message through a candidate notification destination

Operation ID: testNotifyDestination
Authentication: Bearer token
Request body: Present · required

Parameters: none declared.

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 429

/v1/console/runtime/reload

post

Reconcile the durable source roster against the running engine and re-resolve the license (AAL3 step-up); the report names what applied and what needs a restart

Operation ID: reloadRuntime
Authentication: Bearer token
Request body: None

Parameters: none declared.

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 429

/v1/console/secrets

get

List sealed secrets (names and hints, never values)

Operation ID: listSecrets
Authentication: Bearer token
Request body: None

Parameters: none declared.

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 429

put

Create or update a sealed secret

Operation ID: putSecret
Authentication: Bearer token
Request body: Present · required

Parameters: none declared.

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 429

delete

Delete a sealed secret

Operation ID: deleteSecret
Authentication: Bearer token
Request body: None

Parameters: none declared.

Response codes

204 · 400 · 401 · 403 · 404 · 409 · 429

/v1/console/secrets/generate

post

Generate a random password for the signed-in member; nothing is stored

Operation ID: generatePassword
Authentication: Bearer token
Request body: Present · required

Parameters: none declared.

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 429

/v1/console/secrets/reveal

post

Reveal one item of the caller's own personal vault (step-up, audited, rate limited)

Operation ID: revealSecret
Authentication: Bearer token
Request body: Present · required

Parameters: none declared.

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 429

/v1/console/secrets/totp

post

Current authenticator code of one of the caller's own vault items (step-up, audited, rate limited; never the seed)

Operation ID: getVaultCode
Authentication: Bearer token
Request body: Present · required

Parameters: none declared.

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 429

/v1/console/setup-status

get

First-run setup wizard progress

Operation ID: getSetupStatus
Authentication: Bearer token
Request body: None

Parameters: none declared.

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 429

/v1/console/sources

get

List configured source connectors and their status

Operation ID: listSources
Authentication: Bearer token
Request body: None

Parameters: none declared.

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 429

put

Create or update a source connector

Operation ID: putSource
Authentication: Bearer token
Request body: Present · required

Parameters: none declared.

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 429

delete

Remove a source connector

Operation ID: deleteSource
Authentication: Bearer token
Request body: Present · required

Parameters: none declared.

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 429

/v1/console/sources/diff

get

A bounded content diff between two refs of one repository owned by a configured source (501 when no git-host diff reader is wired; 422 when the diff exceeds the read cap)

Operation ID: getSourceContentDiff
Authentication: Bearer token
Request body: None

Parameters
Name	In	Required	Type
source	query	yes	string
host	query	yes	string
repository	query	yes	string
base	query	yes	string
head	query	yes	string

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 429

/v1/console/sso

get

Current SSO/IdP configuration

Operation ID: getSSOConfig
Authentication: Bearer token
Request body: None

Parameters: none declared.

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 429

put

Create or update SSO/IdP configuration

Operation ID: putSSOConfig
Authentication: Bearer token
Request body: Present · required

Parameters: none declared.

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 429

delete

Remove SSO/IdP configuration

Operation ID: deleteSSOConfig
Authentication: Bearer token
Request body: None

Parameters: none declared.

Response codes

204 · 400 · 401 · 403 · 404 · 409 · 429

/v1/console/sso/idps

get

List every IdP configured under the deployment-wide global scope, default first; no secrets, only hints

Operation ID: listSSOIdPs
Authentication: Bearer token
Request body: None

Parameters: none declared.

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 429

/v1/console/sso/idps/{alias}

get

Get one additional IdP's configuration by alias

Operation ID: getSSOIdP
Authentication: Bearer token
Request body: None

Parameters
Name	In	Required	Type
alias	path	yes	string

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 429

put

Create or update one additional IdP by alias (AAL3 step-up)

Operation ID: putSSOIdP
Authentication: Bearer token
Request body: Present · required

Parameters
Name	In	Required	Type
alias	path	yes	string

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 429

delete

Remove one additional IdP by alias (AAL3 step-up)

Operation ID: deleteSSOIdP
Authentication: Bearer token
Request body: None

Parameters
Name	In	Required	Type
alias	path	yes	string

Response codes

204 · 400 · 401 · 403 · 404 · 409 · 429

/v1/console/sso/idps/{alias}/test

post

Validate a candidate additional-IdP config (OIDC discovery / SAML metadata fetch) without persisting it; 501 when no SSO provider service is wired

Operation ID: testSSOIdP
Authentication: Bearer token
Request body: Present · required

Parameters
Name	In	Required	Type
alias	path	yes	string

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 429

/v1/console/sso/tenants/{tenant}

get

Get the tenant's primary SSO/IdP configuration

Operation ID: getTenantSSOConfig
Authentication: Bearer token
Request body: None

Parameters
Name	In	Required	Type
tenant	path	yes	string

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 429

put

Create or update the tenant's primary SSO/IdP configuration (AAL3 step-up)

Operation ID: putTenantSSOConfig
Authentication: Bearer token
Request body: Present · required

Parameters
Name	In	Required	Type
tenant	path	yes	string

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 429

delete

Remove the tenant's primary SSO/IdP configuration (AAL3 step-up)

Operation ID: deleteTenantSSOConfig
Authentication: Bearer token
Request body: None

Parameters
Name	In	Required	Type
tenant	path	yes	string

Response codes

204 · 400 · 401 · 403 · 404 · 409 · 429

/v1/console/sso/tenants/{tenant}/idps

get

List every IdP configured under the tenant's scope, default first; no secrets, only hints

Operation ID: listTenantSSOIdPs
Authentication: Bearer token
Request body: None

Parameters
Name	In	Required	Type
tenant	path	yes	string

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 429

/v1/console/sso/tenants/{tenant}/idps/{alias}

get

Get one of the tenant's additional IdPs by alias

Operation ID: getTenantSSOIdP
Authentication: Bearer token
Request body: None

Parameters
Name	In	Required	Type
tenant	path	yes	string
alias	path	yes	string

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 429

put

Create or update one of the tenant's additional IdPs by alias (AAL3 step-up)

Operation ID: putTenantSSOIdP
Authentication: Bearer token
Request body: Present · required

Parameters
Name	In	Required	Type
tenant	path	yes	string
alias	path	yes	string

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 429

delete

Remove one of the tenant's additional IdPs by alias (AAL3 step-up)

Operation ID: deleteTenantSSOIdP
Authentication: Bearer token
Request body: None

Parameters
Name	In	Required	Type
tenant	path	yes	string
alias	path	yes	string

Response codes

204 · 400 · 401 · 403 · 404 · 409 · 429

/v1/console/sso/tenants/{tenant}/idps/{alias}/test

post

Validate a candidate tenant-scoped IdP config without persisting it; 501 when no SSO provider service is wired

Operation ID: testTenantSSOIdP
Authentication: Bearer token
Request body: Present · required

Parameters
Name	In	Required	Type
tenant	path	yes	string
alias	path	yes	string

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 429

/v1/console/sso/tenants/{tenant}/test

post

Test the tenant's primary SSO/IdP connectivity (AAL3 step-up)

Operation ID: testTenantSSOConfig
Authentication: Bearer token
Request body: Present · required

Parameters
Name	In	Required	Type
tenant	path	yes	string

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 429

/v1/console/sso/test

post

Test SSO/IdP connectivity

Operation ID: testSSOConfig
Authentication: Bearer token
Request body: Present · required

Parameters: none declared.

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 429

/v1/console/support-bundle

post

Build and download a redacted support bundle (AAL3 step-up)

Operation ID: createSupportBundle
Authentication: Bearer token
Request body: None

Parameters: none declared.

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 429

/v1/console/update-check

post

Check the configured signed update channel now

Operation ID: refreshUpdateStatus
Authentication: Bearer token
Request body: None

Parameters: none declared.

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 429

/v1/console/updates

get

The running version, the newest signed release in the instance's channel with its notes, and whether it is newer

Operation ID: getEngineUpdate
Authentication: Bearer token
Request body: None

Parameters: none declared.

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 429

/v1/console/updates/apply

post

Install the newest release as the olivares upgrade command does and restart the engine on it (AAL3 step-up)

Operation ID: applyEngineUpdate
Authentication: Bearer token
Request body: None

Parameters: none declared.

Response codes

200 · 400 · 401 · 403 · 404 · 409 · 429