Skip to main content

Tenant Control Plane

Server-key tenant control plane endpoints power the dashboard and partner operator workflows. They require a secret server key and are not available to publishable widget keys.

Use these endpoints from trusted backend or first-party dashboard contexts:

  • GET /api/v2/tenant/status
  • GET /api/v2/tenant/profile
  • PUT /api/v2/tenant/settings
  • POST /api/v2/tenant/webhooks/secret/rotate
  • GET /api/v2/tenant/analytics
  • GET /api/v2/tenant/health
  • GET /api/v2/tenant/api-keys
  • POST /api/v2/tenant/api-keys
  • POST /api/v2/tenant/api-keys/publishable/regenerate
  • DELETE /api/v2/tenant/api-keys/{keyId}

Operator recovery endpoints are also server-key-only:

  • GET /api/v2/tenant/operations/repair-markers
  • GET /api/v2/tenant/operations/intent-health
  • GET /api/v2/tenant/operations/execution-attempts
  • POST /api/v2/tenant/operations/recover-pending-broadcasts
  • POST /api/v2/tenant/operations/recover-ready-trades
  • POST /api/v2/tenant/operations/recover-executing-trades

Pending-broadcast recovery is tenant-scoped. It checks delegation rows that already carry a transaction hash and activates an intent only after receipt and operation-level proof succeed.

Do not call these endpoints from browser widget code. Browser/widget flows use the publishable key plus signed widget-user HMAC headers for inventory, wants, swaps, signing, and broadcast reporting.

Webhook signing secrets are excluded from profile and settings responses. Rotation returns the new raw secret once, so save it directly to the receiver's secret manager and never place it in browser storage or URLs.