Technical
Admin
Workspace administration for team access, roles, technical controls, and security posture.
Public and internal interfaces
These are the main routes, handlers, and integration surfaces used by this product area.
GET /api/portal/admin/team
POST /api/portal/admin/users
PATCH /api/portal/admin/users/{id}
DELETE /api/portal/admin/users/{id}
POST /api/portal/admin/invites
POST /api/portal/admin/invites/{id}/resend
DELETE /api/portal/admin/invites/{id}
GET/POST/DELETE /api/portal/api-keys
Architecture notes
- Admin role logic is enforced in ai-portal/api/portal/handlers/admin.php.
- Owner and admin roles can manage team access; assignable roles depend on the current user role.
- Public invite acceptance is handled through public invite routes.
Access and permissions
App pages are authenticated through the shared bnl_session cookie unless explicitly marked public. Public docs should describe integration behavior without including secrets, private tokens, private IPs, or tenant-specific records.
Troubleshooting
- A user limit message means the plan has reached its user allowance.
- Invite failures can be expired tokens, duplicate emails, or role restrictions.