All admin endpoints require a session JWT with the is_admin claim (the role is verified server-side) and answer 403 FORBIDDEN otherwise.
Endpoints
| Method | Path | Description |
|---|---|---|
| GET | /admin/stats | Platform totals (users, revenue, calls). |
| GET | /admin/users | Paginated users (filter by status). |
| GET | /admin/users/:id | User detail with keys, invoices and usage. |
| PATCH | /admin/users/:id | Update a user’s status. |
| PATCH | /admin/users/bulk | Bulk update (max 100, skips self). |
| GET | /admin/keys | Paginated API keys. |
| DELETE | /admin/keys/:id | Revoke a key. |
| GET | /admin/invoices | Paginated top-up invoices with failure reasons. |
| GET | /admin/traffic | Traffic by product, day, and endpoint. |
| POST | /admin/deploy-frontend | Trigger a GitHub Actions deploy. |
Errors
UNAUTHORIZED(401): missing or invalid token.FORBIDDEN(403): non-admin caller.