Management and RBAC
Management APIs use /api/v1/management. A valid token must have audience admin-console, client_id=admin-console, a user subject, and an assigned admin-console#LOGIN relationship unless the subject is a configured bootstrap administrator.
Operations
| Method | Route | Purpose |
|---|---|---|
| GET | /api/v1/management/dashboard/summary | Aggregate admin dashboard counts and status. |
| GET | /api/v1/management/rbac/metadata | Discover supported RBAC objects, relations, and permission metadata. |
| POST | /api/v1/management/access-checks | Evaluate an authorization check. |
| GET, POST, DELETE | /api/v1/management/roles/access | List, set, or remove role access. |
| GET | /api/v1/management/audit-events | List audit events. |
| GET | /api/v1/management/audit-events/{id} | Read one audit event. |
| GET | /api/v1/management/oauth-resources | List configured OAuth protected resources and scopes. |
Client and user relationship routes are described under Management clients and Management users.
Audit behavior
Management mutations are audited with actor, route, permission context, result, and request correlation. Passwords, secrets, bearer tokens, cookies, codes, verifiers, nonces, and OTPs are redacted. Send x-request-id when you need stable correlation across services.