App Admin API

App admins have elevated access within a single marketplace app. The org owner is implicitly an app admin for every app the org publishes. Additional admins are granted and revoked explicitly.

Who Can Grant

Only the org owner or an existing app admin for the target app can grant or revoke app admin access.

Grant App Admin

~~~http POST /api/marketplace/apps/:app_id/admins Authorization: Bearer Content-Type: application/json

{ "user_uuid": "usr_01abc..." } ~~~

~~~jsonc // 201 Created { "grant_id": "grt_01def...", "app_id": "app_01ghi...", "user_uuid": "usr_01abc...", "granted_by": "usr_01xyz...", "created_at": "2026-05-17T10:00:00Z" } ~~~

The affected user's app_admin JWT claim is updated on their next token refresh. Instruct them to call POST /api/auth/refresh or re-authenticate.

List App Admins

~~~http GET /api/marketplace/apps/:app_id/admins Authorization: Bearer ~~~

~~~jsonc { "admins": [ { "user_uuid": "usr_01abc...", "email": "alice@acme.com", "is_org_owner": false, "granted_at": "2026-05-17T10:00:00Z" } ] } ~~~

Org owners appear in this list with is_org_owner: true even without an explicit grant row.

Revoke App Admin

~~~http DELETE /api/marketplace/apps/:app_id/admins/:user_uuid Authorization: Bearer ~~~

Returns 204 No Content. The affected user loses app admin access at their next token refresh. Their existing token remains valid until expiry (15 minutes default) — if you need immediate revocation, rotate the app's signing key.

Checking App Admin Status

From your app's frontend or backend, use the Role & Access Check API:

~~~http GET /api/marketplace/apps/:app_id/access Authorization: Bearer ~~~

~~~jsonc { "is_app_admin": true, "is_org_owner": false, "install_status": "active", "install_id": "..." } ~~~

Or inspect the JWT claim directly:

~~~jsonc // app_admin field in the access token payload { "app_admin": ["app_01ghi...", "app_02jkl..."] } ~~~

What App Admins Can Do

| Action | App Admin | Org Owner | Platform Admin | |--------|-----------|-----------|----------------| | Edit app metadata | ✓ | ✓ | ✓ | | View all installs | ✓ | ✓ | ✓ | | Suspend / resume an install | ✓ | ✓ | ✓ | | Rotate provision webhook secret | ✓ | ✓ | ✓ | | Manage marketplace listings | ✓ | ✓ | ✓ | | Grant / revoke app admin | ✓ | ✓ | ✓ | | View platform-wide installs | — | — | ✓ | | Approve app publications | — | — | ✓ | | Revoke cloud targets | — | — | ✓ |