//Tenant Registry & Org Infra Bindings API

Tenant Registry & Org Infra Bindings API

Admin endpoints for multi-homed tenancy: register an org's "home" per (org, app) and drive its lifecycle, and bind an org to its infrastructure via vault references only (never raw secrets).

Tenant registry (Plan K)

Stores only public-safe routing info plus infra_binding_id, a soft-FK pointer to the org's infra binding. Registry + lifecycle only — not infra provisioning.

  • tenancy_mode: shared | dedicated (defaults to shared).
  • status lifecycle: pending → active / suspended / deprovisioned.

    • GET /api/admin/apps/:app_id/orgs/:org_uuid/tenant

    Read an org's tenant registration. Auth: app admin. 404 if no row.

    Output: { "data": }

    PUT /api/admin/apps/:app_id/orgs/:org_uuid/tenant

    Register/upsert an org's home for this app. Auth: app admin.

    Input (all fields optional): ~~~json { "tenancy_mode": "dedicated", "home_region": "us-east-1", "home_base_url": "https://acme.example.com", "infra_binding_id": 7, "metadata": {} } ~~~

    tenancy_mode defaults to shared; infra_binding_id is a pointer, not a credential. Output: { "data": }.

    POST /api/admin/apps/:app_id/orgs/:org_uuid/tenant/status

    Drive the lifecycle status. Auth: app admin.

    Input:* { "status": "active" } → *Output: { "data": }

    Org infra bindings (Plan I — vault-ref only)

    Routes an org to its database, API base, Dragonfly instance, and home base.

  • mode: shared | remote-db | remote-db-api | remote-full |
    • homed (defaults to shared).
  • identity_spine: central | local (defaults to central).

GET / PUT / DELETE /api/admin/apps/:app_id/orgs/:org_uuid/infra-binding

Admin CRUD over an org's infra binding. Auth: app admin.

PUT input (upsert): ~~~json { "db_dsn_ref": "vault://kv/org/acme/db", "api_base_ref": "vault://kv/org/acme/api", "dragonfly_dsn_ref": "vault://kv/org/acme/dragonfly", "home_base_url": "https://acme.example.com", "mode": "remote-db", "identity_spine": "local" } ~~~

Output: { "data": }. GET returns { "data": }; DELETE returns 204 No Content.

> Vault-ref only.* The _ref fields are opaque references to vault > entries — never raw DSNs or secrets. This endpoint stores them verbatim and > never accepts or persists raw credentials; the underlying secret is entered > through the secrets surface. The audit event records only the presence of > each ref, never the values.