Admin API Reference

For: Platform operators and automation scripts managing Axemere Gateway at runtime.

Complete endpoint listing for the Axemere Gateway v1 Admin API. If you prefer a CLI over direct HTTP calls, see the CLI Reference. For a hosted, API-key-authenticated equivalent of these endpoints (no admin token or direct gateway network access required), see the Management API Reference.

All endpoints require one of:

• MVGC-Admin-Token: <token> header
• Authorization: Bearer <token> header

The token value is set via MVGC_ADMIN_TOKEN on the gateway.

Table of Contents

• Health Check
• Credentials
• Workloads
• Policies
• Addons
• Connectors
• Approvals
• Quarantine
• Org Management
• Nodes
• Rate Limiting
• Discovery
• Policy Cache
• Observability
• Record Verification
• SSL MITM Proxy

DELETE endpoint availability: DELETE is supported for credentials and workloads. There is no DELETE endpoint for policies.

• To remove a credential: DELETE /v1/admin/credentials/{id} (returns 200 on success, 404 if not found).
• To remove a policy bundle: push a new empty bundle (deny-all default) via PUT /v1/admin/policies.
• To remove a workload: DELETE /v1/admin/workloads/{id} (returns 200 on success, 404 if not found).

Health Check

Credentials

Workloads

Policies

Addons

Addons are org-level feature toggles managed from the control plane. When enabled, an addon contributes additional policy rules to the effective bundle for that org. The addon catalog is seeded at migration time; operators enable or disable individual addons per org.

Response shape for GET /v1/orgs/{orgID}/addons:

{
  "addons": [
    {
      "addon_id": "credential-passthrough",
      "display_name": "Credential Passthrough",
      "description": "Forward client-supplied auth headers to AI providers unchanged while applying full governance.",
      "category": "credentials",
      "version": "1.0.0",
      "enabled": false,
      "enabled_at": ""
    }
  ]
}

Note: Addon endpoints are org-scoped (path prefix /v1/orgs/) and require the standard admin token. They are available only when the gateway is connected to a control plane (MVGC_CP_ADDR set).

Connectors

Approvals

Quarantine

Org Management

These endpoints let platform operators inspect and control the suspension state of an organisation without restarting the gateway. They are available in both managed and self-hosted modes when the gateway is connected to a control plane.

GET /v1/admin/org response:

{
  "org_id": "org_01j...",
  "status": "suspended",
  "suspended_reason": "Non-payment: invoice #1234 overdue"
}

suspended_reason is omitted when the org is active or when no reason was given at suspension time.

POST /v1/admin/org/suspend request body (optional):

{ "reason": "Non-payment: invoice #1234 overdue" }

Returns {"status":"suspended"} on success, 404 if the gateway has no org configured.

POST /v1/admin/org/reactivate response:

Returns {"status":"active"} on success, 404 if the gateway has no org configured.

Effect on traffic:

• Managed gateway: Enforced at the auth layer via push events. Suspension propagates within one CheckIn cycle (~60 s) to all managed nodes.
• Self-hosted + CP: Enforced at execution time. The gateway learns the suspended status on its next periodic CheckIn (default 60 s interval). At most one request may pass through between the suspension event and the next check-in. Reactivation is detected on the first denied request: a background check-in is triggered immediately, so the following request is unblocked without waiting for the full interval.

Keys are not revoked; suspension is fully reversible.

Nodes

Rate Limiting

Discovery

Policy Cache

Observability

Record Verification

SSL MITM Proxy

Response Schemas

Approval object

Returned by GET /v1/admin/approvals and GET /v1/admin/approvals/{id}:

{
  "approval_id": "01955f3e-bbbb-7abc-8def-000000000002",
  "org_id": "org-example-001",
  "workload_id": "wl-prod-app-1",
  "caller_id": "service-abc",
  "status": "pending",
  "reason": "high-cost model requires operator approval",
  "decided_by": null,
  "created_at": "2026-03-12T10:00:00Z",
  "decided_at": null,
  "expires_at": "2026-03-13T10:00:00Z"
}

status values: pending, approved, denied, expired

Quarantine entry object

Returned by GET /v1/admin/quarantine:

{
  "quarantine_id": "01955f3e-aaaa-7abc-8def-000000000001",
  "org_id": "org-example-001",
  "workload_id": "wl-prod-app-1",
  "caller_id": "service-abc",
  "caller_ip": "10.0.1.42",
  "action_type": "ai.infer",
  "reason": "composite risk score exceeds threshold",
  "risk_score": 0.87,
  "created_at": "2026-03-12T10:15:00Z",
  "released_at": null,
  "released_by": null
}

Record verification response

Returned by GET /v1/verify/{record_hash}:

{
  "status": "verified",
  "record_hash": "a1b2c3d4e5f6...",
  "inclusion_proof": {
    "schema": "mvgc.inclusion_proof.v1",
    "record_hash": "a1b2c3d4e5f6...",
    "batch_id": "01955f3e-0000-7abc-8def-000000000001",
    "leaf_index": 42,
    "leaf_count": 1000,
    "path": [
      { "side": "right", "hash": "deadbeef..." },
      { "side": "left", "hash": "cafebabe..." }
    ],
    "root": {
      "schema": "mvgc.merkle_root.v1",
      "batch_id": "01955f3e-0000-7abc-8def-000000000001",
      "root_hash": "abcdef01...",
      "leaf_count": 1000,
      "sig": { "alg": "ed25519", "kid": "kid_cp_1", "sig": "..." }
    }
  }
}

When not yet batched: {"status": "pending_inclusion", "record_hash": "..."}

See Also

• Network Operations Guide — usage examples and full operational context
• Approval Workflows — lifecycle, DSL triggers, polling
• Quarantine — investigation and release workflow
• Risk Scoring — risk signals and thresholds
• Telemetry — Prometheus metrics reference
• Merkle Proof Verification — verifying inclusion proofs
• Delegation Tokens — token creation and verification