tenant-manager API

tenant-manager API

Base URL: http://tenant-manager.secusiem-system.svc.cluster.local:8000

Interactive documentation: /docs (Swagger UI) or /redoc (ReDoc)

Tenants

POST /api/v1/tenants

Create a new tenant with full auto-provisioning.

Request body:

{
  "name": "ACME Corporation",
  "slug": "acme",
  "contact_email": "admin@acme.com",
  "contact_name": "John Doe",
  "pricing_tier": "starter",
  "trial_days": 14,
  "settings": {},
  "metadata": {}
}

Automatic actions:

1. S3 bucket creation on OVH (secusiem-acme-logs)
2. Loki access verification (tenant-acme)
3. Grafana organization creation
4. Authentik group creation
5. Stripe customer + subscription creation

Response (201):

{
  "id": "uuid",
  "name": "ACME Corporation",
  "slug": "acme",
  "loki_org_id": "tenant-acme",
  "s3_bucket": "secusiem-acme-logs",
  "grafana_org_id": 5,
  "pricing_tier": "starter",
  "status": "trial",
  "trial_ends_at": "2026-03-01T00:00:00"
}

GET /api/v1/tenants

List all tenants. Parameters: skip, limit, status.

GET /api/v1/tenants/{tenant_id}

Get tenant details.

PATCH /api/v1/tenants/{tenant_id}

Update a tenant (name, email, status, settings).

DELETE /api/v1/tenants/{tenant_id}?force=false

Soft delete by default. With force=true: deletes the S3 bucket.

POST /api/v1/tenants/{tenant_id}/suspend

Suspend a tenant and revoke all API keys.

POST /api/v1/tenants/{tenant_id}/activate

Reactivate a suspended tenant.

API Keys

POST /api/v1/tenants/{tenant_id}/apikeys

Generate a new API key.

Request body:

{
  "name": "Production Key",
  "description": "Main API key for log ingestion",
  "scopes": ["logs:write", "logs:read"],
  "rate_limit_rpm": 1000,
  "expires_in_days": 365
}

Response (201):

{
  "api_key": "sk_live_AbCdEfGh...",
  "details": {
    "id": "uuid",
    "key_prefix": "sk_live_AbCdEfG...",
    "name": "Production Key",
    "scopes": ["logs:write", "logs:read"],
    "is_active": true
  }
}

Important: The full API key is displayed only once.

GET /api/v1/tenants/{tenant_id}/apikeys

List API keys for a tenant.

DELETE /api/v1/tenants/{tenant_id}/apikeys/{apikey_id}

Revoke an API key (irreversible).

Health Checks

• GET /health: Service status
• GET /ready: Readiness (dependency checks)
• GET /: Service information and available endpoints