Admin API

The admin API provides endpoints for managing users, ACL rules, cache entries, and server stats. All admin endpoints require admin role credentials or the static auth_token.

Authentication

# Using the static auth token
curl -H "Authorization: Bearer your-auth-token" http://your-server:3000/admin/users

# Using admin user credentials
curl -u alice:password http://your-server:3000/admin/users

Users

List Users

GET /admin/users

Create User

POST /admin/users
Content-Type: application/json

{
  "username": "bob",
  "role": "read",
  "token": "optional-token"
}

Update User

PUT /admin/users/{username}
Content-Type: application/json

{
  "role": "write"
}

Delete User

DELETE /admin/users/{username}

TIP

Config-defined users ([[users]] in mise-server.toml) are immutable and cannot be modified or deleted via the admin API. Only runtime users (created via the API) can be managed.

ACL Rules

List Rules

GET /admin/acl

Create Rule

POST /admin/acl
Content-Type: application/json

{
  "user": "ci",
  "pattern": "npm/**",
  "permission": "write"
}

Delete Rule

DELETE /admin/acl/{id}

Cache Management

List Cache Entries

GET /admin/cache

Delete Cache Entry

DELETE /admin/cache/{registry}/{path}

Server Stats

GET /admin/stats

Returns storage usage, cache statistics, and registry activity.

Tenant-Scoped Admin (Multi-Tenant)

When running in multi-tenant mode, admin endpoints are scoped per tenant:

GET    /admin/tenants/{tenant}/users
POST   /admin/tenants/{tenant}/users
PUT    /admin/tenants/{tenant}/users/{username}
DELETE /admin/tenants/{tenant}/users/{username}

GET    /admin/tenants/{tenant}/acl
POST   /admin/tenants/{tenant}/acl
DELETE /admin/tenants/{tenant}/acl/{id}