Provider Console

The Provider API is the only place SKUs, feature flags and kill switches are managed. It is cross-tenant and restricted to AuthSpoke provider admins. Tenant and org admins cannot reach it.

Access model#

Provider access is an allowlist (support_admins), default-deny. A caller's token must belong to a listed, enabled provider admin. Any other caller — including a tenant super-admin — receives:

{ "error": "provider_admin_required", "message": "The Provider console is restricted to AuthSpoke support admins." }

Confirm access:

curl "https://your-company.authspoke.com/api/v1/support/me" -H "Authorization: Bearer $TOKEN"

List tenants#

curl "https://your-company.authspoke.com/api/v1/support/tenants" -H "Authorization: Bearer $TOKEN"

Returns every tenant with headline agent and MCP counts.

License a SKU / toggle a feature#

# enable Identity Foundation for a tenant
curl -X POST "https://your-company.authspoke.com/api/v1/support/tenants/$TENANT_ID/entitlements/CAPABILITY/IDENTITY_FOUNDATION" \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{ "enabled": true }'

# enable a feature flag
curl -X POST "https://your-company.authspoke.com/api/v1/support/tenants/$TENANT_ID/entitlements/FEATURE/POLICY_SIMULATOR" \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{ "enabled": true }'

Both are audited as ENTITLEMENT_CHANGED.

Flip kill switches#

See Kill Switches for the global operational controls, also under /support.

API#

See the Provider API.