Admin endpoints

​

POST /products/register

​

Request

POST /products/register
X-Admin-Key: <admin key>
Content-Type: application/json

{
  "slug": "demo",
  "display_name": "Demo product",
  "policy": {
    "max_engines": 1000,
    "rate_limit_rpm": 600
  }
}

​

Response (200)

{
  "product_id": "5c2f...",
  "slug": "demo",
  "platform_api_key": "pk-sept-..."
}

​

Errors

• 401 INVALID_ADMIN_KEY — wrong or missing X-Admin-Key.
• 409 PRODUCT_SLUG_EXISTS — slug already in use.

​

PUT /products//policy

​

Request

PUT /products/5c2f.../policy
X-Admin-Key: <admin key>
Content-Type: application/json

{
  "policy": {
    "max_engines": 5000,
    "rate_limit_rpm": 2000
  }
}

​

Response (200)

{
  "policy": {
    "max_engines": 5000,
    "rate_limit_rpm": 2000
  }
}

​

Errors

• 401 INVALID_ADMIN_KEY — wrong or missing X-Admin-Key.
• 404 PRODUCT_NOT_FOUND — product_id doesn’t exist.

​

What admin endpoints can’t do

• Destroy a product. No DELETE today. To remove a product: destroy all its engines, then delete the row directly: DELETE FROM products WHERE id = '...';. Cascades clean up engines.
• Rotate a platform key. No endpoint today. Re-register the product or update products.api_key_hash directly.
• Upgrade engine version per product. Engines run on ORCH_ENGINE_IMAGE globally. To run different versions per product, you need separate orchestrator deployments.

​

Security

• Keep it in your secret manager.
• Audit access to it.
• Rotate quarterly.
• Don’t share with products’ application code.

​

See also

• Auth — X-Admin-Key mechanics.
• Policy — what the policy fields mean.
• Security — admin key rotation playbook.