verification-providers

Create verification provider

Provisions one verification provider for one tenant (one live row per tenant+name; a second is 409). Platform-admin only. Validated before write, all 400 invalid_provider_config: name must be a registered provider (activecampaign, cybrid, maxmd, stripe); api_endpoint is required; every action_group_map key must be in allowed_actions and every allowed action must route to a group (its map entry or target_group_name); target_group_name and every mapped group must be a live group SLUG in that tenant — the same lookup the grant uses, so a row that validates is a row that grants. auth_key is write-only: sealed at rest with the connection key ring, never returned, never audited. Unknown body keys are 400.

post/admin/verification-providers

Request

  • Base URL: https://api.instruxi.dev/api/v1/enforcer
  • URL: https://api.instruxi.dev/api/v1/enforcer/admin/verification-providers
  • Auth: one of:
    • API key in header Authorization
    • API key in header X-API-Key

Request body

action_group_mapobject

action -> group SLUG. Every key must be in allowed_actions; every value a live group in the tenant.

allowed_actionsstring[]

Actions this provider may serve. Every entry must route to a group (its action_group_map entry or target_group_name). Empty permits every action.

api_endpointstring

gRPC SessionProvider address, e.g. enforcer-cybrid:50054. Required on create.

auth_keystring

WRITE-ONLY shared secret sent to the SessionProvider (x-verifier-key). Sealed at rest; never returned. "" clears it.

idempotency_enabledboolean

Reuse a pending session instead of minting a new one.

insecureboolean

Dial plaintext gRPC (cluster-internal); TLS otherwise.

is_asyncboolean

Provider completes out-of-band via the verification.callback event.

namestring

Registered provider name: activecampaign, cybrid, maxmd or stripe.

sensitive_fieldsstring[]

Response fields returned to the client but never persisted.

session_ttlinteger

Session lifetime in seconds.

target_group_namestring

Default group SLUG granted on a pass. Must be a live group in the tenant.

tenant_idstring

Target tenant. Required: the platform admin names the tenant explicitly.

Example request

{
  "api_endpoint": "enforcer-cybrid:50054",
  "name": "stripe",
  "target_group_name": "kyc_users",
  "tenant_id": "00000000-0000-0000-0000-000000000000"
}

Response

Created

successboolean

Example response

{
  "success": true
}

Changes

No recorded changes to this operation across all 1 revision of this API.