Environments and live API

Lifecycle guides and console reference pages always include static REST examples (sanitized captures from the enterprise e2e gate, or OpenAPI-backed examples). Those work offline.

You can also connect an environment from any page (floating Environment control, bottom-right). Discovery uses the same platform bootstrap runtime-config API as the Admin Console. After connect (and optional sign-in), CapturedCall examples can Run live and dual-path steps can Open in Admin Console on that environment.

Environment kinds

Kind	What you do
Preset	Pick a shipped lab profile (entry host + optional default tenant)
Custom domain	Enter your platform or tenant origin (e.g. https://acme.example.com or https://platform.example.com)
Cloud	Reserved for product cloud regions later (same connect flow once an entry host is known)

Optional after entry host: tenant slug or tenant id when the entry host is platform-scoped and you want a tenant projection.

Discovery (backend info)

On Discover, the docs site calls:

GET {entryOrigin}/api/platform/bootstrap/v1/runtime-config/admin-console
  ?tenantId=…
  &tenantSlug=…

This is the same application projection the Admin Console loads (applicationId=admin-console). No separate “docs backend info” API.

Response area	Used for
data.platform	Public base URL, authorize/token/logout endpoints
data.oauth	Client id/scope hints (docs still use a docs redirect URI)
data.services[*]	Service baseUrl, audience, endpoint paths for live REST
metadata.tenantId / tenantSlug	Active tenant context

The session stores that projection in sessionStorage (never localStorage; logout/disconnect clears it).

Sign-in

Auth is OAuth 2.0 authorization code for the public docs-playground client with:

• PKCE required (code_challenge_method=S256)
• PAR (RFC 9126) required: parameters are pushed to /par first, then the browser is sent to /authorize with request_uri
• Token endpoint auth none (public client; no client secret)
• Explicit redirect URI registration only (no reliance on permissive-redirect for this client)

Authorize, token, and PAR endpoints come from AS discovery (.well-known/openid-configuration) with runtime-config as fallback. The redirect URI is always:

{docsOrigin}/docs-env/callback

Register that path on each allowed docs origin for the docs-playground client (EDK can provision this automatically when docs.playground is enabled or when tenant sample data is selected). After tokens are stored, the docs site re-fetches runtime-config with tenant selectors when possible so tenant-scoped service bases match the console.

CORS mode

Mode	When
direct	Gateway CORS allows the docs origin for bootstrap, PAR, token, and APIs
proxy	Browser calls /docs-env-proxy?u=… (allowlisted path prefixes)

npm start: the docs-env-proxy webpack middleware handles /docs-env-proxy.
Hosted / npm run serve: terminate TLS at your reverse proxy and forward only allowlisted paths. Example nginx snippet:

location /docs-env-proxy {
  # Only enable for trusted operators; validate ?u= against an allowlist of hosts
  # and path prefixes (/api/, /par, /token, /.well-known, …).
  # Prefer gateway CORS (direct mode) when the docs origin is known.
  return 501; # implement host allowlist proxy here
}

If the browser is blocked, use Copy as cURL on any CapturedCall (always available).

Guide variables

The environment panel includes a Guide variables drawer. Values are stored in sessionStorage and applied to live requests by replacing {{name}} placeholders in URLs and JSON bodies (for example {{designId}}, {{tenantId}}). Disconnect clears them.

Live Run and Admin Console links

On a CapturedCall Overview tab:

1. Connect (and sign in for protected APIs).
2. Confirm the resolved URL (path kept, origin from discovered services / platform base; variables applied).
3. Run or Copy as cURL.

After sign-in the panel can show public endpoints (issuer/verifier/AS origins from platform-admin, when available).

Dual-path guide steps can show Open in Admin Console when connected: {platformOrEntryOrigin}/admin-console#… using catalog hashes (for example #resource=kms&rarea=keys).

Security

• Prefer lab and non-production hosts. Production-looking hosts show a warning.
• No client secrets in the docs SPA.
• Access tokens only in sessionStorage.
• Disconnect clears the session.

Ops checklist (deployment)

1. Project runtime-config for admin-console (already standard on EDK).
2. Enable docs playground on the platform (compose docs.playground / Helm docsPlayground.enabled) so the platform AS registers docs-playground with PKCE + required PAR, and tenant AS bootstrap can mirror it. Tenant onboarding that selects sample data also provisions that client for the tenant.
3. Set docs origins (redirect bases): each needs {origin}/docs-env/callback.
4. Allow docs origins in gateway CORS or use a production reverse proxy equivalent to /docs-env-proxy.
5. Optional: cloud entry hosts when a product registry exists.

Related

Using the REST APIs, Open the console, Keys and DID, Postman downloads.