Using the REST APIs
Gateway vs browser BFF
| Client | Base | Auth |
|---|---|---|
| Admin Console (browser) | Same-origin /admin-console/api/* BFF | HttpOnly session; BFF attaches upstream tokens |
| Scripts / Postman / docs live Run | Public gateway https://platform.<base>/… or https://<tenant>.<base>/… | Authorization: Bearer <token> |
Documentation examples always show gateway paths and bearer tokens so you can reproduce them outside the browser.
Discover service bases
After sign-in, service URLs and audiences are available from platform bootstrap runtime config (the same projection the console loads):
GET /api/platform/bootstrap/v1/runtime-config/admin-console
Platform APIs stay on the platform origin (for example /api/platform/admin/v1, /api/platform/config/v1). Tenant APIs resolve on the tenant gateway (for example /api/kms/v1, /api/did/v1).
The Postman collection starts from baseDomain and runs the same discovery steps.
Tokens
A platform operator token comes from the platform AS (authorization code with PKCE) and is required for Platform Admin. A tenant principal or service token is used for tenant KMS, DID, issuer, and verifier administration.
Wire-level operator sign-in is documented in Operator sign-in.
OpenAPI reference
Per-API Scalar pages live under REST APIs. Guide steps link to the exact operation where possible.
Live calls from this site
See Environments and live API to connect a lab or custom deployment and run examples in the browser. Static CapturedCall examples always work offline.