Settings

Deployment and administrative preferences

Service

Status

API base

/v1

proxied through nginx

Access model

The dashboard authenticates with an operator agent credential against POST /v1/agents/token and reads through /v1/admin/*. Every request is authorised server-side by the admin:read scope; the browser holds no privileged state of its own.

Credentials are never stored in source and never returned by an API. They are issued once by the admin CLI.