Admin API Overview

Privileged endpoints for platform operators.

The admin API is a privileged set of endpoints available exclusively to users withrole = admin. It is accessed at the same base URL as the user API (https://cifp.vril.dev/api/admin) but requires a session with admin privileges — API keys are not accepted for admin endpoints.

Admin session required

All /api/admin/* endpoints verify session.user.role === "admin". Requests from non-admin users — including API keys with admin-sounding scopes — are rejected with 403. There is no way to elevate a regular user session to admin access via the API.

Available Endpoints

Endpoint	Description
GET /api/admin/stats	Platform-wide aggregate metrics
GET /api/admin/users	List all user accounts
GET /api/admin/users/:id	Get a single user with tenant details
PATCH /api/admin/users/:id	Update role, name, emailVerified, or reset password
DELETE /api/admin/users/:id	Hard-delete a user and all their data
GET /api/admin/tenants	List all tenants with proxy counts
GET /api/admin/tenants/:id	Get tenant with user info and full proxy list
PATCH /api/admin/tenants/:id	Update plan, access level, or Whop fields
DELETE /api/admin/tenants/:id	Hard-delete tenant (cascades to all child records)
GET /api/admin/proxies	List all proxies across all tenants
GET /api/admin/proxies/:id	Get any proxy by ID (cross-tenant)
PATCH /api/admin/proxies/:id	Pause, resume, force-status, or rename
DELETE /api/admin/proxies/:id	Force-delete any proxy
POST /api/admin/proxies/:id/redeploy	Tear down and re-provision a stuck/failed proxy VM
POST /api/admin/seed-test-account	Create/update a test account (protected by seed key)
POST /api/proxies/:id/logs	Sidecar log ingestion — write access log records (internal, X-CIFP-API-Key auth)

Granting Admin Access

The admin role is set directly on the users table. The only way to grant admin access is via the POST /api/admin/seed-test-account endpoint (using the LAUNCH_ADMIN_SEED_KEY environment variable) or directly in the database:

bash

# Via seed endpoint
curl -X POST https://cifp.vril.dev/api/admin/seed-test-account \
  -H "X-Seed-Key: $LAUNCH_ADMIN_SEED_KEY" \
  -H "Content-Type: application/json" \
  -d '{"email":"admin@vril.dev","password":"StrongPassword123!","role":"admin"}'

bash

# Or via admin PATCH user after first admin is created
curl -X PATCH https://cifp.vril.dev/api/admin/users/user-uuid \
  -H "Cookie: authjs.session-token=..." \
  -d '{"role":"admin"}'

Sidecar Log Ingestion (Internal)

The proxy's sidecar calls POST /api/proxies/:id/logs to write access log records into the control plane database. This endpoint is not part of the admin session API — it authenticates using the proxy's own internalApiKey passed in the X-CIFP-API-Key header, not an admin session cookie or user API key.

This call happens automatically. You never need to invoke it directly. It is documented here for operators who inspect traffic between the sidecar and the control plane or who are building custom sidecar implementations.

bash

POST /api/proxies/:id/logs

curl -X POST https://cifp.vril.dev/api/proxies/proxy-id/logs \
  -H "X-CIFP-API-Key: <proxy-internalApiKey>" \
  -H "Content-Type: application/json" \
  -d '[
    {
      "method":           "POST",
      "url":              "https://api.openai.com/v1/chat/completions",
      "srcIp":            "203.0.113.45",
      "statusCode":       200,
      "bytesTransferred": 4821,
      "duration":         312,
      "action":           "allow",
      "ruleMatched":      "allow-openai"
    }
  ]'

Authentication

Admin endpoints use the same Auth.js session cookie as the dashboard. Log in as an admin user in the browser, then use the session cookie in API calls. There is no separate admin API key mechanism.