Admin: Tenants

Manage tenant billing and access state.

A tenant is the billing and resource boundary. In Phase 2, each user has exactly one tenant. These endpoints let admins inspect, adjust billing state, and remove tenants.

List Tenants

GET/api/admin/tenants

Param	Description
limit	Max results (default 100, max 500)
offset	Pagination offset

bash

curl "https://cifp.vril.dev/api/admin/tenants?limit=50" \
  -H "Cookie: authjs.session-token=your-admin-session"

Response

{
  "tenants": [
    {
      "id":                   "tenant_xxx",
      "name":                 "My Organization",
      "slug":                 "user-abc12345",
      "plan":                 "pro",
      "whopAccessLevel":      "customer",
      "whopMembershipStatus": "active",
      "user": {
        "email": "alice@example.com",
        "name":  "Alice",
        "role":  "user"
      },
      "proxyCount": 3,
      "createdAt":  "2026-06-01T09:00:00Z"
    }
  ],
  "total": 847,
  "limit": 50,
  "offset": 0
}

Get Tenant

GET/api/admin/tenants/:id

Returns full tenant detail including user info and a summary of all proxies (including soft-deleted).

bash

curl https://cifp.vril.dev/api/admin/tenants/tenant_xxx \
  -H "Cookie: authjs.session-token=your-admin-session"

Update Tenant

PATCH/api/admin/tenants/:id

Use to manually override billing state, grant free access, or correct Whop sync issues.

Field	Values
name	New display name
plan	free \| pro \| enterprise
whopAccessLevel	no_access \| customer \| admin
whopMembershipStatus	none \| active \| expired \| cancelled

bash

# Grant pro access manually (e.g. for a complimentary account)
curl -X PATCH https://cifp.vril.dev/api/admin/tenants/tenant_xxx \
  -H "Cookie: authjs.session-token=your-admin-session" \
  -H "Content-Type: application/json" \
  -d '{
    "plan":                 "pro",
    "whopAccessLevel":      "customer",
    "whopMembershipStatus": "active"
  }'

Delete Tenant

DELETE/api/admin/tenants/:id

Cascade deletes all tenant data

Deletes the tenant record. Due to cascading foreign keys this also removes all proxies, secrets, credentials, firewall rules, IP allowlist entries, access logs, API keys, and SSH keys for that tenant. VM teardown is notautomatically triggered — use DELETE /api/admin/proxies/:id first for each proxy to cleanly destroy VMs before deleting the tenant.

bash

curl -X DELETE https://cifp.vril.dev/api/admin/tenants/tenant_xxx \
  -H "Cookie: authjs.session-token=your-admin-session"

# Returns 204 No Content