Admin Policy Endpoints
Three endpoints for reading and updating group policies. They are the API behind the admin dashboard.
auth-svc authenticates the caller and forwards the request to policy-svc, returning its
response unchanged.
| Method | Endpoint | Purpose |
|---|---|---|
GET | /v2/admin/groups | List all groups |
GET | /v2/admin/groups/{group_id} | Get one group and its policy |
PUT | /v2/admin/groups/{group_id}/policy | Replace a group's policy |
Authentication
A JWT access token whose scope claim contains update:default_policy — including on the
two read endpoints. See Auth0 for how that permission is granted.
Firebase authentication is not supported on these endpoints.
Errors
| Status | Body | Cause |
|---|---|---|
404 | {"error":"Policy service is not configured for this deployment","code":100310} | POLICY_SVC_URL is unset — this deployment has no policy service |
401 | {"error":"Authentication failed","code":100110} | No Authorization header |
401 | {"error":"Token missing required scope","code":100115} | Token lacks update:default_policy |
405 | (empty) | Wrong HTTP method |
404 | {"code":200302,"error":"Group not found"} | No such group_id |
400 | {"code":200201,"error":"Policy validation failed: ..."} | The policy was rejected |
500 | {"code":200401,"error":"Internal server error: ..."} | policy-svc failed |
502 | {"error":"Policy service unavailable"} | policy-svc is configured but unreachable |
The first row is checked before anything else — before the method and before the token. A
deployment without a policy service answers 404 for every one of these endpoints, whatever
you send.
Not available
Creating groups, deleting groups, and assigning users to groups are not implemented. Every user
belongs to the seeded default-policy group.