Admin API
Admin routes under the /auth mount.
User management
| Method | Path | Notes |
|---|---|---|
GET | /auth/users | List/search + onboarding filters |
POST | /auth/register | Admin create user |
DELETE | /auth/users/:user_id | Admin delete user |
GET | /auth/admin/users/:id | Get user + sessions (biz + privacy; no acquisition) |
PUT | /auth/admin/users/:id | Update core profile / type |
POST | /auth/password-change/admin | Admin password change |
PATCH | /auth/admin/users/:id/privacy | Privacy override (admin/superadmin) |
Privacy / acquisition analytics (onboarding module)
Requires admin or superadmin session. Part of the privacy/onboarding module (core + acquisition columns). Not gated by USER_ANALYTICS_MCU.
| Method | Path | Notes |
|---|---|---|
GET | /auth/admin/analytics/acquisition | Channel/source breakdown |
GET | /auth/admin/analytics/acquisition/funnel | Per-source funnel |
User analytics (MCU opt-in)
Requires USER_ANALYTICS_ENABLED=true or USER_ANALYTICS_MCU=user-analytics://enabled@....
Default roles: admin,superadmin (CSV via MCU). Aggregates only — no PII. Uses getKyselyDb (multi-dialect). Separate from privacy/acquisition analytics above.
bash
USER_ANALYTICS_MCU=user-analytics://enabled@config/v1?roles=admin,superadmin&features=summary,breakdown,age,metrics,cohorts,crosstab,query,compare,completeness,churn,lifecycle,security| Method | Path | Notes |
|---|---|---|
GET | /auth/admin/analytics/users/summary | KPIs + avg_age; compare=previous |
GET | /auth/admin/analytics/users/breakdown | dimension= allowlist |
GET | /auth/admin/analytics/users/age | Age ranges + avg |
GET | /auth/admin/analytics/users/metrics | metrics= CSV |
GET | /auth/admin/analytics/users/cohorts | Signup cohorts |
GET | /auth/admin/analytics/users/crosstab | row= × col= |
GET | /auth/admin/analytics/users/query | Orquestrator view= |
GET | /auth/admin/analytics/users/completeness | Profile field fill rates |
GET | /auth/admin/analytics/users/churn | Soft-delete aggregates |
GET | /auth/admin/analytics/users/lifecycle | registered → verified → onboarded |
Shared filters: from, to, user_type, user_types, lang, gender, flags, include_deleted.
Disabled MCU → 503 MODULE_DISABLED. Rate limit Ultra (default 60/10min).