Admin API

The Admin API is the write-side surface for managing flags, environments, targeting rules, rollouts, and audit logs. It is authenticated with a Supabase JWT (obtained via POST /auth/login).

Authentication

Admin endpoints require a Supabase JWT in the Authorization header:

Authorization: Bearer <supabase_jwt>

Obtain a JWT by logging in:

POST /auth/login
Content-Type: application/json

{
  "email": "admin@clubedge.live",
  "password": "your-password"
}

Response 200 OK:

{
  "access_token": "<supabase_jwt>",
  "refresh_token": "<refresh_token>",
  "user": {
    "id": "user-uuid",
    "email": "admin@clubedge.live"
  }
}

Log out with:

POST /auth/logout
Authorization: Bearer <supabase_jwt>

Returns 204 No Content.

Environments

Create an environment

POST /environments
Authorization: Bearer <jwt>
Content-Type: application/json

{
  "product": "workspace",
  "name": "production"
}

Response 201 Created:

{
  "id": "env_1a2b3c4d",
  "product": "workspace",
  "name": "production",
  "sdkKey": "ffk_abc123...",
  "sdkKeyPrefix": "ffk_abc",
  "status": "active",
  "createdAt": "2026-08-01T04:00:00.000Z"
}

The sdkKey is returned only once at creation time. Copy it into your secrets manager immediately — it cannot be retrieved again.

Behind the scenes:

A new environments row is inserted with a SHA-256 hash of the SDK key (plaintext is never persisted).
A sdkKeyPrefix is extracted for dashboard display.
All existing active flags are auto-initialized for this environment with isEnabled: false.
An ENVIRONMENT_CREATED audit log entry is written in the same transaction.

List environments

GET /environments?page=1&limit=20&product=workspace&status=active
Authorization: Bearer <jwt>

Response 200 OK:

{
  "items": [
    {
      "id": "env_1a2b3c4d",
      "product": "workspace",
      "name": "production",
      "sdkKeyPrefix": "ffk_abc",
      "status": "active",
      "createdAt": "2026-08-01T04:00:00.000Z"
    }
  ],
  "pagination": { "page": 1, "limit": 20, "total": 1 }
}

Query param	Type	Default	Description
`page`	integer	`1`	Page number (min 1)
`limit`	integer	`20`	Items per page (min 1, max 100)
`product`	string	—	Filter by product
`status`	`active` \| `revoked`	—	Filter by lifecycle status

Get an environment

GET /environments/{id}
Authorization: Bearer <jwt>

Update an environment

Rename an environment (PATCH with { "name": "new-name" }):

PATCH /environments/{id}
Authorization: Bearer <jwt>
Content-Type: application/json

{ "name": "production-v2" }

Revoke an environment

Revokes an environment, making its SDK key inactive. Revoked environments cannot be evaluated by SDKs.

POST /environments/{id}/revoke
Authorization: Bearer <jwt>

Response 200 OK — returns the revoked environment object with status: "revoked".

Rotate an SDK key

Rotates the SDK key for an environment. This revokes the old environment (status set to revoked) and creates a new active environment with the same product and name, migrating all flag configurations, targeting rules, and rollout configurations to the new environment. The new plaintext SDK key is returned only once.

POST /environments/{id}/rotate-key
Authorization: Bearer <jwt>

Response 201 Created:

{
  "id": "env_new123",
  "product": "workspace",
  "name": "production",
  "sdkKey": "ffk_xyz789...",
  "sdkKeyPrefix": "ffk_xyz",
  "status": "active",
  "createdAt": "2026-08-05T12:00:00.000Z"
}

Rotation invalidates the old key immediately. Update the key in your secrets manager and restart/re-deploy affected services before relying on the new key.

Feature flags

Create a flag

POST /flags
Authorization: Bearer <jwt>
Content-Type: application/json

{
  "key": "new_dashboard",
  "name": "New Dashboard",
  "description": "Enable the new dashboard UI",
  "type": "boolean"
}

Field	Type	Required	Description
`key`	string	Yes	Human-readable identifier (unique, immutable)
`name`	string	Yes	Display name
`description`	string	No	Longer description
`type`	`boolean` \| `string` \| `multivariate`	Yes	Flag value type

Response 201 Created:

{
  "id": "flag_456def",
  "key": "new_dashboard",
  "name": "New Dashboard",
  "description": "Enable the new dashboard UI",
  "type": "boolean",
  "createdBy": "user_123",
  "createdAt": "2026-08-01T04:01:00.000Z",
  "archivedAt": null
}

Boolean flags are fully supported by the evaluation engine. String and multivariate types can be created, but the current evaluation engine only resolves boolean results — isEnabled() always returns true or false.

List flags

GET /flags?page=1&limit=20&archived=false
Authorization: Bearer <jwt>

Query param	Type	Default	Description
`page`	integer	`1`	Page number
`limit`	integer	`20`	Items per page (max 100)
`archived`	boolean	—	`true` for archived only, `false` for active only, omit for both

Get a flag

GET /flags/{id}
Authorization: Bearer <jwt>

Update a flag

PATCH /flags/{id}
Authorization: Bearer <jwt>
Content-Type: application/json

{
  "name": "Updated Name",
  "description": "Updated description"
}

Archive a flag

DELETE /flags/{id}
Authorization: Bearer <jwt>

Archived flags are retained for auditing. A flag cannot be archived while it is enabled in any environment. Returns 409 Conflict if so.

Flag environment configuration

Get configuration

GET /flags/{flagId}/environments/{environmentId}
Authorization: Bearer <jwt>

Response 200 OK:

{
  "flagId": "flag_456def",
  "environmentId": "env_1a2b3c4d",
  "isEnabled": true,
  "ttlOverrideSeconds": null
}

Create or replace configuration

PUT /flags/{flagId}/environments/{environmentId}
Authorization: Bearer <jwt>
Content-Type: application/json

{
  "isEnabled": true,
  "ttlOverrideSeconds": 5
}

Field	Type	Required	Description
`isEnabled`	boolean	No	Enable or disable the flag for this environment
`ttlOverrideSeconds`	integer \| null	No	Override the default 60s SDK cache TTL for this flag/env pair. Set to `null` to remove the override. Must be >= 1.

Behind the scenes: Updates feature_flag_environments, writes a FLAG_ENVIRONMENT_UPDATED audit entry, and invalidates the Redis cache for this flag + environment.

Targeting rules

Create a rule

POST /flags/{flagId}/environments/{environmentId}/rules
Authorization: Bearer <jwt>
Content-Type: application/json

{
  "priority": 1,
  "logic": "and",
  "value": true,
  "conditions": [
    { "attribute": "country", "operator": "==", "valueType": "string", "valueString": "US" },
    { "attribute": "plan", "operator": "==", "valueType": "string", "valueString": "premium" }
  ]
}

Field	Type	Required	Description
`priority`	integer	Yes	Evaluation order (lower = higher priority). Must be > 0. Must be unique within the same flag + environment.
`logic`	`"and"` \| `"or"`	Yes	How conditions combine
`value`	boolean	Yes	What to return when this rule matches
`conditions`	array	Yes	At least one condition

Each condition uses a discriminated union — exactly one value field, determined by valueType:

Field	Type	Required when `valueType` is
`attribute`	string	always
`operator`	string	always — `==`, `!=`, `>`, `<`, `>=`, `<=`
`valueType`	`"string"` \| `"number"` \| `"boolean"`	always
`valueString`	string	`"string"`
`valueInt`	integer	`"number"`
`valueBool`	boolean	`"boolean"`

Only flat and/or logic is supported. Nested condition groups (e.g. (A AND B) OR (C AND D)) are not currently representable — use multiple prioritized rules instead.

List rules

GET /flags/{flagId}/environments/{environmentId}/rules
Authorization: Bearer <jwt>

Returns rules ordered by priority ASC.

Replace a rule

PUT /rules/{ruleId}
Authorization: Bearer <jwt>
Content-Type: application/json

{
  "priority": 2,
  "logic": "or",
  "value": false,
  "conditions": [
    { "attribute": "email", "operator": "==", "valueType": "string", "valueString": "internal@clubedge.live" }
  ]
}

Delete a rule

DELETE /rules/{ruleId}
Authorization: Bearer <jwt>

Rollouts

Get rollout configuration

GET /flags/{flagId}/environments/{environmentId}/rollout
Authorization: Bearer <jwt>

Create or update rollout

PUT /flags/{flagId}/environments/{environmentId}/rollout
Authorization: Bearer <jwt>
Content-Type: application/json

{
  "percentage": 25,
  "strategy": "per_user"
}

Field	Type	Required	Description
`percentage`	integer	Yes	0–100 (inclusive). Percentage of subjects that receive `enabled: true`.
`strategy`	`"per_user"` \| `"per_tenant"`	Yes	Bucketing strategy

Returns 201 Created on insert, 200 OK on update.

Delete rollout

DELETE /flags/{flagId}/environments/{environmentId}/rollout
Authorization: Bearer <jwt>

Audit logs

GET /audit?flagKey=new_dashboard&limit=20&page=1
Authorization: Bearer <jwt>

Query param	Type	Default	Description
`page`	integer	`1`	Page number
`limit`	integer	`20`	Items per page (max 100)
`flagKey`	string	—	Filter by flag key
`environment`	string	—	Filter by environment name
`from`	date-time	—	Start of time range
`to`	date-time	—	End of time range

Response 200 OK:

{
  "items": [
    {
      "id": "log_001",
      "action": "FLAG_CREATED",
      "actorIdentity": "user_123",
      "occurredAt": "2026-08-01T04:01:00.000Z",
      "flagKey": "new_dashboard",
      "environment": null,
      "product": null,
      "oldValue": null,
      "newValue": { "key": "new_dashboard", "type": "boolean" }
    }
  ],
  "pagination": { "page": 1, "limit": 20, "total": 1 }
}

Audit actions

Action	When
`FLAG_CREATED`	A new flag was created
`FLAG_UPDATED`	Flag name or description was updated
`FLAG_ARCHIVED`	Flag was archived
`ENVIRONMENT_CREATED`	A new environment was created
`ENVIRONMENT_UPDATED`	Environment name was updated
`ENVIRONMENT_REVOKED`	Environment was revoked
`FLAG_ENVIRONMENT_UPDATED`	Flag enabled/disabled or TTL override changed for an environment
`RULE_CREATED`	A targeting rule was created
`RULE_UPDATED`	A targeting rule was replaced
`RULE_DELETED`	A targeting rule was deleted
`ROLLOUT_CONFIGURED`	A rollout was created or updated
`ROLLOUT_DELETED`	A rollout was deleted
`SDK_KEY_ROTATED`	An environment’s SDK key was rotated

Essentials

Feature Flags

Authentication

Environments

Create an environment

List environments

Get an environment

Update an environment

Revoke an environment

Rotate an SDK key

Feature flags

Create a flag

List flags

Get a flag

Update a flag

Archive a flag

Flag environment configuration

Get configuration

Create or replace configuration

Targeting rules

Create a rule

List rules

Replace a rule

Delete a rule

Rollouts

Get rollout configuration

Create or update rollout

Delete rollout

Audit logs

Audit actions

Admin API endpoint summary

​Authentication

​Environments

​Create an environment

​List environments

​Get an environment

​Update an environment

​Revoke an environment

​Rotate an SDK key

​Feature flags

​Create a flag

​List flags

​Get a flag

​Update a flag

​Archive a flag

​Flag environment configuration

​Get configuration

​Create or replace configuration

​Targeting rules

​Create a rule

​List rules

​Replace a rule

​Delete a rule

​Rollouts

​Get rollout configuration

​Create or update rollout

​Delete rollout

​Audit logs

​Audit actions

​Admin API endpoint summary

Authentication

Environments

Create an environment

List environments

Get an environment

Update an environment

Revoke an environment

Rotate an SDK key

Feature flags

Create a flag

List flags

Get a flag

Update a flag

Archive a flag

Flag environment configuration

Get configuration

Create or replace configuration

Targeting rules

Create a rule

List rules

Replace a rule

Delete a rule

Rollouts

Get rollout configuration

Create or update rollout

Delete rollout

Audit logs

Audit actions

Admin API endpoint summary