Skip to content

POST /platform/admin/tenants/(?P\d+)/credentials/(?P[A-Za-z0-9_]+)

PLATFORM > platform

What it does

#^/platform/admin/tenants/(?P<clientId>\d+)/credentials/(?P<credentialKey>[A-Za-z0-9_]+)$# accepts POST and is declared in app/platform/api_routes.php:650 as a regex pattern.

The route handler delegates to platformApiTenantManagedCredentialAccess(). That function is the owner of this behaviour; the route entry is only dispatch.

Call chain:

  1. → platformApiTenantManagedCredentialAccess() — app/platform/admin/api_helper.php:160
  2. ↳ platformApiAssertAdminConsoleAccess() — app/platform/api_routes.php:33
  3. ↳ isSuperAdmin() — config/config.php:1477

Who calls it

No literal caller path was found in frontend/, public/ or new-system/. The endpoint may be called through a constructed path, a helper wrapper, or only by an external client. Treat the route table and owner function as the authority.

Input

Where Key
path clientId
path credentialKey
body EXPECTED_UPDATED_AT
body VALUE

Request bodies must not use TYPE, ACTION or USERNAME as contract fields.

Output

The response is produced by a shared helper, so the key set is not visible at the route. Read the owner function to confirm the shape before writing a client.

Data

No table reference is visible in the owner function body.

Access

  • redactRequestBody => true

Validation and failure messages

  • Credential value is required.

These strings come from the owner function and are the messages a client can receive. They are also the cheapest way to tell a rejected request from a broken one.