Skip to content
Serverless SaaS

Control plane API

Base URL: the controlPlaneAPIEndpoint output of ControlPlaneStack. Every route except /tenant-config needs Authorization: Bearer <ID token> from the control plane user pool. Get one with ./scripts/admin-token.sh '<password>'.

Responses from SBT are wrapped as {"data": …}.

Tenant registrations

Section titled “Tenant registrations”

Registering starts onboarding, and deleting starts offboarding. Both emit an EventBridge event.

Method Path Body or result
POST /tenant-registrations {"tenantData":{"tenantName","email","tier"},"tenantRegistrationData":{"registrationStatus":"In progress"}}
GET /tenant-registrations All registrations
GET /tenant-registrations/{id} registrationStatus, tenantId, …
PATCH /tenant-registrations/{id} Used by the application plane to report results
DELETE /tenant-registrations/{id} Offboard
Terminal window
curl -s -X POST -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' ${API}tenant-registrations \
  -d '{"tenantData":{"tenantName":"globex","email":"admin@globex.example","tier":"PREMIUM"},"tenantRegistrationData":{"registrationStatus":"In progress"}}'

Tenants

Section titled “Tenants”
Method Path Result
GET /tenants Tenant records: tenantId, tenantName, tier, email, tenantStatus, tenantConfig, tenantRegistrationId, sbtaws_active
GET /tenants/{tenantId} One tenant
PUT /tenants/{tenantId} Update a tenant record
DELETE /tenants/{tenantId} Delete a tenant record

Tenant config (public)

Section titled “Tenant config (public)”
Method Path Result
GET /tenant-config/{tenantName} {"userPoolId","appClientId","apiGatewayUrl"}, or 404

No token is needed. The SaaS app calls it before sign-in to find the tenant’s user pool and API.

System admin users

Section titled “System admin users”
Method Path Body or result
GET /users System admins
POST /users {"userName","email","userRole":"SystemAdmin"}
GET, PUT, DELETE /users/{username} One admin

Events

Section titled “Events”
detail-type Source When
sbt_aws_onboardingRequest control plane A registration was created
sbt_aws_provisionSuccess application plane Provisioning finished, with tenantConfig
sbt_aws_offboardingRequest control plane A registration was deleted
sbt_aws_deprovisionSuccess application plane Deprovisioning finished