POST /v1/platform/apps

platform:apps:write

✓

Provision a new app (instance) owned by the platform: mints its publishable key, signing key and first secret key. The secret is revealed exactly once.

GET /v1/platform/apps

platform:apps:read

List the apps (instances) this platform owns. Never returns any secret.

GET /v1/platform/apps/:id

platform:apps:read

Fetch one owned app. Another platform's app id is 404, never 403. Never a secret.

PATCH /v1/platform/apps/:id

platform:apps:write

Update an owned app's safe config subset (name, allowed_origins). Not owned is 404.

DELETE /v1/platform/apps/:id

platform:apps:write

Disable an owned app: refuse sign-ins and sign-ups via its kill switches. Soft and reversible — never a hard drop of user data. Not owned is 404.

POST /v1/platform/apps/:id/rotate_secret

platform:secrets:write

✓

Rotate an owned app's secret key: revoke its prior keys and mint a new one, revealed exactly once. Not owned is 404.

POST /v1/platform/apps/:id/instances

platform:apps:write

✓

Provision an additional instance (e.g. development beside production) under an owned app. Returns the new instance id and its first secret key, revealed exactly once. Not owned is 404.

GET /v1/platform/apps/:id/instances

platform:apps:read

List every instance under an owned app — its development/production siblings. Never returns any secret. Not owned is 404.

POST /v1/platform/apps/:id/instances/:instanceId/rotate_secret

platform:secrets:write

✓

Rotate one specific instance's secret under an owned app: revoke its prior keys and mint a new one, revealed once. Not owned is 404.

POST /v1/platform/accountless_apps

platform:apps:write

✓

Mint an app owned by no platform and return a one-time claim_token (hashed at rest, single-use, expiring). The provision-then-hand-over agency flow — no secret is minted until the app is claimed.

POST /v1/platform/apps/claim

platform:apps:write

✓

Claim an accountless app into the calling platform by its claim_token. Single-use and expiring; sets ownership and mints the first secret key, revealed once. A consumed, expired or unknown token is 4xx.

POST /v1/platform/apps/:id/transfer

platform:apps:write

✓

Initiate a transfer of an owned app: returns a one-time transfer_token bound to it (hashed, single-use, expiring). Only the current owner can initiate; a non-owned app is 404.

POST /v1/platform/apps/accept_transfer

platform:apps:write

✓

Accept a transfer by transfer_token: move the app's ownership to the calling platform and re-parent it to its account. The previous owner loses access immediately. Single-use and expiring; a consumed/expired/unknown token is 4xx.