Admin and CLI

Run your instance from outside your app.

The operator API and the command line: users, sessions, roles, keys, and the day-to-day jobs that are nobody's front end.

The operator API. Users, sessions, roles, principals and tokens, as OpenAPI.
The command line. Every signetctl command and flag, generated from the tool's own help.
Using the command line. The written walk-through, when the flag list is not enough.

Docs · the operator contract

The Admin API.

The official contract for the operator API of a Signet instance (/admin/v1): 124 operations across users, sessions, tokens, delivery and event dead-letters, configuration, audit and stats. Generated from Signet's contract at commit c7649c40bc29, 2026-10-20.

agreements organizations Organizations grants audience stats users app-users sessions api-keys ssh-machine-issuers service-principals authorization-roles principal-role-grants oauth-clients service-tokens signing-keys platform-credentials tokens messages deliveries events config audit vault

Two authorities, deliberately separate. A running instance serves the auth-wire OpenAPI at /api/auth/open-api/generate-schema, and that document covers the better-auth wire only. This contract lives in the repository and covers the operator API; instances do not serve it.

Each name is also a command. An operationId equals a signetctl command path: users_list is signetctl users list. A build check compares the contract and the CLI in both directions, so they cannot drift apart without a failing test. The exceptions are deliberate and few: operations a hosting platform calls directly over HTTP, such as magic_link_send, have no command, and one HTTP-only control has no operationId; both are listed below like every other operation. The signetctl reference is the same list in its terminal form.

agreements

Operation	Route	What it does
`platform_agreements_list`	`GET` `/admin/v1/agreements`	List platform agreements
`platform_agreements_create`	`POST` `/admin/v1/agreements`	Create an agreement and version one
`platform_agreements_show`	`GET` `/admin/v1/agreements/{agreementId}`	Read an agreement and every full version
`platform_agreements_renew`	`PATCH` `/admin/v1/agreements/{agreementId}`	Set renewal for future acceptances
`platform_agreements_delete`	`DELETE` `/admin/v1/agreements/{agreementId}`	Delete an agreement with no acceptances
`platform_agreements_publish`	`POST` `/admin/v1/agreements/{agreementId}/versions`	Publish a new current version
`platform_agreements_record`	`POST` `/admin/v1/agreements/{agreementId}/acceptances`	Record an acceptance made outside Signet
`platform_agreements_acceptances`	`GET` `/admin/v1/agreement-acceptances`	List or export organization acceptances
`platform_clients_agreements_show`	`GET` `/admin/v1/clients/{clientId}/agreements`	Read the required agreement ids
`platform_clients_agreements_set`	`PUT` `/admin/v1/clients/{clientId}/agreements`	Replace the required agreement ids

organizations

Operation	Route	What it does
`agreements_shared_list`	`GET` `/admin/v1/organizations/{id}/shared-agreements`	Read shared agreement evidence
`agreements_shared_show`	`GET` `/admin/v1/organizations/{id}/shared-agreements/{agreementId}`	Read shared agreement evidence
`agreements_shares_show`	`GET` `/admin/v1/organizations/{id}/agreements/{agreementId}/shares`	Read shares
`agreements_shares_set`	`PUT` `/admin/v1/organizations/{id}/agreements/{agreementId}/shares`	Replace share recipients
`agreements_list`	`GET` `/admin/v1/organizations/{id}/agreements`	List organization agreements
`agreements_create`	`POST` `/admin/v1/organizations/{id}/agreements`	Create an agreement and version one
`agreements_show`	`GET` `/admin/v1/organizations/{id}/agreements/{agreementId}`	Read an agreement and every full version
`agreements_renew`	`PATCH` `/admin/v1/organizations/{id}/agreements/{agreementId}`	Set renewal for future acceptances
`agreements_delete`	`DELETE` `/admin/v1/organizations/{id}/agreements/{agreementId}`	Delete an agreement with no acceptances
`agreements_publish`	`POST` `/admin/v1/organizations/{id}/agreements/{agreementId}/versions`	Publish a new current version
`agreements_record`	`POST` `/admin/v1/organizations/{id}/agreements/{agreementId}/acceptances`	Record an acceptance made outside Signet
`clients_list`	`GET` `/admin/v1/organizations/{id}/clients`	List organization registered apps and their agreement requirements
`clients_agreements_show`	`GET` `/admin/v1/organizations/{id}/clients/{clientId}/agreements`	Read the required agreement ids
`clients_agreements_set`	`PUT` `/admin/v1/organizations/{id}/clients/{clientId}/agreements`	Replace the required agreement ids
`agreements_acceptances`	`GET` `/admin/v1/organizations/{id}/agreement-acceptances`	List or export organization acceptances
`organizations_list`	`GET` `/admin/v1/organizations`	Resolve an organization by exact slug
`organizations_create`	`POST` `/admin/v1/organizations`	Create an organization and its owner member row (platform credential only)
`organizations_get`	`GET` `/admin/v1/organizations/{id}`	Read one organization's public identity
`organizations_delete`	`DELETE` `/admin/v1/organizations/{id}`	Erase an organization and its whole tenant estate (platform credential only)
`organizations_members`	`GET` `/admin/v1/organizations/{id}/members`	List one organization's members, with each member's live session count
`organizations_add_member`	`POST` `/admin/v1/organizations/{id}/members`	Add one member to an organization (platform credential only)
`organizations_remove_member`	`DELETE` `/admin/v1/organizations/{id}/members/{userId}`	Remove one member immediately (platform credential only)
`organizations_sessions`	`GET` `/admin/v1/organizations/{id}/sessions`	List the live sessions currently active in one organization
`organizations_audit`	`GET` `/admin/v1/organizations/{id}/audit`	List one organization's audit entries, newest first, with the attribution boundary

Organizations

Operation	Route	What it does
`organizations_set_member_role`	`PATCH` `/admin/v1/organizations/{id}/members`	Set a membership role
`organizations_session_rules_get`	`GET` `/admin/v1/organizations/{id}/session-rules`	Read an organization's session rules
`organizations_session_rules_put`	`PUT` `/admin/v1/organizations/{id}/session-rules`	Replace an organization's session rules

grants

Operation	Route	What it does
`grants_create`	`POST` `/admin/v1/grants`	Create one exact opaque principal/resource/capability grant (grants:write)
`grants_list`	`GET` `/admin/v1/grants`	List grants in the caller's tenant scope (grants:read)
`grants_check`	`GET` `/admin/v1/grants/check`	Check one exact opaque principal/resource/capability tuple (grants:read)
`grants_get`	`GET` `/admin/v1/grants/{id}`	Fetch one grant in the caller's tenant scope (grants:read)
`grants_revoke`	`DELETE` `/admin/v1/grants/{id}`	Idempotently revoke one grant in the caller's tenant scope (grants:write)
`grants_revoke_many`	`POST` `/admin/v1/grants/revoke`	Revoke every live grant matching exact filters (grants:write)

audience

Operation	Route	What it does
`audience_get`	`GET` `/admin/v1/audience/{app}/{resource}`	Read the audience set for one resource (audience:manage)
`audience_set`	`PUT` `/admin/v1/audience/{app}/{resource}`	Create or revise the audience for one resource (audience:manage)
`audience_check`	`POST` `/admin/v1/audience/{app}/{resource}/check`	Ask whether one person may open this resource now (audience:check)

stats

Operation	Route	What it does
`stats`	`GET` `/admin/v1/stats`	Instance stats: users, active sessions, sign-ins per day, delivery and rate-limit counters

users

Operation	Route	What it does
`users_list`	`GET` `/admin/v1/users`	List users, newest first, with case-insensitive substring search over email and name
`users_create`	`POST` `/admin/v1/users`	Create a user (optionally with password, role, and profile data)
`users_set_role`	`POST` `/admin/v1/users/{id}/role`	Set a user's role or roles
`users_two_factor_get`	`GET` `/admin/v1/users/{id}/two-factor`	Count the backup codes on a person's verified hosted factor (platform credential only)
`users_two_factor_import`	`PUT` `/admin/v1/users/{id}/two-factor`	Import a proven SHA256 factor without replacement (platform credential only)
`users_two_factor_remove`	`DELETE` `/admin/v1/users/{id}/two-factor`	Remove only with the person's current factor code (platform credential only)
`magic_link_send`	`POST` `/admin/v1/magic-link`	Mail a platform sign-in link to an exactly configured landing (platform credential only)
`users_set_password`	`POST` `/admin/v1/users/{id}/password`	Set a user's email/password credential (platform credential only)
`users_delete`	`DELETE` `/admin/v1/users/{id}`	IRREVERSIBLE: delete a user and every row they own
`users_ban`	`POST` `/admin/v1/users/{id}/ban`	Ban a user (reversible): revokes their sessions and user-backed credentials
`users_unban`	`POST` `/admin/v1/users/{id}/unban`	Lift a user's ban
`users_unlock`	`POST` `/admin/v1/users/unlock`	Clear a lockout/escalation state, addressed by email (not id)
`users_sessions`	`GET` `/admin/v1/users/{id}/sessions`	List a user's sessions
`users_revoke_all`	`POST` `/admin/v1/users/{id}/revoke-all`	Revoke every session belonging to a user

app-users

Operation	Route	What it does
`app_users_list`	`GET` `/admin/v1/app-users`	List one canonical application's end-user population, newest first
`app_users_create`	`POST` `/admin/v1/app-users`	Create one tenant/application-scoped end user
`app_users_update`	`POST` `/admin/v1/app-users/{id}`	Update an application's end user
`app_users_delete`	`DELETE` `/admin/v1/app-users/{id}`	IRREVERSIBLE: erase one app_user principal and its sessions
`app_users_revoke_sessions`	`POST` `/admin/v1/app-users/{id}/revoke-sessions`	Revoke every session of one application end user

sessions

Operation	Route	What it does
`sessions_revoke`	`POST` `/admin/v1/sessions/{token}/revoke`	Revoke one session by its at-rest token reference

api-keys

Operation	Route	What it does
`api_keys_mint`	`POST` `/admin/v1/api-keys`	Mint a declared-permission API key for an existing user

ssh-machine-issuers

Operation	Route	What it does
`ssh_machine_issuers_register`	`POST` `/admin/v1/ssh-machine-issuers`	Register a trusted machine SSH task issuer in the infrastructure organization

service-principals

Operation	Route	What it does
`service_principals_ssh_machine_template_register`	`POST` `/admin/v1/service-principals/{id}/ssh-machine-templates`	Bind one machine SSH task template to a live service principal
`service_principals_list`	`GET` `/admin/v1/service-principals`	Service identities, keyset-paged (cursor, not offset) and filterable by organization
`service_principals_create`	`POST` `/admin/v1/service-principals`	Create a stable tenant-owned service identity with a server-generated id
`service_principals_get`	`GET` `/admin/v1/service-principals/{id}`	One service identity with its role grants and each credential's engine-computed ceiling
`service_principals_delete`	`DELETE` `/admin/v1/service-principals/{id}`	Delete one disarmed service principal after all credentials and open batches are terminal

authorization-roles

Operation	Route	What it does
`authorization_roles_list`	`GET` `/admin/v1/authorization-roles`	Persisted D150 roles, keyset-paged and filterable by organization
`authorization_roles_create`	`POST` `/admin/v1/authorization-roles`	Create an immutable named D150 permission bundle in one exact scope
`authorization_roles_get`	`GET` `/admin/v1/authorization-roles/{id}`	Read one persisted D150 authorization role by id
`authorization_roles_delete`	`DELETE` `/admin/v1/authorization-roles/{id}`	Delete one authorization role after all principal-role grants are revoked

principal-role-grants

Operation	Route	What it does
`principal_role_grants_list`	`GET` `/admin/v1/principal-role-grants`	Which identities hold which roles, keyset-paged and filterable by principal and/or role
`principal_role_grants_create`	`POST` `/admin/v1/principal-role-grants`	Grant one existing scoped authorization role to one existing principal
`principal_role_grants_delete`	`DELETE` `/admin/v1/principal-role-grants/{id}`	Delete one principal-role grant without deleting its principal or role

oauth-clients

Operation	Route	What it does
`oauth_clients_create`	`POST` `/admin/v1/oauth-clients`	Create a confidential OAuth client for an existing service principal
`no operationId`	`POST` `/admin/v1/oauth-clients/{client_id}`	Set the consent policy or post-logout addresses of an existing public or confidential client
`oauth_clients_get`	`GET` `/admin/v1/oauth-clients/{client_id}`	Read OAuth client metadata without its secret or digest
`oauth_clients_delete`	`DELETE` `/admin/v1/oauth-clients/{client_id}`	Delete an OAuth client and invalidate its issued credentials
`no operationId`	`GET` `/admin/v1/organizations/{id}/sign-in-clients`	List the organization sign-in clients made by this route
`no operationId`	`POST` `/admin/v1/organizations/{id}/sign-in-clients`	Create an organization app's public PKCE sign-in client
`no operationId`	`GET` `/admin/v1/organizations/{id}/sign-in-clients/{client_id}`	Read an organization sign-in client made by this route
`no operationId`	`DELETE` `/admin/v1/organizations/{id}/sign-in-clients/{client_id}`	Delete an organization sign-in client made by this route

service-tokens

Operation	Route	What it does
`service_tokens_mint`	`POST` `/admin/v1/service-tokens`	Mint a required-expiry credential for an existing service principal
`service_tokens_rotate`	`POST` `/admin/v1/service-tokens/{id}/rotate`	Rotate one active service token with an explicit bounded overlap
`service_tokens_mint_batch`	`POST` `/admin/v1/service-token-batches`	Idempotently mint one pre-provisioned tenant credential manifest
`service_tokens_reconcile_batch`	`POST` `/admin/v1/service-token-batches/{id}/reconcile`	Abandon one crashed U13 claim and revoke every reverse-linked destination token
`service_tokens_remint_batch`	`POST` `/admin/v1/service-token-remints`	Prevalidate and remint one complete U6 legacy-credential batch

signing-keys

Operation	Route	What it does
`signing_keys_list`	`GET` `/admin/v1/signing-keys`	List Ed25519 JWKS signing-key lifecycle metadata
`signing_keys_prepare`	`POST` `/admin/v1/signing-keys/prepare`	Prepare one EdDSA or RS256 JWKS-lane successor
`signing_keys_activate`	`POST` `/admin/v1/signing-keys/{kid}/activate`	Activate a dwelled prepared JWKS successor
`signing_keys_revoke`	`POST` `/admin/v1/signing-keys/{handle}/revoke`	Revoke a prepared, retiring, or emergency active JWKS key

platform-credentials

Operation	Route	What it does
`platform_credentials_list`	`GET` `/admin/v1/platform-credentials`	List durable platform-administrator credential lifecycle metadata
`platform_credentials_mint`	`POST` `/admin/v1/platform-credentials`	Mint a credential in an independent no-vault or unlock lineage
`platform_credentials_rotate`	`POST` `/admin/v1/platform-credentials/rotate`	Mint a managed platform credential with bounded predecessor overlap
`platform_credentials_revoke`	`POST` `/admin/v1/platform-credentials/{id}/revoke`	Revoke one retiring or offline-recovery platform credential

tokens

Operation	Route	What it does
`tokens_list`	`GET` `/admin/v1/tokens`	Token inventory, keyset-paged (cursor, not offset)
`tokens_config`	`GET` `/admin/v1/tokens/config`	The token-kind registry (read-only)
`tokens_get`	`GET` `/admin/v1/tokens/{id}`	One token record by handle
`tokens_revoke`	`POST` `/admin/v1/tokens/{id}/revoke`	Revoke one exact token handle
`tokens_revoke_principal`	`POST` `/admin/v1/principals/{id}/tokens/revoke`	Review then atomically revoke one service principal's exact active credential estate

messages

Operation	Route	What it does
`messages_hobby_waitlist`	`POST` `/admin/v1/messages/hobby-waitlist`	Send one numbered Hobby waitlist stage mail

deliveries

Operation	Route	What it does
`deliveries_dead_letters`	`GET` `/admin/v1/deliveries/dead-letters`	List delivery dead-letters (undeliverable emails/webhooks)
`deliveries_replay`	`POST` `/admin/v1/deliveries/dead-letters/{id}/replay`	Replay one dead-lettered delivery

events

Operation	Route	What it does
`events_dead_letters`	`GET` `/admin/v1/events/dead-letters`	List event dead-letters
`events_deliveries`	`GET` `/admin/v1/events/deliveries`	List durable event-delivery retry state and terminal rollup receipts
`events_replay`	`POST` `/admin/v1/events/dead-letters/{id}/replay`	Replay one dead-lettered event

config

Operation	Route	What it does
`config_show`	`GET` `/admin/v1/config`	Configuration introspection: secrets absent by construction, never masked

audit

Operation	Route	What it does
`approval_requests_list`	`GET` `/admin/v1/approval-requests`	List approval requests and their outcomes, newest first
`audit_export`	`GET` `/admin/v1/audit/export`	Export the admin audit log as NDJSON

vault

Operation	Route	What it does
`vault_list`	`GET` `/admin/v1/vault`	List an organization's secret paths and metadata: never a value
`vault_get`	`GET` `/admin/v1/vault/{path}`	Decrypt and return one secret: receipted before the value is returned
`vault_put`	`PUT` `/admin/v1/vault/{path}`	Create a secret or write a new version, shredding the one it supersedes
`vault_rotate`	`POST` `/admin/v1/vault/{path}/rotate`	Write a new version under a fresh data key and crypto-shred the previous one
`vault_revoke`	`POST` `/admin/v1/vault/{path}/revoke`	Withdraw a secret by deleting its data key: the ciphertext becomes unrecoverable
`vault_unseal`	`POST` `/admin/v1/vault-master-key`	Supply this instance's 32-byte vault master key, the only supported way one arrives
`vault_status`	`GET` `/admin/v1/vault-status`	Report the vault seal state, memory hygiene posture, and the corrective action
`vault_audit_export`	`GET` `/admin/v1/vault-audit-export`	Export the vault's hash-chained receipt trail as NDJSON: every read, write and refusal

A new operation is added to the contract first, then the CLI grows the command. The API mounts only when an admin key is configured; without one, every path answers 404.