Console BFF

Console session, projects, keys, services, members and audit.

Generated from the public REST API definitions

Version v1.1.0 · Updated 2026-10-26 · revision 1

Group overview

Generated at build time from the public REST API definition: tag console, 80 operations (out of 189). For authentication, envelope and pagination conventions see REST API overview.

Method	Path	Summary
`POST`	`/console/auth/login`	Console login
`POST`	`/console/auth/logout`	Console logout
`POST`	`/console/auth/mfa`	Complete the MFA challenge
`GET`	`/console/auth/sso/authorize`	Start an OIDC authorization-code flow
`POST`	`/console/auth/sso/exchange`	Exchange an OIDC authorization code for a session
`GET`	`/console/auth/sso/status`	Report SSO availability
`GET`	`/console/billing`	Billing settlement overview
`GET`	`/console/billing/invoices/{invoiceId}/csv`	Download an invoice as CSV
`POST`	`/console/billing/invoices/{invoiceId}/pay`	Settle an invoice with the sandbox provider
`GET`	`/console/billing/plans`	List subscription plans
`POST`	`/console/billing/subscriptions`	Change the subscription plan
`DELETE`	`/console/billing/subscriptions`	Cancel the subscription
`PUT`	`/console/billing/tax-profile`	Save the tax profile
`POST`	`/console/billing/topups`	Record a sandbox top-up
`GET`	`/console/extensions`	List the built-in extension registry
`GET`	`/console/me`	Current account with projects
`GET`	`/console/notifications`	Notification preferences, inbox summary and channels
`GET`	`/console/notifications/channels`	Delivery channel availability
`GET`	`/console/notifications/inbox`	List the in-app inbox
`POST`	`/console/notifications/inbox/read-all`	Mark every inbox message read
`POST`	`/console/notifications/inbox/{messageId}/read`	Mark one inbox message read or unread
`PUT`	`/console/notifications/preferences`	Update notification preferences
`POST`	`/console/notifications/test`	Send a test notification
`GET`	`/console/organisation`	Organisation overview
`PATCH`	`/console/organisation`	Rename the organisation
`POST`	`/console/organisation/members`	Invite an organisation member
`DELETE`	`/console/organisation/members/{accountId}`	Remove an organisation member
`POST`	`/console/organisation/projects/{projectId}/transfer`	Transfer project ownership
`GET`	`/console/projects`	List my projects
`POST`	`/console/projects`	Create a project (returns secrets once)
`GET`	`/console/projects/cap`	Project cap for the account
`GET`	`/console/projects/{projectId}`	Project detail
`PATCH`	`/console/projects/{projectId}`	Update project
`GET`	`/console/projects/{projectId}/alerts`	List usage alert rules and deliveries
`POST`	`/console/projects/{projectId}/alerts`	Create a usage alert rule
`POST`	`/console/projects/{projectId}/alerts/evaluate`	Evaluate every alert rule of the project
`PATCH`	`/console/projects/{projectId}/alerts/{ruleId}`	Update a usage alert rule
`DELETE`	`/console/projects/{projectId}/alerts/{ruleId}`	Delete a usage alert rule
`POST`	`/console/projects/{projectId}/alerts/{ruleId}/evaluate`	Evaluate one alert rule
`GET`	`/console/projects/{projectId}/audit`	Audit trail
`GET`	`/console/projects/{projectId}/certificates`	List the App Certificate table
`POST`	`/console/projects/{projectId}/certificates`	Add a secondary App Certificate
`DELETE`	`/console/projects/{projectId}/certificates/{certificateId}`	Delete a certificate row
`POST`	`/console/projects/{projectId}/certificates/{certificateId}/disable`	Disable a certificate
`POST`	`/console/projects/{projectId}/certificates/{certificateId}/promote`	Promote a certificate to primary
`GET`	`/console/projects/{projectId}/collaborators`	List collaborators
`POST`	`/console/projects/{projectId}/collaborators`	Add a collaborator
`PATCH`	`/console/projects/{projectId}/collaborators/{accountId}`	Assign a built-in or custom role to a member
`DELETE`	`/console/projects/{projectId}/collaborators/{accountId}`	Remove a collaborator
`GET`	`/console/projects/{projectId}/extensions`	List project extensions
`DELETE`	`/console/projects/{projectId}/extensions/{extensionId}`	Uninstall an extension
`POST`	`/console/projects/{projectId}/extensions/{extensionId}/enable`	Enable or disable an installed extension
`POST`	`/console/projects/{projectId}/extensions/{extensionId}/install`	Install a built-in extension
`POST`	`/console/projects/{projectId}/extensions/{extensionId}/run`	Run a built-in extension
`POST`	`/console/projects/{projectId}/keys/rotate`	Rotate customer secret / app certificate
`GET`	`/console/projects/{projectId}/overview`	Dashboard overview
`GET`	`/console/projects/{projectId}/roles`	List built-in and custom roles
`POST`	`/console/projects/{projectId}/roles`	Create a custom role
`PATCH`	`/console/projects/{projectId}/roles/{roleId}`	Update a custom role
`DELETE`	`/console/projects/{projectId}/roles/{roleId}`	Delete a custom role
`POST`	`/console/projects/{projectId}/services`	Activate/deactivate services
`GET`	`/console/projects/{projectId}/statements/{period}`	Billing statement for one month (JSON envelope or CSV)
`POST`	`/console/projects/{projectId}/token`	Token generator
`GET`	`/console/projects/{projectId}/tokens/verify`	Verify a token from the console
`GET`	`/console/projects/{projectId}/webhook`	Get webhook config
`PUT`	`/console/projects/{projectId}/webhook`	Configure webhook
`DELETE`	`/console/projects/{projectId}/webhook`	Delete webhook config
`GET`	`/console/projects/{projectId}/webhook/deliveries`	Delivery log
`POST`	`/console/projects/{projectId}/webhook/deliveries/{deliveryId}/replay`	Replay a delivery
`GET`	`/console/projects/{projectId}/xla/monthly`	XLA monthly report (one project)
`GET`	`/console/security`	Account security overview
`POST`	`/console/security/mfa/disable`	Disable MFA
`POST`	`/console/security/mfa/enroll`	Start TOTP enrollment
`POST`	`/console/security/mfa/recovery-codes`	Regenerate recovery codes
`POST`	`/console/security/mfa/verify`	Verify the TOTP code and enable MFA
`POST`	`/console/security/password`	Change the console password
`PUT`	`/console/security/sso`	Configure the OIDC connection
`POST`	`/console/security/sso/test`	Run OIDC discovery against the configured issuer
`GET`	`/console/status`	Regional service status (XLA)
`GET`	`/console/xla/monthly`	XLA monthly report (account-wide)

Operation details

POST `/console/auth/login`

Console login

Authentication: no credentials required

Request body

Field	Type	Required	Description
`email`	`string`	is	format email
`password`	`string`	is

json

{
  "email": "owner@ni-meet.local",
  "password": "ni-meet-demo"
}

Response

Status codes	Description / schema
`200`	oneOf: a session (direct sign-in) or an MFA challenge — narrow on the presence of `token` — `any`
`401`	Missing/invalid credentials — `Error`

Example call

bash

curl -s -X POST "$NIMEET_API_BASE/console/auth/login" \
  -H "Content-Type: application/json" \
  -d '{"email":"owner@ni-meet.local","password":"ni-meet-demo"}'

POST `/console/auth/logout`

Console logout

Authentication: no credentials required

Response

Status codes	Description / schema
`204`	logged out

Example call

bash

curl -s -X POST "$NIMEET_API_BASE/console/auth/logout"

POST `/console/auth/mfa`

Complete the MFA challenge

Exchanges the short-lived challenge token plus a TOTP/recovery code for a session (#29).

Authentication: no credentials required

Response

Status codes	Description / schema
`200`	the session minted after the second factor verified — `object{ token, expiresAt, account }`
`400`	Invalid parameter — `Error`
`401`	Missing/invalid credentials — `Error`
`403`	Banned or service not enabled — `Error`

Example call

bash

curl -s -X POST "$NIMEET_API_BASE/console/auth/mfa"

GET `/console/auth/sso/authorize`

Start an OIDC authorization-code flow

Returns the authorization URL and the single-use state (#29).

Authentication: no credentials required

Response

Status codes	Description / schema
`200`	the authorize URL, the CSRF state and the discovery endpoints — `object{ authorizeUrl, state, issuer, discovery }`
`400`	Invalid parameter — `Error`
`401`	Missing/invalid credentials — `Error`
`403`	Banned or service not enabled — `Error`

Example call

bash

curl -s -X GET "$NIMEET_API_BASE/console/auth/sso/authorize"

POST `/console/auth/sso/exchange`

Exchange an OIDC authorization code for a session

Discovery + token + userinfo against the configured issuer (#29).

Authentication: no credentials required

Response

Status codes	Description / schema
`200`	the session minted after the SSO code exchanged — `object{ token, expiresAt, account }`
`400`	Invalid parameter — `Error`
`401`	Missing/invalid credentials — `Error`
`403`	Banned or service not enabled — `Error`

Example call

bash

curl -s -X POST "$NIMEET_API_BASE/console/auth/sso/exchange"

GET `/console/auth/sso/status`

Report SSO availability

Issuers with an enabled OIDC connection (#29).

Authentication: no credentials required

Response

Status codes	Description / schema
`200`	whether any organisation exposes SSO, the redirect URI and the local stub state — `object{ available, issuers, redirectUri, stub }`
`400`	Invalid parameter — `Error`
`401`	Missing/invalid credentials — `Error`
`403`	Banned or service not enabled — `Error`

Example call

bash

curl -s -X GET "$NIMEET_API_BASE/console/auth/sso/status"

GET `/console/billing`

Billing settlement overview

Invoices, top-ups, plans, tax profile and the sandbox provider state (#15).

Authentication: console session (Bearer)

Response

Status codes	Description / schema
`200`	provider capability, plans, subscription, invoices, top-ups, charges, tax profile and totals — `BillingOverview`
`400`	Invalid parameter — `Error`
`401`	Missing/invalid credentials — `Error`
`403`	Banned or service not enabled — `Error`

Example call

bash

curl -s -X GET "$NIMEET_API_BASE/console/billing" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

GET `/console/billing/invoices/{invoiceId}/csv`

Download an invoice as CSV

Authentication: console session (Bearer)

Parameters

Name	Location	Required	Type	Description
`invoiceId`	path	is	`string`

Response

Status codes	Description / schema
`200`	the invoice as CSV (RFC 4180): a header row followed by one row per line item; delivered as a file download
`400`	Invalid parameter — `Error`
`401`	Missing/invalid credentials — `Error`
`403`	Banned or service not enabled — `Error`

Example call

bash

curl -s -X GET "$NIMEET_API_BASE/console/billing/invoices/invoiceId/csv" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

POST `/console/billing/invoices/{invoiceId}/pay`

Settle an invoice with the sandbox provider

Records a simulated charge; no money moves (#15).

Authentication: console session (Bearer)

Parameters

Name	Location	Required	Type	Description
`invoiceId`	path	is	`string`

Response

Status codes	Description / schema
`200`	the settled invoice, the (simulated) charge and the provider disclaimer — `object{ invoice, charge, provider, disclaimer }`
`400`	Invalid parameter — `Error`
`401`	Missing/invalid credentials — `Error`
`403`	Banned or service not enabled — `Error`

Example call

bash

curl -s -X POST "$NIMEET_API_BASE/console/billing/invoices/invoiceId/pay" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

GET `/console/billing/plans`

List subscription plans

Authentication: console session (Bearer)

Response

Status codes	Description / schema
`200`	the price list the deployment prices against — `object{ plans }`
`400`	Invalid parameter — `Error`
`401`	Missing/invalid credentials — `Error`
`403`	Banned or service not enabled — `Error`

Example call

bash

curl -s -X GET "$NIMEET_API_BASE/console/billing/plans" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

POST `/console/billing/subscriptions`

Change the subscription plan

Authentication: console session (Bearer)

Response

Status codes	Description / schema
`200`	the active subscription — `object{ subscription }`
`400`	Invalid parameter — `Error`
`401`	Missing/invalid credentials — `Error`
`403`	Banned or service not enabled — `Error`

Example call

bash

curl -s -X POST "$NIMEET_API_BASE/console/billing/subscriptions" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

DELETE `/console/billing/subscriptions`

Cancel the subscription

Authentication: console session (Bearer)

Response

Status codes	Description / schema
`200`	the cancelled subscription — `object{ subscription }`
`400`	Invalid parameter — `Error`
`401`	Missing/invalid credentials — `Error`
`403`	Banned or service not enabled — `Error`

Example call

bash

curl -s -X DELETE "$NIMEET_API_BASE/console/billing/subscriptions" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

PUT `/console/billing/tax-profile`

Save the tax profile

Stored unverified: no tax authority is called (#15).

Authentication: console session (Bearer)

Response

Status codes	Description / schema
`200`	the stored tax profile (never validated against an authority) — `object{ taxProfile }`
`400`	Invalid parameter — `Error`
`401`	Missing/invalid credentials — `Error`
`403`	Banned or service not enabled — `Error`

Example call

bash

curl -s -X PUT "$NIMEET_API_BASE/console/billing/tax-profile" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

POST `/console/billing/topups`

Record a sandbox top-up

Records a sandbox top-up: no real money moves. The amount is validated in integer cents, so a third decimal place is rejected rather than rounded.

Authentication: console session (Bearer)

Request body

Field	Type	Required	Description
`amount`	`any`	is	top-up amount in major units (e.g. 12.34 or "12.34"). Money wire migration stage 1 (ADR-0016 §6): a JSON number is accepted during the compatibility window, a decimal string is the forward-compatible form, and stage 3 will accept only the string. At most 2 decimal places — a third decimal place is rejected with `invalid_parameter`, never rounded.
`note`	`string`		length 0..200

json

{
  "amount": "string",
  "note": "string"
}

Response

Status codes	Description / schema
`201`	the sandbox top-up, its charge and the updated totals — `object{ topUp, charge, totals }`
`400`	Invalid parameter — `Error`
`401`	Missing/invalid credentials — `Error`
`403`	Banned or service not enabled — `Error`

Example call

bash

curl -s -X POST "$NIMEET_API_BASE/console/billing/topups" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION" \
  -H "Content-Type: application/json" \
  -d '{"amount":"string","note":"string"}'

GET `/console/extensions`

List the built-in extension registry

Authentication: console session (Bearer)

Response

Status codes	Description / schema
`200`	built-in extension registry — this deployment distributes no third-party packages — `object{ extensions, note }`
`400`	Invalid parameter — `Error`
`401`	Missing/invalid credentials — `Error`
`403`	Banned or service not enabled — `Error`

Example call

bash

curl -s -X GET "$NIMEET_API_BASE/console/extensions" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

GET `/console/me`

Current account with projects

Authentication: console session (Bearer)

Response

Status codes	Description / schema
`200`	current account, projects, usage, roles, organisation, quota, notifications, security — `object`

Example call

bash

curl -s -X GET "$NIMEET_API_BASE/console/me" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

GET `/console/notifications`

Notification preferences, inbox summary and channels

Includes the honest email availability state (#30).

Authentication: console session (Bearer)

Response

Status codes	Description / schema
`200`	notification preferences, event catalogue, channel availability, unread count and the latest 20 inbox messages — `object{ preferences, catalogue, channels, unread, latest }`

Example call

bash

curl -s -X GET "$NIMEET_API_BASE/console/notifications" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

GET `/console/notifications/channels`

Delivery channel availability

smtp_not_configured is reported explicitly (#30).

Authentication: console session (Bearer)

Response

Status codes	Description / schema
`200`	inbox/email channel availability and the reason each one is on or off — `object{ inbox, email }`
`400`	Invalid parameter — `Error`
`401`	Missing/invalid credentials — `Error`
`403`	Banned or service not enabled — `Error`

Example call

bash

curl -s -X GET "$NIMEET_API_BASE/console/notifications/channels" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

GET `/console/notifications/inbox`

List the in-app inbox

Authentication: console session (Bearer)

Response

Status codes	Description / schema
`200`	inbox messages plus the total unread count — `object{ messages, unread }`

Example call

bash

curl -s -X GET "$NIMEET_API_BASE/console/notifications/inbox" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

POST `/console/notifications/inbox/read-all`

Mark every inbox message read

Authentication: console session (Bearer)

Response

Status codes	Description / schema
`200`	how many messages were marked read — `object{ updated }`
`400`	Invalid parameter — `Error`
`401`	Missing/invalid credentials — `Error`
`403`	Banned or service not enabled — `Error`

Example call

bash

curl -s -X POST "$NIMEET_API_BASE/console/notifications/inbox/read-all" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

POST `/console/notifications/inbox/{messageId}/read`

Mark one inbox message read or unread

Authentication: console session (Bearer)

Parameters

Name	Location	Required	Type	Description
`messageId`	path	is	`string`

Response

Status codes	Description / schema
`200`	the message with its new read state — `object{ message }`
`400`	Invalid parameter — `Error`
`401`	Missing/invalid credentials — `Error`
`403`	Banned or service not enabled — `Error`

Example call

bash

curl -s -X POST "$NIMEET_API_BASE/console/notifications/inbox/messageId/read" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

PUT `/console/notifications/preferences`

Update notification preferences

Authentication: console session (Bearer)

Response

Status codes	Description / schema
`200`	the stored preferences plus the current channel availability — `object{ preferences, channels }`
`400`	Invalid parameter — `Error`
`401`	Missing/invalid credentials — `Error`
`403`	Banned or service not enabled — `Error`

Example call

bash

curl -s -X PUT "$NIMEET_API_BASE/console/notifications/preferences" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

POST `/console/notifications/test`

Send a test notification

Delivery records state delivered/suppressed/failed per channel (#30).

Authentication: console session (Bearer)

Response

Status codes	Description / schema
`200`	one delivery row per channel plus the channel availability — `object{ deliveries, channels }`
`400`	Invalid parameter — `Error`
`401`	Missing/invalid credentials — `Error`
`403`	Banned or service not enabled — `Error`

Example call

bash

curl -s -X POST "$NIMEET_API_BASE/console/notifications/test" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

GET `/console/organisation`

Organisation overview

Members, projects, SSO summary and the account project cap (#28).

Authentication: console session (Bearer)

Response

Status codes	Description / schema
`200`	organisation, caller role, members, projects, SSO view and the project cap — `object{ organisation, callerRole, members, projects, sso, projectCap }`
`400`	Invalid parameter — `Error`
`401`	Missing/invalid credentials — `Error`
`403`	Banned or service not enabled — `Error`

Example call

bash

curl -s -X GET "$NIMEET_API_BASE/console/organisation" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

PATCH `/console/organisation`

Rename the organisation

Authentication: console session (Bearer)

Response

Status codes	Description / schema
`200`	the organisation after the rename — `object{ organisation, callerRole, members, projects, sso, projectCap }`
`400`	Invalid parameter — `Error`
`401`	Missing/invalid credentials — `Error`
`403`	Banned or service not enabled — `Error`

Example call

bash

curl -s -X PATCH "$NIMEET_API_BASE/console/organisation" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

POST `/console/organisation/members`

Invite an organisation member

No outbound email; the initial password is handed over out-of-band (#28).

Authentication: console session (Bearer)

Response

Status codes	Description / schema
`201`	the invited member, whether a password was set and whether a new account was created — `object{ member, invitePasswordSet, accountCreated }`
`400`	Invalid parameter — `Error`
`401`	Missing/invalid credentials — `Error`
`403`	Banned or service not enabled — `Error`

Example call

bash

curl -s -X POST "$NIMEET_API_BASE/console/organisation/members" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

DELETE `/console/organisation/members/{accountId}`

Remove an organisation member

Authentication: console session (Bearer)

Parameters

Name	Location	Required	Type	Description
`accountId`	path	is	`string`	length 0..128

Response

Status codes	Description / schema
`204`	member removed
`400`	Invalid parameter — `Error`
`401`	Missing/invalid credentials — `Error`
`403`	Banned or service not enabled — `Error`

Example call

bash

curl -s -X DELETE "$NIMEET_API_BASE/console/organisation/members/$ACCOUNT_ID" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

POST `/console/organisation/projects/{projectId}/transfer`

Transfer project ownership

Target becomes owner, caller is demoted to admin (#28).

Authentication: console session (Bearer)

Parameters

Name	Location	Required	Type	Description
`projectId`	path	is	`string`	length 0..128

Response

Status codes	Description / schema
`200`	the project after the ownership transfer — `object{ project }`
`400`	Invalid parameter — `Error`
`401`	Missing/invalid credentials — `Error`
`403`	Banned or service not enabled — `Error`
`404`	Resource not found — `Error`

Example call

bash

curl -s -X POST "$NIMEET_API_BASE/console/organisation/projects/$PROJECT_ID/transfer" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

GET `/console/projects`

List my projects

Authentication: console session (Bearer)

Response

Status codes	Description / schema
`200`	projects visible to the caller — `object{ projects }`

Example call

bash

curl -s -X GET "$NIMEET_API_BASE/console/projects" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

POST `/console/projects`

Create a project (returns secrets once)

Authentication: console session (Bearer)

Request body

Field	Type	Required
`name`	`string`	is
`authMode`	`enum(token \| appid)`
`tokenTtlSeconds`	`integer`
`privilegeTtlSeconds`	`integer`
`services`	`object{ recording, streaming, analytics }`
`quotas`	`object{ recordingConcurrent, streamingConcurrent, maxChannels }`

json

{
  "name": "demo-project",
  "services": {
    "recording": true,
    "streaming": true
  }
}

Response

Status codes	Description / schema
`201`	created project; appCertificate and customerSecret are returned once — `object{ project, appCertificate, customerSecret }`

Example call

bash

curl -s -X POST "$NIMEET_API_BASE/console/projects" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION" \
  -H "Content-Type: application/json" \
  -d '{"name":"demo-project","services":{"recording":true,"streaming":true}}'

GET `/console/projects/cap`

Project cap for the account

{ limit, used, remaining, enforced } (#34).

Authentication: console session (Bearer)

Response

Status codes	Description / schema
`200`	project count cap and current usage — `object{ limit, used, remaining, enforced }`
`400`	Invalid parameter — `Error`
`401`	Missing/invalid credentials — `Error`
`403`	Banned or service not enabled — `Error`

Example call

bash

curl -s -X GET "$NIMEET_API_BASE/console/projects/cap" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

GET `/console/projects/{projectId}`

Project detail

Authentication: console session (Bearer)

Parameters

Name	Location	Required	Type	Description
`projectId`	path	is	`string`	length 0..128

Response

Status codes	Description / schema
`200`	project detail with webhook, role, credentials metadata, rest keys, rotation and quota — `object`

Example call

bash

curl -s -X GET "$NIMEET_API_BASE/console/projects/$PROJECT_ID" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

PATCH `/console/projects/{projectId}`

Update project

Authentication: console session (Bearer)

Parameters

Name	Location	Required	Type	Description
`projectId`	path	is	`string`	length 0..128

Response

Status codes	Description / schema
`200`	the updated project — `object{ project }`

Example call

bash

curl -s -X PATCH "$NIMEET_API_BASE/console/projects/$PROJECT_ID" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

GET `/console/projects/{projectId}/alerts`

List usage alert rules and deliveries

Rules, delivery log and the metric/channel catalogue (#33).

Authentication: console session (Bearer)

Parameters

Name	Location	Required	Type	Description
`projectId`	path	is	`string`	length 0..128

Response

Status codes	Description / schema
`200`	alert rules, delivery log, the metric/channel catalogue and the project region — `object{ rules, deliveries, catalogue, projectRegion }`
`400`	Invalid parameter — `Error`
`401`	Missing/invalid credentials — `Error`
`403`	Banned or service not enabled — `Error`

Example call

bash

curl -s -X GET "$NIMEET_API_BASE/console/projects/$PROJECT_ID/alerts" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

POST `/console/projects/{projectId}/alerts`

Create a usage alert rule

Threshold, comparison, evaluation window and delivery channels (#33).

Authentication: console session (Bearer)

Parameters

Name	Location	Required	Type	Description
`projectId`	path	is	`string`	length 0..128

Response

Status codes	Description / schema
`201`	the created rule — `object{ rule }`
`400`	Invalid parameter — `Error`
`401`	Missing/invalid credentials — `Error`
`403`	Banned or service not enabled — `Error`

Example call

bash

curl -s -X POST "$NIMEET_API_BASE/console/projects/$PROJECT_ID/alerts" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

POST `/console/projects/{projectId}/alerts/evaluate`

Evaluate every alert rule of the project

Deterministic evaluation used by the console and the acceptance tests (#33).

Authentication: console session (Bearer)

Parameters

Name	Location	Required	Type	Description
`projectId`	path	is	`string`	length 0..128

Response

Status codes	Description / schema
`200`	the evaluation report and the rule snapshot after evaluation — `object{ report, rules }`
`400`	Invalid parameter — `Error`
`401`	Missing/invalid credentials — `Error`
`403`	Banned or service not enabled — `Error`

Example call

bash

curl -s -X POST "$NIMEET_API_BASE/console/projects/$PROJECT_ID/alerts/evaluate" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

PATCH `/console/projects/{projectId}/alerts/{ruleId}`

Update a usage alert rule

Partial update (#33).

Authentication: console session (Bearer)

Parameters

Name	Location	Required	Type	Description
`projectId`	path	is	`string`	length 0..128
`ruleId`	path	is	`string`

Response

Status codes	Description / schema
`200`	the updated rule — `object{ rule }`
`400`	Invalid parameter — `Error`
`401`	Missing/invalid credentials — `Error`
`403`	Banned or service not enabled — `Error`

Example call

bash

curl -s -X PATCH "$NIMEET_API_BASE/console/projects/$PROJECT_ID/alerts/ruleId" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

DELETE `/console/projects/{projectId}/alerts/{ruleId}`

Delete a usage alert rule

Authentication: console session (Bearer)

Parameters

Name	Location	Required	Type	Description
`projectId`	path	is	`string`	length 0..128
`ruleId`	path	is	`string`

Response

Status codes	Description / schema
`200`	the id of the deleted rule — `object{ deleted }`
`400`	Invalid parameter — `Error`
`401`	Missing/invalid credentials — `Error`
`403`	Banned or service not enabled — `Error`

Example call

bash

curl -s -X DELETE "$NIMEET_API_BASE/console/projects/$PROJECT_ID/alerts/ruleId" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

POST `/console/projects/{projectId}/alerts/{ruleId}/evaluate`

Evaluate one alert rule

Authentication: console session (Bearer)

Parameters

Name	Location	Required	Type	Description
`projectId`	path	is	`string`	length 0..128
`ruleId`	path	is	`string`

Response

Status codes	Description / schema
`200`	the evaluation report and the rule snapshot after evaluation — `object{ report, rules }`
`400`	Invalid parameter — `Error`
`401`	Missing/invalid credentials — `Error`
`403`	Banned or service not enabled — `Error`

Example call

bash

curl -s -X POST "$NIMEET_API_BASE/console/projects/$PROJECT_ID/alerts/ruleId/evaluate" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

GET `/console/projects/{projectId}/audit`

Audit trail

Authentication: console session (Bearer)

Parameters

Name	Location	Required	Type	Description
`projectId`	path	is	`string`	length 0..128

Response

Status codes	Description / schema
`200`	audit entries; verification and chain appear when ?verify=1 — `object{ total, entries, verification, chain }`

Example call

bash

curl -s -X GET "$NIMEET_API_BASE/console/projects/$PROJECT_ID/audit" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

GET `/console/projects/{projectId}/certificates`

List the App Certificate table

Primary/secondary/disabled rows with fingerprints; secrets are never listed (#7).

Authentication: console session (Bearer)

Parameters

Name	Location	Required	Type	Description
`projectId`	path	is	`string`	length 0..128

Response

Status codes	Description / schema
`200`	certificate rows (fingerprint only — never the secret), rotation state, legend and token-validation note — `object{ certificates, rotation, legend, tokenValidation }`
`400`	Invalid parameter — `Error`
`401`	Missing/invalid credentials — `Error`
`403`	Banned or service not enabled — `Error`

Example call

bash

curl -s -X GET "$NIMEET_API_BASE/console/projects/$PROJECT_ID/certificates" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

POST `/console/projects/{projectId}/certificates`

Add a secondary App Certificate

Returns the certificate material exactly once (#7).

Authentication: console session (Bearer)

Parameters

Name	Location	Required	Type	Description
`projectId`	path	is	`string`	length 0..128

Response

Status codes	Description / schema
`201`	the new secondary certificate; `secret` is returned exactly once — `object{ certificate, notice }`
`400`	Invalid parameter — `Error`
`401`	Missing/invalid credentials — `Error`
`403`	Banned or service not enabled — `Error`

Example call

bash

curl -s -X POST "$NIMEET_API_BASE/console/projects/$PROJECT_ID/certificates" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

DELETE `/console/projects/{projectId}/certificates/{certificateId}`

Delete a certificate row

Primary cannot be deleted; a disabled or secondary row can (#7).

Authentication: console session (Bearer)

Parameters

Name	Location	Required	Type	Description
`projectId`	path	is	`string`	length 0..128
`certificateId`	path	is	`string`

Response

Status codes	Description / schema
`200`	whether the certificate was removed, plus a notice — `object{ removed, notice }`
`400`	Invalid parameter — `Error`
`401`	Missing/invalid credentials — `Error`
`403`	Banned or service not enabled — `Error`

Example call

bash

curl -s -X DELETE "$NIMEET_API_BASE/console/projects/$PROJECT_ID/certificates/certificateId" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

POST `/console/projects/{projectId}/certificates/{certificateId}/disable`

Disable a certificate

Tokens signed by it stop validating immediately (#7).

Authentication: console session (Bearer)

Parameters

Name	Location	Required	Type	Description
`projectId`	path	is	`string`	length 0..128
`certificateId`	path	is	`string`

Response

Status codes	Description / schema
`200`	the disabled certificate and a notice — `object{ certificate, notice }`
`400`	Invalid parameter — `Error`
`401`	Missing/invalid credentials — `Error`
`403`	Banned or service not enabled — `Error`

Example call

bash

curl -s -X POST "$NIMEET_API_BASE/console/projects/$PROJECT_ID/certificates/certificateId/disable" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

POST `/console/projects/{projectId}/certificates/{certificateId}/promote`

Promote a certificate to primary

The previous primary keeps verifying during the overlap window (#7).

Authentication: console session (Bearer)

Parameters

Name	Location	Required	Type	Description
`projectId`	path	is	`string`	length 0..128
`certificateId`	path	is	`string`

Response

Status codes	Description / schema
`200`	the promoted certificate, the previous primary and a notice — `object{ certificate, previous, notice }`
`400`	Invalid parameter — `Error`
`401`	Missing/invalid credentials — `Error`
`403`	Banned or service not enabled — `Error`

Example call

bash

curl -s -X POST "$NIMEET_API_BASE/console/projects/$PROJECT_ID/certificates/certificateId/promote" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

GET `/console/projects/{projectId}/collaborators`

List collaborators

Authentication: console session (Bearer)

Parameters

Name	Location	Required	Type	Description
`projectId`	path	is	`string`	length 0..128

Response

Status codes	Description / schema
`200`	collaborators, caller role, role matrix and custom roles — `object{ collaborators, caller, roles, customRoles, permissions, inviteableRoles }`

Example call

bash

curl -s -X GET "$NIMEET_API_BASE/console/projects/$PROJECT_ID/collaborators" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

POST `/console/projects/{projectId}/collaborators`

Add a collaborator

Authentication: console session (Bearer)

Parameters

Name	Location	Required	Type	Description
`projectId`	path	is	`string`	length 0..128

Request body

Field	Type	Required
`email`	`string`	is
`name`	`string`
`role`	`enum(admin \| developer \| viewer)`	is

json

{
  "email": "dev@example.com",
  "name": "Dev",
  "role": "developer"
}

Response

Status codes	Description / schema
`201`	the new collaborator plus whether an initial password was set — `object`

Example call

bash

curl -s -X POST "$NIMEET_API_BASE/console/projects/$PROJECT_ID/collaborators" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION" \
  -H "Content-Type: application/json" \
  -d '{"email":"dev@example.com","name":"Dev","role":"developer"}'

PATCH `/console/projects/{projectId}/collaborators/{accountId}`

Assign a built-in or custom role to a member

Custom role assignment overrides the built-in role permissions (#26).

Authentication: console session (Bearer)

Parameters

Name	Location	Required	Type	Description
`projectId`	path	is	`string`	length 0..128
`accountId`	path	is	`string`	length 0..128

Response

Status codes	Description / schema
`200`	the collaborator after the role change — `object{ collaborator }`
`400`	Invalid parameter — `Error`
`401`	Missing/invalid credentials — `Error`
`403`	Banned or service not enabled — `Error`

Example call

bash

curl -s -X PATCH "$NIMEET_API_BASE/console/projects/$PROJECT_ID/collaborators/$ACCOUNT_ID" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

DELETE `/console/projects/{projectId}/collaborators/{accountId}`

Remove a collaborator

Authentication: console session (Bearer)

Parameters

Name	Location	Required	Type	Description
`projectId`	path	is	`string`	length 0..128
`accountId`	path	is	`string`	length 0..128

Response

Status codes	Description / schema
`204`	removed

Example call

bash

curl -s -X DELETE "$NIMEET_API_BASE/console/projects/$PROJECT_ID/collaborators/$ACCOUNT_ID" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

GET `/console/projects/{projectId}/extensions`

List project extensions

Installed built-in extensions with enablement and run counters (#31).

Authentication: console session (Bearer)

Parameters

Name	Location	Required	Type	Description
`projectId`	path	is	`string`	length 0..128

Response

Status codes	Description / schema
`200`	extension catalogue with this project install state — `object{ extensions, note }`
`400`	Invalid parameter — `Error`
`401`	Missing/invalid credentials — `Error`
`403`	Banned or service not enabled — `Error`

Example call

bash

curl -s -X GET "$NIMEET_API_BASE/console/projects/$PROJECT_ID/extensions" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

DELETE `/console/projects/{projectId}/extensions/{extensionId}`

Uninstall an extension

Authentication: console session (Bearer)

Parameters

Name	Location	Required	Type	Description
`projectId`	path	is	`string`	length 0..128
`extensionId`	path	is	`string`

Response

Status codes	Description / schema
`204`	the install record was removed
`400`	Invalid parameter — `Error`
`401`	Missing/invalid credentials — `Error`
`403`	Banned or service not enabled — `Error`

Example call

bash

curl -s -X DELETE "$NIMEET_API_BASE/console/projects/$PROJECT_ID/extensions/extensionId" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

POST `/console/projects/{projectId}/extensions/{extensionId}/enable`

Enable or disable an installed extension

Authentication: console session (Bearer)

Parameters

Name	Location	Required	Type	Description
`projectId`	path	is	`string`	length 0..128
`extensionId`	path	is	`string`

Response

Status codes	Description / schema
`200`	the project and the updated install record — `object{ project, install }`
`400`	Invalid parameter — `Error`
`401`	Missing/invalid credentials — `Error`
`403`	Banned or service not enabled — `Error`

Example call

bash

curl -s -X POST "$NIMEET_API_BASE/console/projects/$PROJECT_ID/extensions/extensionId/enable" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

POST `/console/projects/{projectId}/extensions/{extensionId}/install`

Install a built-in extension

Config is validated against the manifest schema (#31).

Authentication: console session (Bearer)

Parameters

Name	Location	Required	Type	Description
`projectId`	path	is	`string`	length 0..128
`extensionId`	path	is	`string`

Response

Status codes	Description / schema
`201`	the install record and the extension manifest — `object{ install, extension }`
`400`	Invalid parameter — `Error`
`401`	Missing/invalid credentials — `Error`
`403`	Banned or service not enabled — `Error`

Example call

bash

curl -s -X POST "$NIMEET_API_BASE/console/projects/$PROJECT_ID/extensions/extensionId/install" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

POST `/console/projects/{projectId}/extensions/{extensionId}/run`

Run a built-in extension

Produces a downloadable artefact with a sha256 (#31).

Authentication: console session (Bearer)

Parameters

Name	Location	Required	Type	Description
`projectId`	path	is	`string`	length 0..128
`extensionId`	path	is	`string`

Response

Status codes	Description / schema
`200`	the run artifact (text output, checksum, truncation flag) — `object{ artifact }`
`400`	Invalid parameter — `Error`
`401`	Missing/invalid credentials — `Error`
`403`	Banned or service not enabled — `Error`

Example call

bash

curl -s -X POST "$NIMEET_API_BASE/console/projects/$PROJECT_ID/extensions/extensionId/run" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

POST `/console/projects/{projectId}/keys/rotate`

Rotate customer secret / app certificate

Authentication: console session (Bearer)

Parameters

Name	Location	Required	Type	Description
`projectId`	path	is	`string`	length 0..128

Request body

Field	Type	Required	Description
`scope`	`enum(customer \| certificate \| all)`		default "all"

json

{
  "scope": "all"
}

Response

Status codes	Description / schema
`200`	new key material (secrets returned once) and the resulting rotation state — `object{ customerId, customerSecret, appCertificate, previousCertificateAcceptedUntil, rotation, notice }`

Example call

bash

curl -s -X POST "$NIMEET_API_BASE/console/projects/$PROJECT_ID/keys/rotate" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION" \
  -H "Content-Type: application/json" \
  -d '{"scope":"all"}'

GET `/console/projects/{projectId}/overview`

Dashboard overview

Authentication: console session (Bearer)

Parameters

Name	Location	Required	Type	Description
`projectId`	path	is	`string`	length 0..128

Response

Status codes	Description / schema
`200`	dashboard overview: project, role, permissions, live counts, 24h usage, quality snapshot, service counters, webhook health, billing block and scheduler stats — `object`

Example call

bash

curl -s -X GET "$NIMEET_API_BASE/console/projects/$PROJECT_ID/overview" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

GET `/console/projects/{projectId}/roles`

List built-in and custom roles

Includes the permission catalogue and member assignments (#26).

Authentication: console session (Bearer)

Parameters

Name	Location	Required	Type	Description
`projectId`	path	is	`string`	length 0..128

Response

Status codes	Description / schema
`200`	built-in and custom role views, permission catalogue, role matrix, caller, members and inviteable roles — `object`
`400`	Invalid parameter — `Error`
`401`	Missing/invalid credentials — `Error`
`403`	Banned or service not enabled — `Error`

Example call

bash

curl -s -X GET "$NIMEET_API_BASE/console/projects/$PROJECT_ID/roles" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

POST `/console/projects/{projectId}/roles`

Create a custom role

Named permission set scoped to the project (#26).

Authentication: console session (Bearer)

Parameters

Name	Location	Required	Type	Description
`projectId`	path	is	`string`	length 0..128

Response

Status codes	Description / schema
`201`	the created custom role — `object{ role }`
`400`	Invalid parameter — `Error`
`401`	Missing/invalid credentials — `Error`
`403`	Banned or service not enabled — `Error`

Example call

bash

curl -s -X POST "$NIMEET_API_BASE/console/projects/$PROJECT_ID/roles" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

PATCH `/console/projects/{projectId}/roles/{roleId}`

Update a custom role

Authentication: console session (Bearer)

Parameters

Name	Location	Required	Type	Description
`projectId`	path	is	`string`	length 0..128
`roleId`	path	is	`string`

Response

Status codes	Description / schema
`200`	the updated custom role — `object{ role }`
`400`	Invalid parameter — `Error`
`401`	Missing/invalid credentials — `Error`
`403`	Banned or service not enabled — `Error`

Example call

bash

curl -s -X PATCH "$NIMEET_API_BASE/console/projects/$PROJECT_ID/roles/roleId" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

DELETE `/console/projects/{projectId}/roles/{roleId}`

Delete a custom role

Refused while the role is assigned (#26).

Authentication: console session (Bearer)

Parameters

Name	Location	Required	Type	Description
`projectId`	path	is	`string`	length 0..128
`roleId`	path	is	`string`

Response

Status codes	Description / schema
`200`	the id and name of the deleted role — `object{ deleted }`
`400`	Invalid parameter — `Error`
`401`	Missing/invalid credentials — `Error`
`403`	Banned or service not enabled — `Error`

Example call

bash

curl -s -X DELETE "$NIMEET_API_BASE/console/projects/$PROJECT_ID/roles/roleId" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

POST `/console/projects/{projectId}/services`

Activate/deactivate services

Authentication: console session (Bearer)

Parameters

Name	Location	Required	Type	Description
`projectId`	path	is	`string`	length 0..128

Response

Status codes	Description / schema
`200`	the project with its services switched — `object{ project }`

Example call

bash

curl -s -X POST "$NIMEET_API_BASE/console/projects/$PROJECT_ID/services" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

GET `/console/projects/{projectId}/statements/{period}`

Billing statement for one month (JSON envelope or CSV)

Split out of /overview (ADR-0005 §5.3.3). :period is YYYY-MM or current; ?format=csv returns text/csv. Requires billing:read.

Authentication: console session (Bearer)

Parameters

Name	Location	Required	Type	Description
`projectId`	path	is	`string`	length 0..128
`period`	path	is	`string`	pattern ^(\d{4}-\d{2}\|current)$
`format`	query		`enum(json \| csv)`

Response

Status codes	Description / schema
`200`	the statement envelope (json) or the statement as CSV (text/csv) — `object{ exportedAt, checksumAlgorithm, statement }`

Example call

bash

curl -s -X GET "$NIMEET_API_BASE/console/projects/$PROJECT_ID/statements/period?format=json" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

POST `/console/projects/{projectId}/token`

Token generator

Authentication: console session (Bearer)

Parameters

Name	Location	Required	Type	Description
`projectId`	path	is	`string`	length 0..128

Response

Status codes	Description / schema
`200`	issued token — `TokenIssueResponse`

Example call

bash

curl -s -X POST "$NIMEET_API_BASE/console/projects/$PROJECT_ID/token" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

GET `/console/projects/{projectId}/tokens/verify`

Verify a token from the console

Authentication: console session (Bearer)

Parameters

Name	Location	Required	Type	Description
`projectId`	path	is	`string`	length 0..128
`token`	query	is	`string`

Response

Status codes	Description / schema
`200`	oneOf: `{ valid: true, payload }` or `{ valid: false, error }` — `any`

Example call

bash

curl -s -X GET "$NIMEET_API_BASE/console/projects/$PROJECT_ID/tokens/verify?token=%24RTC_TOKEN" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

GET `/console/projects/{projectId}/webhook`

Get webhook config

Authentication: console session (Bearer)

Parameters

Name	Location	Required	Type	Description
`projectId`	path	is	`string`	length 0..128

Response

Status codes	Description / schema
`200`	webhook endpoint (secret masked) and the subscribable event names — `object{ configured, endpoint, availableEvents }`

Example call

bash

curl -s -X GET "$NIMEET_API_BASE/console/projects/$PROJECT_ID/webhook" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

PUT `/console/projects/{projectId}/webhook`

Configure webhook

Authentication: console session (Bearer)

Parameters

Name	Location	Required	Type	Description
`projectId`	path	is	`string`	length 0..128

Response

Status codes	Description / schema
`200`	the endpoint after configuration; a null endpoint leaves only `configured: false` — `object{ configured, url, events, enabled }`

Example call

bash

curl -s -X PUT "$NIMEET_API_BASE/console/projects/$PROJECT_ID/webhook" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

DELETE `/console/projects/{projectId}/webhook`

Delete webhook config

Authentication: console session (Bearer)

Parameters

Name	Location	Required	Type	Description
`projectId`	path	is	`string`	length 0..128

Response

Status codes	Description / schema
`200`	the endpoint is gone — `object{ configured }`

Example call

bash

curl -s -X DELETE "$NIMEET_API_BASE/console/projects/$PROJECT_ID/webhook" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

GET `/console/projects/{projectId}/webhook/deliveries`

Delivery log

Authentication: console session (Bearer)

Parameters

Name	Location	Required	Type	Description
`projectId`	path	is	`string`	length 0..128
`state`	query		`string`
`limit`	query		`integer`

Response

Status codes	Description / schema
`200`	webhook delivery log — `object{ total, deliveries }`

Example call

bash

curl -s -X GET "$NIMEET_API_BASE/console/projects/$PROJECT_ID/webhook/deliveries?state=running&limit=50" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

POST `/console/projects/{projectId}/webhook/deliveries/{deliveryId}/replay`

Replay a delivery

Authentication: console session (Bearer)

Parameters

Name	Location	Required	Type	Description
`projectId`	path	is	`string`	length 0..128
`deliveryId`	path	is	`string`	length 0..128

Response

Status codes	Description / schema
`200`	the delivery after the replay attempt — `WebhookDelivery`

Example call

bash

curl -s -X POST "$NIMEET_API_BASE/console/projects/$PROJECT_ID/webhook/deliveries/$DELIVERY_ID/replay" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

GET `/console/projects/{projectId}/xla/monthly`

XLA monthly report (one project)

Same monthly aggregates scoped to one project (#32 companion).

Authentication: console session (Bearer)

Parameters

Name	Location	Required	Type	Description
`projectId`	path	is	`string`	length 0..128

Response

Status codes	Description / schema
`200`	the monthly XLA report scoped to one project — `XlaMonthReport`
`400`	Invalid parameter — `Error`
`401`	Missing/invalid credentials — `Error`
`403`	Banned or service not enabled — `Error`

Example call

bash

curl -s -X GET "$NIMEET_API_BASE/console/projects/$PROJECT_ID/xla/monthly" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

GET `/console/security`

Account security overview

MFA state, password policy, SSO config and recent security events (#29).

Authentication: console session (Bearer)

Response

Status codes	Description / schema
`200`	MFA/password/SSO state, the security event feed and the account identity — `object{ mfa, password, sso, events, account }`
`400`	Invalid parameter — `Error`
`401`	Missing/invalid credentials — `Error`
`403`	Banned or service not enabled — `Error`

Example call

bash

curl -s -X GET "$NIMEET_API_BASE/console/security" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

POST `/console/security/mfa/disable`

Disable MFA

Requires a valid TOTP or recovery code (#29).

Authentication: console session (Bearer)

Response

Status codes	Description / schema
`200`	MFA is now disabled for the account — `object{ enabled }`
`400`	Invalid parameter — `Error`
`401`	Missing/invalid credentials — `Error`
`403`	Banned or service not enabled — `Error`

Example call

bash

curl -s -X POST "$NIMEET_API_BASE/console/security/mfa/disable" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

POST `/console/security/mfa/enroll`

Start TOTP enrollment

Returns the base32 secret, otpauth URL and recovery codes (#29).

Authentication: console session (Bearer)

Response

Status codes	Description / schema
`200`	enrollment material: the TOTP secret, its otpauth URL and the recovery codes (each returned once) — `object{ secret, otpauthUrl, recoveryCodes }`
`400`	Invalid parameter — `Error`
`401`	Missing/invalid credentials — `Error`
`403`	Banned or service not enabled — `Error`

Example call

bash

curl -s -X POST "$NIMEET_API_BASE/console/security/mfa/enroll" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

POST `/console/security/mfa/recovery-codes`

Regenerate recovery codes

Authentication: console session (Bearer)

Response

Status codes	Description / schema
`200`	the new recovery code set, returned once — `object{ recoveryCodes }`
`400`	Invalid parameter — `Error`
`401`	Missing/invalid credentials — `Error`
`403`	Banned or service not enabled — `Error`

Example call

bash

curl -s -X POST "$NIMEET_API_BASE/console/security/mfa/recovery-codes" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

POST `/console/security/mfa/verify`

Verify the TOTP code and enable MFA

Authentication: console session (Bearer)

Response

Status codes	Description / schema
`200`	MFA is now enabled for the account — `object{ enabled, recoveryCodesRemaining }`
`400`	Invalid parameter — `Error`
`401`	Missing/invalid credentials — `Error`
`403`	Banned or service not enabled — `Error`

Example call

bash

curl -s -X POST "$NIMEET_API_BASE/console/security/mfa/verify" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

POST `/console/security/password`

Change the console password

Enforces the deployment password policy (#29).

Authentication: console session (Bearer)

Response

Status codes	Description / schema
`200`	the password changed at the given instant — `object{ changed, at, revokedSessions }`
`400`	Invalid parameter — `Error`
`401`	Missing/invalid credentials — `Error`
`403`	Banned or service not enabled — `Error`

Example call

bash

curl -s -X POST "$NIMEET_API_BASE/console/security/password" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

PUT `/console/security/sso`

Configure the OIDC connection

Per organisation (#29).

Authentication: console session (Bearer)

Response

Status codes	Description / schema
`200`	the organisation SSO view after the update (clientSecret is never echoed) — `object{ sso }`
`400`	Invalid parameter — `Error`
`401`	Missing/invalid credentials — `Error`
`403`	Banned or service not enabled — `Error`

Example call

bash

curl -s -X PUT "$NIMEET_API_BASE/console/security/sso" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

POST `/console/security/sso/test`

Run OIDC discovery against the configured issuer

Authentication: console session (Bearer)

Response

Status codes	Description / schema
`200`	oneOf: discovery succeeded (ok: true) or the probe failed (ok: false + error) — `any`
`400`	Invalid parameter — `Error`
`401`	Missing/invalid credentials — `Error`
`403`	Banned or service not enabled — `Error`

Example call

bash

curl -s -X POST "$NIMEET_API_BASE/console/security/sso/test" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

GET `/console/status`

Regional service status (XLA)

Health derived from observed telemetry only (#32).

Authentication: console session (Bearer)

Response

Status codes	Description / schema
`200`	regional service status report plus the projects the caller can see — `object`
`400`	Invalid parameter — `Error`
`401`	Missing/invalid credentials — `Error`
`403`	Banned or service not enabled — `Error`

Example call

bash

curl -s -X GET "$NIMEET_API_BASE/console/status" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

GET `/console/xla/monthly`

XLA monthly report (account-wide)

Monthly quality and telemetry-availability aggregates across the account (#32 companion).

Authentication: console session (Bearer)

Response

Status codes	Description / schema
`200`	the account-wide monthly XLA report — `XlaMonthReport`
`400`	Invalid parameter — `Error`
`401`	Missing/invalid credentials — `Error`
`403`	Banned or service not enabled — `Error`

Example call

bash

curl -s -X GET "$NIMEET_API_BASE/console/xla/monthly" \
  -H "Authorization: Bearer $NIMEET_CONSOLE_SESSION"

Schemas used by this group

BillingOverview — object

Field	Type	Required	Description
`provider`	`object`	is
`plans`	`array<object>`	is
`subscription`	`any`	is
`invoices`	`array<object>`	is
`topUps`	`array<object>`	is
`charges`	`array<object>`	is
`taxProfile`	`any`	is
`totals`	`object{ outstanding, paid, credit, currency }`	is
`generatedAt`	`string`	is	format date-time

BillingPlan — object

Field	Type	Required	Description
`id`	`string`	is
`name`	`string`	is
`pricePerMonth`	`number`	is	monthly list price in major units (see x-money-scale)
`currency`	`string`		ISO-4217 currency code；pattern ^[A-Z]{3}$
`includedMinutes`	`number`	is	metered minutes included before overage
`description`	`string`	is
`features`	`array<string>`	is

BillingProvider — object

Field	Type	Required	Description
`kind`	`enum(sandbox \| live)`	is
`live`	`boolean`	is
`configured`	`boolean`	is
`currency`	`string`	is	ISO-4217 currency code；pattern ^[A-Z]{3}$
`taxRatePercent`	`number`	is
`disclaimer`	`string`	is
`capabilities`	`object{ payInvoice, topUp, subscribe }`	is

BillingTotals — object{ outstanding, paid, credit, currency }

Field	Type	Required	Description
`outstanding`	`number`	is	invoiced but unpaid amount
`paid`	`number`	is	settled amount
`credit`	`number`	is	unconsumed top-up credit
`currency`	`string`	is	ISO-4217 currency code；pattern ^[A-Z]{3}$

Error — object{ code, message, reason, sdkCode, details }

Field	Type	Required	Description
`code`	`string`	is	stable machine code, see errors.json
`message`	`string`	is
`reason`	`string`
`sdkCode`	`integer`		Agora-aligned client error number
`details`	`object`

Invoice — object

Field	Type	Required	Description
`id`	`string`	is
`projectId`	`string \| null`	is
`projectName`	`string`	is
`period`	`string`	is	billing period label, e.g. 2026-10
`currency`	`string`	is	ISO-4217 currency code；pattern ^[A-Z]{3}$
`subtotal`	`number`	is	amount before tax
`tax`	`number`	is	tax amount
`total`	`number`	is	amount due
`status`	`enum(open \| paid \| void)`	is
`issuedAt`	`string`	is	format date-time
`paidAt`	`string \| null`	is	format date-time
`chargeId`	`string \| null`	is
`lines`	`array<object{ type, minutes, amount }>`	is

InvoiceLine — object{ type, minutes, amount }

Field	Type	Required	Description
`type`	`string`	is
`minutes`	`number`	is
`amount`	`number`	is	line amount

PaymentCharge — object

Field	Type	Required	Description
`id`	`string`	is
`kind`	`enum(invoice \| topup)`	is
`referenceId`	`string`	is
`amount`	`number`	is	charged amount
`currency`	`string`	is	ISO-4217 currency code；pattern ^[A-Z]{3}$
`provider`	`enum(sandbox)`	is
`status`	`enum(succeeded)`	is
`simulated`	`boolean`	is
`createdAt`	`string`	is	format date-time

Project — object

Field	Type	Required	Description
`id`	`string`	is
`appId`	`string`	is
`customerId`	`string`	is
`name`	`string`	is
`authMode`	`enum(token \| appid)`	is
`status`	`enum(active \| suspended)`	is
`tokenTtlSeconds`	`integer`	is
`privilegeTtlSeconds`	`integer`	is
`services`	`object{ recording, streaming, analytics }`	is
`quotas`	`object{ recordingConcurrent, streamingConcurrent, maxChannels }`	is
`createdAt`	`string`	is	format date-time
`updatedAt`	`string`	is	format date-time

Quotas — object{ recordingConcurrent, streamingConcurrent, maxChannels }

Field	Type	Required	Description
`recordingConcurrent`	`integer`	is
`streamingConcurrent`	`integer`	is
`maxChannels`	`integer`	is	0 = unlimited

Services — object{ recording, streaming, analytics }

Field	Type	Required
`recording`	`boolean`	is
`streaming`	`boolean`	is
`analytics`	`boolean`	is

Subscription — object{ planId, status, startedAt, currentPeriodEnd, pricePerMonth, includedMinutes }

Field	Type	Required	Description
`planId`	`string`	is
`status`	`enum(active \| cancelled)`	is
`startedAt`	`string`	is	format date-time
`currentPeriodEnd`	`string`	is	format date-time
`pricePerMonth`	`number`	is	subscription price in major units
`includedMinutes`	`number`	is

TaxProfile — object{ legalName, country, taxId, address, updatedAt, status }

Field	Type	Required	Description
`legalName`	`string`	is
`country`	`string`	is	ISO-3166 alpha-2
`taxId`	`string`	is
`address`	`string`	is
`updatedAt`	`string`	is	format date-time
`status`	`enum(unverified)`	is	this deployment never validates the tax id against an authority

TokenIssueResponse — object

Field	Type	Required	Description
`appId`	`string`	is
`channelName`	`string`	is
`rtcToken`	`string`	is
`rtcUid`	`integer`	is	1..2147483647
`role`	`enum(host \| audience)`	is
`privileges`	`array<string>`	is
`controlToken`	`string`		Opaque control-plane token for REST diagnostics/renewal. TokenIssueResult.controlToken is optional; toResult() always sets it.
`mediaRoom`	`string`		SFU room name when the media adapter namespaces by App ID (TokenIssueResult.mediaRoom).
`expireAt`	`string`	is	format date-time
`privilegeExpireAt`	`string`	is	format date-time

TopUp — object

Field	Type	Required	Description
`id`	`string`	is
`amount`	`number`	is	credited amount
`currency`	`string`	is	ISO-4217 currency code；pattern ^[A-Z]{3}$
`status`	`enum(succeeded)`	is
`provider`	`enum(sandbox)`	is
`chargeId`	`string`	is
`note`	`string`	is
`createdAt`	`string`	is	format date-time

WebhookDelivery — object

Field	Type	Required	Description
`id`	`string`	is
`projectId`	`string`	is
`envelope`	`object{ noticeId, productId, eventType, notifyMs, sid, payload }`	is
`url`	`string`	is
`state`	`enum(pending \| delivering \| delivered \| failed \| dropped)`	is
`attempts`	`integer`	is
`maxAttempts`	`integer`	is
`nextAttemptAt`	`string \| null`	is	format date-time
`lastStatusCode`	`integer \| null`	is
`lastError`	`string \| null`	is
`createdAt`	`string`	is	format date-time
`updatedAt`	`string`	is	format date-time

XlaMetricSet — object

Field	Type	Required	Description
`samples`	`integer`	is
`joinAttempts`	`integer`	is
`joinSuccessRate`	`number \| null`	is	joinSuccess / joinAttempt samples; null when there is no sample
`joinWithin5sRate`	`number \| null`	is
`videoFreezeRate`	`number \| null`	is
`audioFreezeRate`	`number \| null`	is
`networkDelayMs`	`number \| null`	is
`availability`	`number \| null`	is	telemetry availability: observed 5-minute buckets / buckets in the month
`observedBuckets`	`integer`	is
`expectedBuckets`	`integer`	is

XlaMonthReport — object

Field	Type	Required	Description
`month`	`string`	is	YYYY-MM
`from`	`string`	is	format date-time
`to`	`string`	is	format date-time
`scope`	`object{ kind, projectId, projectName }`	is
`metrics`	`object`	is
`projects`	`array<any>`	is
`insufficient`	`boolean`	is
`reason`	`string \| null`	is
`note`	`string`	is	how each metric is computed (no modelled percentages)
`generatedAt`	`string`	is	format date-time

XlaProjectRow — any

No field declarations.

Console BFF

Group overview

Operation details

POST /console/auth/login

POST /console/auth/logout

POST /console/auth/mfa

GET /console/auth/sso/authorize

POST /console/auth/sso/exchange

GET /console/auth/sso/status

GET /console/billing

GET /console/billing/invoices/{invoiceId}/csv

POST /console/billing/invoices/{invoiceId}/pay

GET /console/billing/plans

POST /console/billing/subscriptions

DELETE /console/billing/subscriptions

PUT /console/billing/tax-profile

POST /console/billing/topups

GET /console/extensions

GET /console/me

GET /console/notifications

GET /console/notifications/channels

GET /console/notifications/inbox

POST /console/notifications/inbox/read-all

POST /console/notifications/inbox/{messageId}/read

PUT /console/notifications/preferences

POST /console/notifications/test

GET /console/organisation

PATCH /console/organisation

POST /console/organisation/members

DELETE /console/organisation/members/{accountId}

POST /console/organisation/projects/{projectId}/transfer

GET /console/projects

POST /console/projects

GET /console/projects/cap

GET /console/projects/{projectId}

PATCH /console/projects/{projectId}

GET /console/projects/{projectId}/alerts

POST /console/projects/{projectId}/alerts

POST /console/projects/{projectId}/alerts/evaluate

PATCH /console/projects/{projectId}/alerts/{ruleId}

DELETE /console/projects/{projectId}/alerts/{ruleId}

POST /console/projects/{projectId}/alerts/{ruleId}/evaluate

GET /console/projects/{projectId}/audit

GET /console/projects/{projectId}/certificates

POST /console/projects/{projectId}/certificates

DELETE /console/projects/{projectId}/certificates/{certificateId}

POST /console/projects/{projectId}/certificates/{certificateId}/disable

POST /console/projects/{projectId}/certificates/{certificateId}/promote

GET /console/projects/{projectId}/collaborators

POST /console/projects/{projectId}/collaborators

PATCH /console/projects/{projectId}/collaborators/{accountId}

DELETE /console/projects/{projectId}/collaborators/{accountId}

GET /console/projects/{projectId}/extensions

DELETE /console/projects/{projectId}/extensions/{extensionId}

POST /console/projects/{projectId}/extensions/{extensionId}/enable

POST /console/projects/{projectId}/extensions/{extensionId}/install

POST /console/projects/{projectId}/extensions/{extensionId}/run

POST /console/projects/{projectId}/keys/rotate

GET /console/projects/{projectId}/overview

GET /console/projects/{projectId}/roles

POST /console/projects/{projectId}/roles

PATCH /console/projects/{projectId}/roles/{roleId}

DELETE /console/projects/{projectId}/roles/{roleId}

POST /console/projects/{projectId}/services

GET /console/projects/{projectId}/statements/{period}

POST /console/projects/{projectId}/token

GET /console/projects/{projectId}/tokens/verify

GET /console/projects/{projectId}/webhook

PUT /console/projects/{projectId}/webhook

DELETE /console/projects/{projectId}/webhook

GET /console/projects/{projectId}/webhook/deliveries

POST /console/projects/{projectId}/webhook/deliveries/{deliveryId}/replay

GET /console/projects/{projectId}/xla/monthly

GET /console/security

POST /console/security/mfa/disable

POST /console/security/mfa/enroll

POST /console/security/mfa/recovery-codes

POST /console/security/mfa/verify

POST /console/security/password

PUT /console/security/sso

POST `/console/auth/login`

POST `/console/auth/logout`

POST `/console/auth/mfa`

GET `/console/auth/sso/authorize`

POST `/console/auth/sso/exchange`

GET `/console/auth/sso/status`

GET `/console/billing`

GET `/console/billing/invoices/{invoiceId}/csv`

POST `/console/billing/invoices/{invoiceId}/pay`

GET `/console/billing/plans`

POST `/console/billing/subscriptions`

DELETE `/console/billing/subscriptions`

PUT `/console/billing/tax-profile`

POST `/console/billing/topups`

GET `/console/extensions`

GET `/console/me`

GET `/console/notifications`

GET `/console/notifications/channels`

GET `/console/notifications/inbox`

POST `/console/notifications/inbox/read-all`

POST `/console/notifications/inbox/{messageId}/read`

PUT `/console/notifications/preferences`

POST `/console/notifications/test`

GET `/console/organisation`

PATCH `/console/organisation`

POST `/console/organisation/members`

DELETE `/console/organisation/members/{accountId}`

POST `/console/organisation/projects/{projectId}/transfer`

GET `/console/projects`

POST `/console/projects`

GET `/console/projects/cap`

GET `/console/projects/{projectId}`

PATCH `/console/projects/{projectId}`

GET `/console/projects/{projectId}/alerts`

POST `/console/projects/{projectId}/alerts`

POST `/console/projects/{projectId}/alerts/evaluate`

PATCH `/console/projects/{projectId}/alerts/{ruleId}`

DELETE `/console/projects/{projectId}/alerts/{ruleId}`

POST `/console/projects/{projectId}/alerts/{ruleId}/evaluate`

GET `/console/projects/{projectId}/audit`

GET `/console/projects/{projectId}/certificates`

POST `/console/projects/{projectId}/certificates`

DELETE `/console/projects/{projectId}/certificates/{certificateId}`

POST `/console/projects/{projectId}/certificates/{certificateId}/disable`

POST `/console/projects/{projectId}/certificates/{certificateId}/promote`

GET `/console/projects/{projectId}/collaborators`

POST `/console/projects/{projectId}/collaborators`

PATCH `/console/projects/{projectId}/collaborators/{accountId}`

DELETE `/console/projects/{projectId}/collaborators/{accountId}`

GET `/console/projects/{projectId}/extensions`

DELETE `/console/projects/{projectId}/extensions/{extensionId}`

POST `/console/projects/{projectId}/extensions/{extensionId}/enable`

POST `/console/projects/{projectId}/extensions/{extensionId}/install`

POST `/console/projects/{projectId}/extensions/{extensionId}/run`

POST `/console/projects/{projectId}/keys/rotate`

GET `/console/projects/{projectId}/overview`

GET `/console/projects/{projectId}/roles`

POST `/console/projects/{projectId}/roles`

PATCH `/console/projects/{projectId}/roles/{roleId}`

DELETE `/console/projects/{projectId}/roles/{roleId}`

POST `/console/projects/{projectId}/services`

GET `/console/projects/{projectId}/statements/{period}`

POST `/console/projects/{projectId}/token`

GET `/console/projects/{projectId}/tokens/verify`

GET `/console/projects/{projectId}/webhook`

PUT `/console/projects/{projectId}/webhook`

DELETE `/console/projects/{projectId}/webhook`

GET `/console/projects/{projectId}/webhook/deliveries`

POST `/console/projects/{projectId}/webhook/deliveries/{deliveryId}/replay`

GET `/console/projects/{projectId}/xla/monthly`

GET `/console/security`

POST `/console/security/mfa/disable`

POST `/console/security/mfa/enroll`

POST `/console/security/mfa/recovery-codes`

POST `/console/security/mfa/verify`

POST `/console/security/password`

PUT `/console/security/sso`

POST `/console/security/sso/test`

GET `/console/status`

GET `/console/xla/monthly`