Admin API

Every endpoint under /_/api/admin/*, grouped by purpose.

The admin UI and GitOps integrations talk to this surface. All mutation routes require a session cookie (issued by POST /_/api/admin/login). Sessions are IP-bound — a token is rejected from a different source IP — and default to a 4-hour TTL (DGP_SESSION_TTL_HOURS).

Endpoints documented here are admin only. The S3-compatible API lives under / and is documented by AWS themselves.

Authentication and session#

Configuration — three scopes#

All three scopes route through the same apply_config_transition path, so hot-reload semantics are identical no matter which level you use.

Field-level (legacy GUI forms)#

Section-level#

:name ∈ admission / access / storage / advanced. Unknown names → 404.

Merge-patch semantics: keys missing from the body are preserved; null deletes; objects merge recursively. Secrets round-trip (GET → edit → PUT never clears credentials).

Document-level (GitOps)#

Full-document apply returns {applied, persisted, requires_restart, warnings, persisted_path}. Persist failure returns HTTP 500, not 200+warning — GitOps pipelines can't mistake a half-applied state for a clean success.

CLI wrapper:

export DGP_BOOTSTRAP_PASSWORD=...
deltaglider_proxy config apply deltaglider_proxy.yaml --server https://s3.acme.example

Backends#

IAM (gated by iam_mode)#

POST/PUT/DELETE return 403 { "error": "iam_declarative" } when access.iam_mode: declarative. Reads stay open for diagnostics.

External auth (OAuth / OIDC)#

OAuth redirect flow (public, no session)#

Full Backup#

Response on POST carries per-resource counters: {users_created, users_skipped, groups_created, groups_skipped, memberships_created, external_identities_created, external_identities_skipped}.

external_identities are remapped through the imported user + provider ID maps. Orphaned records (user or provider didn't import) are dropped with a WARN log.

Legacy JSON-only import path is still supported for pre-v0.8.4 scripts.

Diagnostics and usage#

Object operations (browse panel)#

Server-side helpers behind the embedded S3 browser's bulk actions.

Jobs — one surface for everything background#

Replication rules, lifecycle rules, and one-off maintenance jobs (re-encrypt, bucket migration) share a single read+action API. Job ids are namespaced: replication:<rule>, lifecycle:<rule>, maintenance:<n>. Rules stay YAML-authoritative under storage.replication.rules[] / storage.lifecycle.rules[]; maintenance one-offs are DB-born. See replication.md and lifecycle.md for rule shapes and guardrails.

Actions outside a kind's capability matrix return 405 with the supported list. Lifecycle preview is intentionally read-only; scheduler and run-now executions persist history/failure rows in the config DB and use per-rule leases so instances sharing the DB never double-execute.

Write gate: while a re-encrypt or migrate job is active, S3 writes to that bucket return 503 SlowDown (SDKs back off and retry); reads pass untouched. The gate engages at job creation and lifts when the job finishes (for migrations, the moment the bucket flips to the new backend).

Resource limits (env vars)#

Keyboard shortcuts (app-wide)#

Reachable via ? anywhere in the UI (when focus is not in an input). ⌘ is Ctrl on non-Apple platforms.

Operational endpoints (no admin prefix)#

Unauthenticated — needed for load-balancer probes and Prometheus:

/_/ready probes the backend with a bounded, retried ListBuckets so a brief provider latency spike doesn't flip readiness to a paging 503: it only reports not-ready if every attempt fails. Tune with DGP_READY_TIMEOUT_SECS (per-attempt, default 3) and DGP_READY_RETRIES (extra attempts, default 2) — raise the timeout for a storage provider with a long tail latency, raise retries to ride out short blips.

Session-protected (reveals per-bucket sizes):