Budgets
Hard and soft budget caps at the global, tenant, and API-key level.
Introduction
The Admin API is the control plane for a running DVARA deployment. Every
A2A Agents
A2A Agents
A2A Approvals
A2A Approvals
A2A Policies
A2A Policies
API Keys
API Keys
Audit
Audit
Budgets
Budgets
Check MCP server connectivity
Check MCP server connectivity
Config
Config
Register an A2A peer agent
Register an A2A peer agent
Create an A2A policy
Create an A2A policy
Create an API key
Issues a new API key scoped to this tenant. The plaintext key is
Create a budget cap
Create a budget cap
Create a provider credential
Stores a provider API key encrypted at rest with AES-256-GCM. The
Register an MCP server
Register an MCP server
Create a policy
Creates a policy in `DRAFT` status. Use the status endpoint to move
Create a pricing entry
Create a pricing entry
Create a route
Create a route
Create a tenant
Create a tenant
Create a virtual MCP server
A named, tenant-scoped bundle composing a curated, namespaced subset of tools across several member MCP servers. A native client selects it with the `X-DVARA-Virtual-Server: <name>` header on `/mcp`; `tools/list` returns the allow-listed union and `tools/call` is allow-list-enforced.
Create a webhook
Every delivery carries a `X-Gateway-Signature: sha256=<hex>` header
Credentials
Credentials
Delete an A2A agent
Delete an A2A agent
Delete an A2A policy
Delete an A2A policy
Delete a budget
Delete a budget
Delete a credential
Delete a credential
Delete an MCP server
Delete an MCP server
Delete a policy
Delete a policy
Delete a pricing entry
Delete a pricing entry
Delete a route
Delete a route
Delete a tenant
Delete a tenant
Delete a virtual MCP server
Delete a virtual MCP server
Delete a webhook
Delete a webhook
Validate an A2A policy DSL
Validate a candidate DSL (YAML syntax + rules array) without persisting.
Dry-run a policy
Validates policy YAML and evaluates it against a sample request without persisting anything.
Export audit events as CSV
Export audit events as CSV
Export audit events as JSON
Export audit events as JSON
Export full gateway config
Returns a JSON snapshot of every configurable resource — tenants,
Get an A2A agent
Get an A2A agent
Pending A2A approval count
Pending A2A approval count
Get an A2A policy
Get an A2A policy
Current-period spend for a budget
Current-period spend for a budget
Get a budget
Get a budget
Get a policy
Get a policy
Get a route
Get a route
Get a tenant
Get a tenant
Get a virtual MCP server
Get a virtual MCP server
Import gateway config
Applies a configuration file. `mode=merge` upserts resources and
List A2A agents
List A2A agents
A2A approval decision history
A2A approval decision history
List A2A policies
List A2A policies
List API keys for a tenant
List API keys for a tenant
List audit events
Returns audit events in reverse chronological order. Every event is
List budget caps
List budget caps
List credentials
List credentials
List MCP servers
List MCP servers
List pending A2A hop approvals
Cross-tenant; owner / policy-admin only.
List policies
List policies
List pricing entries
List pricing entries
Route version history
Returns the last 10 versions of the route.
List routes
List routes
List tenants
List tenants
List virtual MCP servers
List virtual MCP servers
List webhooks
List webhooks
MCP Servers
MCP Servers
Policies
Policies
Pricing
Pricing
Promote a shadow policy to active
Transitions a `SHADOW` policy to `ACTIVE`, runs conflict detection, and cleans up shadow event data.
Resolve a pending A2A approval
Approve or deny a paused hop. The decision is written to the durable `a2a_approvals` store and releases the paused hop on its a2a-proxy pod within one poll interval. Emits `A2A_APPROVAL_RESOLVED` on the A2A own-chain.
Revoke an API key
Marks the key as `REVOKED`. The cached entry is evicted on every
Revoke a credential
Marks the credential as `REVOKED`. Subsequent lookups skip it and fall through to the next step in the resolution chain.
Rollback a route
Restores the route to a previous version. Creates a new version with the restored configuration.
Rotate a credential
Replaces the stored API key with a new value, evicts the cached
Routes
Routes
Fetch and cache the tool catalog
Calls the MCP server's `tools/list` endpoint and caches the result. Required before approval-gate rules can match on tool names.
Tenants
Tenants
Send a synthetic test event
Sends a synthetic `WEBHOOK_TEST` event to the webhook URL and returns the delivery result.
Update an A2A agent
Update an A2A agent
Change A2A policy status
Transition a policy between DRAFT, ACTIVE, and ARCHIVED.
Update an A2A policy
Update an A2A policy
Update a budget
Update a budget
Update an MCP server
Update an MCP server
Change policy status
Transitions the policy between `DRAFT`, `ACTIVE`, `SHADOW`, and
Update a policy
Update a policy
Update a pricing entry
Update a pricing entry
Update a route
Updates the route and increments its version. Propagates to every gateway instance within seconds — no restart required.
Update a tenant
Updates a tenant's name, status, region, or metadata. Metadata is
Update a virtual MCP server
Update a virtual MCP server
Update a webhook
Update a webhook
Webhooks
Webhooks