Admin monitoring

Two read surfaces expose the write-only alert sinks that were previously only visible in tests.

Team admin alerts

Team owners can list unresolved operational alerts for their team. These carry diagnostic payloads — they are JWT-only and cannot be read by a mio_sk_ API key.

GET /api/v1/teams/{team_id}/admin-alerts

Auth: team-owner JWT session. API keys are rejected. Query parameters:

Parameter	Default	Notes
`filter[status]`	`open`	Only `open` is accepted in v1. Any other value returns `422`.
`page[size]`	`50`	1–100.
`page[after]`	—	Cursor from the previous page’s `links.next`.

Response shape:

{
  "data": [
    {
      "id": "0197...",
      "type": "admin_alerts",
      "attributes": {
        "source_module": "checkout",
        "alert_type": "stripe_sync_drift",
        "hub_id": "hub_abc",
        "payload": { "order_id": "ord_123", "gap_seconds": 420 },
        "created_at": "2026-06-09T14:00:00Z",
        "resolved_at": null,
        "resolved_by": null
      }
    }
  ],
  "meta": { "has_more": false }
}

Results are ordered most-recent first. The list returns unresolved alerts only.

Platform admin alerts

Platform admins can list unresolved cross-tenant alerts (abuse signals, infrastructure events).

GET /api/v1/admin/platform-alerts

Auth: platform_admin role required. Query parameters:

Parameter	Default	Notes
`filter[status]`	`open`	Only `open` is accepted in v1.
`filter[severity]`	—	One of `info`, `warning`, or `critical`. Omit to return all severities. Any other value returns `422`.
`page[size]`	`50`	1–100.
`page[after]`	—	Pagination cursor.

Response shape:

{
  "data": [
    {
      "id": "0197...",
      "type": "platform_alerts",
      "attributes": {
        "alert_type": "rate_limit_surge",
        "severity": "warning",
        "payload": { "ip": "198.51.100.1", "route": "/api/v1/hub/{hub_id}/checkout" },
        "created_at": "2026-06-09T15:00:00Z",
        "resolved_at": null,
        "resolved_by": null
      }
    }
  ],
  "meta": { "has_more": false }
}

Results are ordered most-recent first.

Role permissions

Platform admins can assign and remove permissions from roles without rebuilding the role.

POST   /api/v1/roles/{role_id}/permissions
DELETE /api/v1/roles/{role_id}/permissions/{permission_slug}

Auth: JWT session. API keys are rejected.

Assign a permission

curl -X POST "$MIO_BASE_URL/api/v1/roles/$ROLE_ID/permissions" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/vnd.api+json" \
  -d '{"slug": "content:read"}'

Returns 201 with the updated role resource. Re-assigning a permission the role already holds is a no-op that still returns 201.

Remove a permission

curl -X DELETE "$MIO_BASE_URL/api/v1/roles/$ROLE_ID/permissions/content:read" \
  -H "Authorization: Bearer $TOKEN"

Returns 204 No Content. Removing a permission the role does not hold is a no-op that still returns 204. Returns 404 if the role itself does not exist.

Start here

Core concepts

Guides

API reference

Team admin alerts

Platform admin alerts

Role permissions

Assign a permission

Remove a permission

​Team admin alerts

​Platform admin alerts

​Role permissions

​Assign a permission

​Remove a permission

Team admin alerts

Platform admin alerts

Role permissions

Assign a permission

Remove a permission