Admin API

ngz_iot_admin is the nginx HTTP control-plane boundary. It serves bounded daemon snapshots and metrics, then adds authenticated, audited command lifecycle endpoints in the Enterprise profile.

Read-only endpoints

location = /admin/v1/broker {
  iot_admin_snapshot /var/lib/nginz-iot/observe/iotd.snapshot;
  iot_admin_view broker;
}

location = /metrics {
  iot_admin_prometheus /var/lib/nginz-iot/observe/iotd.prom;
}

Use iot_admin_operating_profile tracked to require the same runtime profile as the broker and snapshot. Stale or mismatched output fails closed.

Protected operations

Enterprise locations can require iot_admin_require_auth on. Only enable iot_admin_trust_principal_headers on behind a verified identity proxy boundary; otherwise use the module’s verified identity input.

Controlled writes follow a durable lifecycle: admitted, applied or rejected, and audited with actor, target, correlation, generation, and writer term. Release enablement depends on the Enterprise installed two-node evidence gate.

Operator console pairing

Every lane image serves the static console from the same nginx HTTP boundary as these routes. Read-only views consume /live, /ready, dashboard, collection, and metrics endpoints.

Enterprise mutation locations additionally require a verified principal, CSRF, generation, capability, and audit gates. HTTP 2xx means accepted; the console waits for reconciled evidence. Lower lanes keep controlled_writes_requested = false, so drain, preflight, and support-bundle POSTs fail closed.

Do not expose admin listeners to the public device network. See Operator console.