Platform Administration

This page is for platform administrators configuring OpenAPI. External clients do not need access to /admin/openapi/* management endpoints.

1. Register an endpoint

Open Endpoint Management, create an endpoint, and select the route from the discovery results.

The system discovers only routes that meet all of these conditions:

• The controller is located in the project API controller directory or the plugin’s built-in OpenAPI controller directory.
• The method is marked with #[OpenApiEndpoint].
• The path starts with /openapi/.
• The path is not under /openapi/auth/*.

The current code discovers:

Method	Path	Name
GET	/openapi/profile	Retrieve the current OpenAPI caller information
GET	/openapi/v1/doudian/order/union-settlement-orders	Douyin Selected Alliance orders

New endpoints enable rate limiting by default with a QPS limit of 10 and a 30-day quota of 100000. Adjust these values for the expected workload and ensure the endpoint status is enabled.

2. Create an application

Open Application Management, select Add Application, and enter a name, status, and notes.

After creation, the platform displays:

• app_key
• app_secret

3. Grant endpoints

Open Endpoint Management from the application’s action menu:

1. Search by endpoint name, method, or path.
2. Select the endpoints the application may call.
3. Save the grant.

Only enabled endpoints appear in the grant list. Authorization uses an exact match on the normalized HTTP method + path.

4. Integration acceptance

Ask the client to follow the quickstart, obtain tokens, and call /openapi/profile. At the same time, verify that:

• The application is enabled.
• The Profile endpoint is registered and enabled.
• The application is granted the Profile endpoint.
• The request returns 200, and its X-Request-Id can be found in the audit log.
• Rate-limit headers match the endpoint configuration.

5. Credential and application lifecycle

• Resetting the Secret immediately revokes all active tokens for the application.
• Disabling an application immediately revokes all active tokens for it.
• Deleting an application removes its grants and token records.
• An administrator can also revoke Refresh Tokens from Token Management for the application.

6. Audit logs

Audit Logs show results from authentication, publication, authorization, rate-limit, and business stages. Use the X-Request-Id supplied by the client as the primary lookup key during troubleshooting.

Logs must not contain plaintext Secrets, full tokens, Authorization headers, raw request bodies, or complete response bodies.

Management API boundary

/admin/openapi/* uses MineAdmin administrator authentication and menu permissions. It does not accept OpenAPI Access Tokens and must not be published as an external client contract.