| Method | Path | Summary | Auth |
|---|---|---|---|
| GET | /v1/admin/users | List tenant users in the customer control plane | Session |
| POST | /v1/admin/users | Create an isolated tenant user | Session |
| PATCH | /v1/admin/users | Atomically update tenant users | Session |
| GET | /v1/admin/users/{id} | Get one tenant user | Session |
| PATCH | /v1/admin/users/{id} | Update tenant user profile, status, and role | Session |
| GET | /v1/admin/users/{id}/login-security | Read the selected tenant user's login security policy | Session |
| PUT | /v1/admin/users/{id}/login-security | Replace a tenant user's login security policy | Session |
| GET | /v1/admin/users/{id}/secondary-verification | Read the selected tenant user's secondary identity verification request | Session |
| PUT | /v1/admin/users/{id}/secondary-verification | Replace a tenant user's secondary identity verification request | Session |
| GET | /v1/admin/users/{user_id}/api-keys | List a tenant user's API key metadata | Session |
| POST | /v1/admin/users/{user_id}/api-keys | Create pending API key metadata for a tenant user | Session |
| POST | /v1/admin/users/{user_id}/api-keys/{key_id}/revoke | Revoke a tenant user's API key | Session |
Contract file：api/openapi/v1/control.yaml