API Reference
  1. Anka Secure Admin API
  2. Platform Administration - Tenants

Create tenant with administrator

post
https://staging.ankatech.co/api/v3/admin/platform/tenants/provision

Creates a new tenant organization and its first administrator account in a single atomic operation. This ensures the tenant is immediately accessible after creation. The operation includes:

  • Tenant creation with unique name validation
  • Post-quantum cryptography keystore generation
  • Administrator account setup with secure password hashing
  • Automatic role assignment (ADMIN role)
  • Full audit trail creation

Authorization: Requires platform.bootstrap scope (available to Super Admins and Core-API S2S)

Recent Requests
Log in to see full request history
TimeStatusUser Agent
Retrieving recent requests…
LoadingLoading…
Body Params

Complete tenant provisioning details: organization information, administrator credentials, and optional policy configuration.

Request payload for atomic tenant provisioning. Creates both the tenant organization and its first administrator account in a single operation, with optional policy configuration.

Two provisioning modes:
• Secure mode (recommended): Set requirePasswordChange=true, omit adminPassword. Admin receives activation link and sets their own password.
• Quick mode (testing): Set requirePasswordChange=false, include adminPassword. Admin can login immediately.

string
required
length between 1 and 200
^\S+( \S+)*$

Unique tenant organization name. This will be the primary identifier for the tenant. Must be unique across the entire platform (case-insensitive). Must not begin or end with whitespace.

string
enum
^(STANDARD|SIMPLE)$
Defaults to STANDARD

OPTIONAL — Tenant type discriminator. Determines which Cryptographic Control Plane entities the tenant administrators will see in the admin console.

Allowed values:
• STANDARD (default when omitted) — full Cryptographic Control Plane (Applications, Cryptographic Actors, Exchange Contexts, Capability Grants, Constraint Policies, Counterparty Types, Key Inventory).
• SIMPLE — orchestrator-driven restricted surface (Applications, Internal Use Cases, Key Inventory, Audit Log, Settings). The other 5 Control Plane pages are hidden and server-managed by the Internal Crypto Use Case orchestrator.

RAPIDAPI is NOT accepted on this endpoint — it is set server-side by the JIT bootstrap path on first marketplace contact.

Immutability: Once set at provisioning, the tenant type cannot be changed. A customer that outgrows SIMPLE must provision a new STANDARD tenant and migrate workload (see ankasecure-public-docs/docs/internal/docs/02-concepts/deployment-organization-model/tenant-types.md §4).

Server default: When omitted, STANDARD is applied (architect condition C-4 / NFR-7 backward compatibility for existing programmatic provisioning scripts). The admin-console Provision Tenant wizard requires an explicit radio selection at the UX layer (D5).

Allowed:
string
required
length between 0 and 320

Email address for the tenant's first administrator. This will be used as the login identifier. Must be a valid email address and unique within the tenant.

string
length between 0 and 255

Human-readable display name for the administrator account. If not provided, the email address will be used as the display name.

password
length between 12 and 128
^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[@$!%*?&#]).{12,}$

OPTIONAL - Initial password for the administrator account.

When to include:
• requirePasswordChange=false (quick provisioning): REQUIRED - Admin can login immediately with this password.
• requirePasswordChange=true (secure provisioning - DEFAULT): OPTIONAL - If omitted, a secure random password is generated internally. The admin will set their own password during account activation.

Password requirements (if provided):
• Minimum 12 characters (OWASP ASVS 2.1.1 compliant)
• At least one uppercase letter (A-Z)
• At least one lowercase letter (a-z)
• At least one digit (0-9)
• At least one special character (@$!%*?&#)
• Maximum 128 characters

Security Note: The password is securely hashed using PBKDF2 before storage. For production use, it is recommended to omit this field and use requirePasswordChange=true, following industry best practices (AWS Cognito, Azure AD, Auth0 pattern).

string
enum
Defaults to DEFAULT

Algorithm policy template name to apply to the tenant. Defaults to 'DEFAULT' when omitted. Available options: DEFAULT, CLASSICAL, PQC, NIST, ENISA, ETSI, BSI_HYBRID_ENFORCED, NIST_APPROVED. Ignored when the deployment is locked — the deployment policy applies platform-wide and the tenant inherits it implicitly (no tenant_*_policies row is written).

string
enum
Defaults to DEFAULT

Key lifecycle policy template name to apply to the tenant. Defaults to 'DEFAULT' when omitted. Available options: DEFAULT, STRICT, RELAXED. Ignored when the deployment is locked — the deployment policy applies platform-wide and the tenant inherits it implicitly (no tenant_*_policies row is written).

Allowed:
string
enum
Defaults to DEFAULT

Algorithm rotation policy template name to apply to the tenant. Defaults to 'DEFAULT' when omitted. Available options: DEFAULT, NO_PQC_TO_CLASSICAL, NO_DOWNGRADE. Ignored when the deployment is locked — the deployment policy applies platform-wide and the tenant inherits it implicitly (no tenant_*_policies row is written).

Allowed:
boolean | null
Defaults to false

Whether the tenant admin may modify the tenant's algorithm/rotation/lifecycle policies after provisioning. Defaults to {@code false} (platform admin assigns templates; tenant admin has read-only view). Ignored when the deployment is locked — tenant-level overrides are not applicable in locked deployments.

boolean
Defaults to true

Whether to require the administrator to change their password on first login. This is a security best practice for API-provisioned accounts:

• true (default - RECOMMENDED): The administrator must activate their account and set a new password before accessing any protected resources. The response will include an activation token that is delivered to the administrator via email as a deep-link to the Admin Console activation page (e.g., https://console.ankatech.co/activate?token=...). This follows OWASP ASVS 2.1.1 and industry best practices (AWS, Azure, Auth0 pattern).
• false: The password is permanent and can be used immediately for login. Use this for automated integrations, testing, or bulk provisioning where password rotation is handled externally.
• null or not specified: Uses server default (true).

Security Note: When enabled (true - default), the provisioning response will include:

  • activationToken: A single-use JWT token (expires in 24 hours)
  • activationUrl: The endpoint to activate the account
  • Administrator must use token to set their own password
Headers
string
enum
Defaults to application/json

Generated from available response content types

Allowed:
Responses

Updated 11 days ago

Did this page help you?
Language
Credentials
Bearer
JWT
URL
LoadingLoading…
Response
Click Try It! to start a request and see the response here! Or choose an example:
application/json
application/problem+json

Updated 11 days ago

Did this page help you?