Keys and tenants

Tenants

A tenant is the unit of isolation. Tokens, the vault session, the cache and the rate limits are all keyed by tenant, and a key belongs to exactly one tenant. Suspending a tenant stops all of its keys at once.

curl -fsS "$SALUS_BASE_URL/admin/v1/tenants" \
  -H "Authorization: Bearer $SALUS_ADMIN_KEY" -H 'content-type: application/json' \
  -d '{"id":"customer-care","display_name":"Customer care","rate_per_minute":120,"burst":20,"max_concurrency":4,"reason":"pilot team"}'

Defaults are 30 requests per minute, a burst of 5 and 2 concurrent requests per key.

Keys

curl -fsS "$SALUS_BASE_URL/admin/v1/api-keys" \
  -H "Authorization: Bearer $SALUS_ADMIN_KEY" -H 'content-type: application/json' \
  -d '{"tenant_id":"customer-care","name":"assistant-prod","role":"api_client","expires_at":"2027-10-01T00:00:00Z","allowed_routes":["detect_text","detect_file","recover_text"],"allowed_cidrs":["10.40.0.0/16"],"reason":"production assistant"}'

The response contains the key itself once, as salus_sk_<selector>.<secret>. Only the selector and a hash of the secret are stored. The display prefix salus_sk_AbCdEfGh… identifies the key afterwards.

Role	Can
platform_admin	Manage all tenants and keys, including other administrators
tenant_admin	Manage api_client keys in its own tenant
api_client	Call the data endpoints its allowed_routes permit

Route permissions are detect_text, detect_file, recover_text and litellm_guardrail. Administrative keys cannot call data endpoints; a key that only protects should not be given recover_text.

Lifecycle. expires_at must be within 365 days. POST /admin/v1/api-keys/{id}/rotate issues a replacement and keeps the old key valid for a grace period (24 hours by default, up to 7 days). POST …/revoke stops a key immediately. PATCH can disable and re-enable a key, change its routes or its source allow-list. Every call needs a reason, and each change becomes an immutable row in the management event table.

Rate limits

Enforced at the gateway with Redis: a token bucket per key from the tenant’s rate_per_minute and burst, and a concurrency cap per key from max_concurrency. Over the limit, the response is 429 RATE_LIMITED with Retry-After. Unauthenticated calls are limited per source address, and an address that fails authentication ten times in five minutes is blocked for fifteen minutes.

Bootstrap

A fresh installation has no keys. The first platform administrator key is created once with the bootstrap secret you generated at install:

curl -fsS "$SALUS_BASE_URL/admin/v1/bootstrap" \
  -H "Authorization: Bearer $SALUS_BOOTSTRAP_KEY" -H 'content-type: application/json' \
  -d '{"name":"platform-admin","expires_at":"2027-01-01T00:00:00Z","reason":"initial setup"}'

The management console has its own one-time bootstrap for the first human account; see Management console.