# Customer Portal

An Institflow account that owns a tenant managing its licence view, install command, registry credentials and relay statement — read-only except for minting the same install token/registry credential a console operator could. Cloud/control-plane only: answers 404 on a self-hosted install.

Generated from `apps/api/openapi.json`. HTML version: https://docs.institflow.com/en/reference/portal

8 operations.

## GET /api/v1/portal/institute

The owned institute: licence state/expiry, install state, subscription plan, and the relay balance. Read-only.

- Operation id: `PortalInstituteController_getInstitute_v1`
- Permission: —
- Auth: credential required
- `Idempotency-Key`: not required

### Responses

**200** — The institute.

| Property | Type | Required | Constraints |
| --- | --- | --- | --- |
| `tenant` | object | yes |  |
| `license` | object \| null | yes |  |
| `address` | string \| null | yes |  |
| `install` | object \| null | yes |  |
| `subscription` | object \| null | yes |  |
| `relay` | object | yes |  |

Every other status answers with the shared `ErrorEnvelope` — see
https://docs.institflow.com/md/en/error-codes.md

### Example request

```bash
curl -X GET "https://your-institute.example/api/v1/portal/institute" \
  -H "Authorization: Bearer $INSTITFLOW_API_KEY"
```

## POST /api/v1/portal/institute/install-command

Generate a one-time install command for the owned institute. The raw token is returned exactly once.

- Operation id: `PortalInstituteController_createInstallCommand_v1`
- Permission: —
- Auth: credential required
- `Idempotency-Key`: not required

### Request body

| Property | Type | Required | Constraints |
| --- | --- | --- | --- |
| `label` | string | no | 1–200 chars |

```json
{
  "label": "string"
}
```

### Responses

**201** — The new token and its ready-to-paste install command.

| Property | Type | Required | Constraints |
| --- | --- | --- | --- |
| `token` | object | yes |  |
| `rawToken` | string | yes |  |
| `command` | string | yes |  |

Every other status answers with the shared `ErrorEnvelope` — see
https://docs.institflow.com/md/en/error-codes.md

### Example request

```bash
curl -X POST "https://your-institute.example/api/v1/portal/institute/install-command" \
  -H "Authorization: Bearer $INSTITFLOW_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{
    "label": "string"
  }'
```

## GET /api/v1/portal/institute/install-tokens

The owned institute’s install tokens (state derived: unused / used / expired / revoked).

- Operation id: `PortalInstituteController_listInstallTokens_v1`
- Permission: —
- Auth: credential required
- `Idempotency-Key`: not required

### Responses

**200** — The install tokens.

```json
[
  {
    "id": "37386ae0-3738-7738-8386-37386ae03738",
    "tenantId": "4332af8b-4332-7332-832a-4332af8b4332",
    "state": "unused",
    "expiresAt": "2026-03-02T09:00:00.000Z",
    "usedAt": "2026-03-02T09:00:00.000Z",
    "usedFromIp": "string",
    "revokedAt": "2026-03-02T09:00:00.000Z",
    "createdBy": "0b14e5a6-0b14-7b14-814e-0b14e5a60b14",
    "createdByAccountId": "34bcf5dc-34bc-74bc-8bcf-34bcf5dc34bc",
    "label": "string",
    "createdAt": "2026-03-02T09:00:00.000Z",
    "updatedAt": "2026-03-02T09:00:00.000Z"
  }
]
```

Every other status answers with the shared `ErrorEnvelope` — see
https://docs.institflow.com/md/en/error-codes.md

### Example request

```bash
curl -X GET "https://your-institute.example/api/v1/portal/institute/install-tokens" \
  -H "Authorization: Bearer $INSTITFLOW_API_KEY"
```

## DELETE /api/v1/portal/institute/install-tokens/{id}

Revoke an unused install token.

- Operation id: `PortalInstituteController_revokeInstallToken_v1`
- Permission: —
- Auth: credential required
- `Idempotency-Key`: not required

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `id` | path | string | yes |  |

### Responses

**200** — The revoked token.

| Property | Type | Required | Constraints |
| --- | --- | --- | --- |
| `id` | string (uuid) | yes |  |
| `tenantId` | string (uuid) | yes |  |
| `state` | enum: "unused" \| "used" \| "expired" \| "revoked" | yes |  |
| `expiresAt` | string (date-time) | yes |  |
| `usedAt` | string (date-time) \| null | yes |  |
| `usedFromIp` | string \| null | yes |  |
| `revokedAt` | string (date-time) \| null | yes |  |
| `createdBy` | string (uuid) \| null | yes |  |
| `createdByAccountId` | string (uuid) \| null | yes |  |
| `label` | string \| null | yes |  |
| `createdAt` | string (date-time) | yes |  |
| `updatedAt` | string (date-time) | yes |  |

Every other status answers with the shared `ErrorEnvelope` — see
https://docs.institflow.com/md/en/error-codes.md

### Example request

```bash
curl -X DELETE "https://your-institute.example/api/v1/portal/institute/install-tokens/37386ae0-3738-7738-8386-37386ae03738" \
  -H "Authorization: Bearer $INSTITFLOW_API_KEY"
```

## POST /api/v1/portal/institute/registry-credential

Re-issue the owned institute’s registry credential (shown once). Revokes any still-active one first.

- Operation id: `PortalInstituteController_reissueRegistryCredential_v1`
- Permission: —
- Auth: credential required
- `Idempotency-Key`: not required

### Responses

**201** — The new credential and its one-time secret.

| Property | Type | Required | Constraints |
| --- | --- | --- | --- |
| `credential` | object | yes |  |
| `secret` | string | yes |  |

Every other status answers with the shared `ErrorEnvelope` — see
https://docs.institflow.com/md/en/error-codes.md

### Example request

```bash
curl -X POST "https://your-institute.example/api/v1/portal/institute/registry-credential" \
  -H "Authorization: Bearer $INSTITFLOW_API_KEY"
```

## GET /api/v1/portal/institute/registry-credentials

The owned institute’s registry credentials (usernames, timestamps — never a secret).

- Operation id: `PortalInstituteController_listRegistryCredentials_v1`
- Permission: —
- Auth: credential required
- `Idempotency-Key`: not required

### Responses

**200** — The registry credentials.

```json
[
  {
    "id": "37386ae0-3738-7738-8386-37386ae03738",
    "tenantId": "4332af8b-4332-7332-832a-4332af8b4332",
    "username": "string",
    "createdByUserId": "d630cadc-d630-7630-830c-d630cadcd630",
    "lastUsedAt": "2026-03-02T09:00:00.000Z",
    "revokedAt": "2026-03-02T09:00:00.000Z",
    "createdAt": "2026-03-02T09:00:00.000Z",
    "updatedAt": "2026-03-02T09:00:00.000Z"
  }
]
```

Every other status answers with the shared `ErrorEnvelope` — see
https://docs.institflow.com/md/en/error-codes.md

### Example request

```bash
curl -X GET "https://your-institute.example/api/v1/portal/institute/registry-credentials" \
  -H "Authorization: Bearer $INSTITFLOW_API_KEY"
```

## DELETE /api/v1/portal/institute/registry-credentials/{id}

Revoke a registry credential.

- Operation id: `PortalInstituteController_revokeRegistryCredential_v1`
- Permission: —
- Auth: credential required
- `Idempotency-Key`: not required

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `id` | path | string | yes |  |

### Responses

**200** — The revoked credential.

| Property | Type | Required | Constraints |
| --- | --- | --- | --- |
| `id` | string (uuid) | yes |  |
| `tenantId` | string (uuid) | yes |  |
| `username` | string | yes |  |
| `createdByUserId` | string (uuid) \| null | yes |  |
| `lastUsedAt` | string (date-time) \| null | yes |  |
| `revokedAt` | string (date-time) \| null | yes |  |
| `createdAt` | string (date-time) | yes |  |
| `updatedAt` | string (date-time) | yes |  |

Every other status answers with the shared `ErrorEnvelope` — see
https://docs.institflow.com/md/en/error-codes.md

### Example request

```bash
curl -X DELETE "https://your-institute.example/api/v1/portal/institute/registry-credentials/37386ae0-3738-7738-8386-37386ae03738" \
  -H "Authorization: Bearer $INSTITFLOW_API_KEY"
```

## GET /api/v1/portal/institute/relay/statement

The owned institute’s relay ledger, newest first. Read-only.

- Operation id: `PortalInstituteController_getRelayStatement_v1`
- Permission: —
- Auth: credential required
- `Idempotency-Key`: not required

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `cursor` | query | string | no |  |
| `limit` | query | integer | no | 1–100 · default: 25 |

### Responses

**200** — A page of ledger entries.

| Property | Type | Required | Constraints |
| --- | --- | --- | --- |
| `data` | array<object> | yes |  |
| `nextCursor` | string \| null | yes |  |

Every other status answers with the shared `ErrorEnvelope` — see
https://docs.institflow.com/md/en/error-codes.md

### Example request

```bash
curl -X GET "https://your-institute.example/api/v1/portal/institute/relay/statement" \
  -H "Authorization: Bearer $INSTITFLOW_API_KEY"
```