Administrator Guide
Domain & users
- Provision domains via
POST /api/v1/domains. - Users receive encrypted key material; admin never sees plaintext DMK.
- RBAC middleware on admin routes (
requireAdmin,requireAdminOrAuditor).
Recovery
- Shamir 3-of-5 recovery ceremony — encrypted shards, admin never holds plaintext DMK.
- Recovery sessions stored in Redis (short-lived, not long-lived JWT).
Compliance tools
| Tool | Route / module |
|---|---|
| Legal export | packages/admin/src/legalExport.ts |
| GDPR erasure | packages/admin/src/erasure.ts |
| Warrant canary | GET /warrant-canary |
| Audit logs | HMAC-chained @anoobot/core audit logger |
| Retention policies | packages/admin/src/retention.ts |
| Account suspension (M1) | POST /api/v1/admin/users/:userId/suspend · POST .../unsuspend |
| Abuse reports (M1) | POST /api/v1/abuse/report |
Suspended users cannot log in or send mesh messages (ACCOUNT_SUSPENDED).
Managed cloud (M2 beta)
- Paid plans only — lite/free rejected at provisioning (
assertManagedCloudEligibleBySlab). - Lapse offboard: cancelled/expired subscriptions trigger tenant offboard (
managedLapseCron). - Beta status:
GET /api/v1/managed/beta-status. - Offboard:
DELETE /api/v1/managed/deployments/:domainId.
See docs/managed-cloud-beta.md.
Outbound deliverability (M3)
When ENABLE_OUTBOUND_MAIL=true (managed GA):
| Route | Purpose |
|---|---|
GET /api/v1/outbound/sending-domain/:domainId | SPF/DKIM/DMARC DNS templates for mail.{slug}.send.anoobot.com |
GET /api/v1/outbound/metrics/:domainId | Bounce/complaint counters (24h window) |
POST /api/v1/outbound/webhooks/postmark | Bounce/complaint ingestion (Postmark) |
POST /api/v1/outbound/webhooks/ses | Bounce/complaint ingestion (AWS SES/SNS) |
Webhook auth: header X-Outbound-Webhook-Secret = OUTBOUND_WEBHOOK_SECRET.
- Recipient suppression: bounced/complaint addresses blocked on mesh send (
RECIPIENT_SUPPRESSED). - Auto-suspend: admin suspended after
OUTBOUND_COMPLAINT_SUSPEND_THRESHOLDcomplaints / 24h (default 3). - Blocklist monitor: RBL scan on
OUTBOUND_SENDING_IPflags tenants (ENABLE_BLOCKLIST_MONITOR).
See docs/outbound-mail-ga.md.