Refreshes the access token using the refresh token stored in httpOnly cookie. No request body required - refresh token is read from cookie.

Logs out the user by revoking the refresh token stored in httpOnly cookie. No request body required - refresh token is read from cookie.

Change user password using username and password. Can be called either with or without Bearer token:

• With token: User can change their own password
• Without token: Authentication is done with username and password (for expired password scenarios)

Starts the OIDC authorization code flow with PKCE. Returns a 302 redirect to the configured identity provider authorization endpoint.

Supports two content types for the optional idp_type field:

application/x-www-form-urlencoded (recommended for browser forms): idp_type=ldap or idp_type=saml

application/json: {"idp_type": "ldap"} or {"idp_type": "saml"}

When idp_type is ldap or saml, the organization-scoped external login policy is applied so LDAP/SAML IDPs are shown on the login page. Omitting idp_type (or sending an empty body) shows the instance-level login screen.

The configured identity provider redirects the browser here after successful user authentication. Exchanges the authorization code for tokens, stores them in a server-side session, sets an HttpOnly session cookie, and redirects the browser to the React SPA.

Called by the React SPA after landing on /auth/callback. Reads the HttpOnly session cookie and returns the F5 Insight access token details needed by the SPA.

Returns the authenticated user's F5 Insight role and the permissions granted to that role. Used by the frontend to enable or hide role-based UI actions. Requires authentication.

Returns all available system roles with user counts. Used to populate the role selector when creating or updating a group mapping. Requires authentication.

Returns a single role by its UUID, including its full permission list. Requires authentication.

Returns configured mappings grouped by identity provider and role. Requires authentication.

Returns all provider-scoped grouped mappings for the given role_id. Requires authentication.

Creates or fully replaces the grouped_resource_attribute list for the given provider_id and role_id. Sending an empty grouped_resource_attribute array clears mappings for that provider/role. Requires admin role.

Adds or moves the provided grouped_resource_attribute values to the given provider_id and role_id without removing other values already mapped to that role. Requires admin role.

Deletes the grouped mapping for the given provider_id and role_id. This removes all grouped_resource_attribute values currently mapped to that provider/role pair. Requires admin role.

Fetches security insights from AIDF including alerts, scoring, and device findings. Requires AIDF to be configured. Returns sample data if AIDF endpoint fails.

Fetches workload classification insights from AIDF including application discovery, traffic analysis, and compliance indicators. Requires AIDF to be configured. Returns sample data if AIDF endpoint fails.

Returns a paginated, filterable list of AI assistant audit events from ClickHouse. Each row represents one agent action (user message, assistant response, tool call, tool result, error, data access, or PDF export). Requires the audit.read permission. PII fields (ip_address, user_agent, message, tool_arguments, tool_result) are masked unless the caller also holds the audit.view_sensitive permission and passes view_sensitive=true.

Generates a CSV export of audit events matching the supplied filters. For ≤10 000 matching rows the export is generated synchronously and the response includes a download_url. For >10 000 rows the job is queued asynchronously; the response is 202 Accepted with status: processing and a status_url to poll. Exports are cached on disk for 30 minutes and deleted after download. A per-user limit of 5 concurrent exports is enforced.

Streams the CSV file for the given export ID. The file is deleted from the server after a successful download. If the export is still being processed, returns 202. If the export has expired (TTL 30 min), returns 410 Gone.

Returns a list of all backup and restore jobs

Triggers a backup operation. Returns a job ID to track progress.

Compares the most recent completed backup size against the rolling average of the previous 3 completed backups. Returns is_anomalous=true when the latest backup is more than 30% smaller than the rolling average (pct_of_avg < 70).

Returns details of a specific backup job including live progress

Deletes a backup file and its job record

Downloads the backup archive file

Triggers a restore from the specified backup

Upload a backup .tar file from another system without restoring

Import a backup file from a local path or remote storage target. Reads the manifest via platform-manager to validate and extract metadata. Creates a DB record referencing the file location without copying.

List all active (non-expired, non-deleted) conversations for the authenticated user, sorted by most recent message.

Create a new conversation thread. Returns 429 if the user has reached the 50-thread cap.

Get a conversation and its full message history. Returns 410 if the conversation has expired.

Soft-delete a conversation. The conversation will be retained for 30 days for audit purposes before hard-deletion.

Add a message to a conversation. Resets the 24-hour TTL rolling window. Returns 410 if the conversation has expired.

Generates and downloads a PDF of either an entire conversation (all turns) or a single assistant response (including its preceding user prompt). PDF is generated server-side using pure-Go rendering (go-pdf/fpdf). Conversations are capped at 200 live messages due to the summarization policy; the export reflects the live message window at time of request. User identity is resolved from the Bearer token — no user_id in the body. The conversation ownership is validated server-side; a conversation belonging to another user returns 404 (not 403) to avoid ID enumeration.

List all VMware cloud environments for auto-scaling.

Creates a new VMware cloud environment for auto-scaling.