Platform Config

Platform configuration is stored in an encrypted key-value store in the database. These endpoints allow superadmins to manage API keys, feature flags, and service settings through the admin UI. Database values take precedence over environment variables.

All API requests require a valid JWT token in the Authorization: Bearer <token> header. The API Gateway decodes the JWT and forwards auth context (user-id, organization-id, user-email, x-platform-role, x-org-role) as headers to downstream services.

All platform config endpoints require superadmin access. Non-superadmin requests receive a 403 Forbidden response. The one exception is GET /api/auth/wizard-config, which any authenticated user may call and which serves only two allow-listed, non-secret wizard display keys.

Get All Config

Retrieve all platform configuration values, grouped by category.

Response (200)

Returns configuration entries organized by category. Sensitive values (API keys) are returned in encrypted form.

object

Configuration entries keyed by category.

Show Config structure

object

AI service configuration.

Show AI config keys

OPENROUTER_API_KEY — OpenRouter API key
OPENAI_API_KEY — OpenAI API key (embeddings)
GEMINI_API_KEY — Google Gemini API key (embeddings)

object

Voice service configuration.

Show Voice config keys

ELEVENLABS_API_KEY — ElevenLabs API key
LIVEKIT_API_KEY — LiveKit API key
LIVEKIT_API_SECRET — LiveKit API secret
LIVEKIT_URL — LiveKit server URL

object

Knowledge service configuration.

Show Knowledge config keys

PINECONE_API_KEY — Pinecone API key
PINECONE_INDEX_NAME — Pinecone index name
PINECONE_ENVIRONMENT — Pinecone environment
LLAMA_CLOUD_API_KEY — LlamaParse API key

object

Feature flags.

Show Feature flag keys

VOICE_ENABLED — Enable voice features globally
KNOWLEDGE_GRAPH_ENABLED — Enable knowledge graph extraction

curl https://your-domain.com/api/auth/admin/config \
  -H "Authorization: Bearer $TOKEN"

const response = await fetch("https://your-domain.com/api/auth/admin/config", {
  headers: { Authorization: `Bearer ${token}` },
});

const { config } = await response.json();

Set Config Value

Create or update a platform configuration value. Values are encrypted at rest using AES-256-GCM.

Request Body

string

required

Configuration key (e.g., OPENROUTER_API_KEY).

string

required

Configuration value. Will be encrypted before storage.

string

required

Category: ai, voice, knowledge, or feature_flags.

Response (200)

{
  "success": true,
  "message": "Configuration updated"
}

curl -X POST https://your-domain.com/api/auth/admin/config \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "key": "OPENROUTER_API_KEY",
    "value": "sk-or-v1-...",
    "category": "ai"
  }'

await fetch("https://your-domain.com/api/auth/admin/config", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${token}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    key: "OPENROUTER_API_KEY",
    value: "sk-or-v1-...",
    category: "ai",
  }),
});

Config Health Check

Check the health of platform configuration, including which required keys are set and which are missing.

Response (200)

string

healthy, degraded, or unconfigured.

string[]

List of configured keys.

string[]

List of required but missing keys.

Setup Status

Check the first-time platform setup status, including whether essential services are configured.

Response (200)

boolean

Whether initial setup is complete.

object

Setup step completion status.

Show Setup steps

boolean

Superadmin user exists.

boolean

At least one AI API key is set.

boolean

Email service is configured.

Wizard Config (non-admin)

The one platform-config read that does not require superadmin. Any authenticated user may call it, and it serves an explicit allow-list of exactly two non-secret, display-only keys used by the agent-creation wizard: wizard_intent_model_defaults and wizard_model_tiers. No other key is reachable through this endpoint.

Response (200)

boolean

Always true on success.

object

Show Wizard config

object | null

Map of wizard intent id to default model id. null when the key has never been configured, or when its stored value is not valid JSON.

array | null

Curated model tiers shown in the wizard picker — each { id, label, cost }. null under the same conditions.

A null field is not an error: the frontend falls back to its built-in defaults, so a deployment that has never configured these keys behaves normally.

Configuration Precedence

Platform config follows this precedence order:

Database (platform_config table) — highest priority
Environment variables (.env files) — fallback

Services call getConfigValue(key) which checks the database first and falls back to process.env. This means you can override any environment variable through the admin UI without restarting services.

Encryption

All config values are encrypted at rest using AES-256-GCM with the JWT_SECRET as the encryption key. The @brainstormer/shared crypto module handles encryption and decryption transparently.

Getting Started

Agent Provisioning

Bot Service

Auth Service

Knowledge Service

Platform Config

Platform Config

Get All Config

Response (200)

Set Config Value

Request Body

Response (200)

Config Health Check

Response (200)

Setup Status

Response (200)

Wizard Config (non-admin)

Response (200)

Configuration Precedence

Encryption

​Platform Config

​Get All Config

​Response (200)

​Set Config Value

​Request Body

​Response (200)

​Config Health Check

​Response (200)

​Setup Status

​Response (200)

​Wizard Config (non-admin)

​Response (200)

​Configuration Precedence

​Encryption

Platform Config

Get All Config

Response (200)

Set Config Value

Request Body

Response (200)

Config Health Check

Response (200)

Setup Status

Response (200)

Wizard Config (non-admin)

Response (200)

Configuration Precedence

Encryption