Admin operations (IESF Card)

Central Auth stores platforms and onboarding schemas. The IESF Card Account Center exposes the operator UI that writes those records through the Central admin APIs.

This page documents the Card admin flows as implemented today. It is not a substitute for the platform BFF integration checklist.

Access

Requirement	Detail
App	IESF Card (Account Center)
Routes	/admin/platforms, /admin/onboarding
Permission	Session must include platforms:admin (copied from the ZITADEL access-token roles into the gateway session at login)

Without a session, Card redirects to login. Without platforms:admin, Card redirects to /.

1. Register a platform key

Open Platform Admin at /admin/platforms. Expand Register a new platform.

Form fields (as sent to POST /v1/platforms)

UI field	Backend field	Rules
Platform key	platformKey	Uppercased on submit; must match ^[A-Z][A-Z0-9_]{1,63}$ (example: IESF_COMPETITIONS)
Display name	displayName	Required human label
Callback URL	callbackUrl	Absolute URL of the platform BFF handoff endpoint
Allowed return URLs	allowedReturnUrls	One absolute URL root per line; used to allowlist returnTo on /v1/auth/start
Default onboarding mode	defaultOnboardingMode	central (default in the form), platform, or none
Central onboarding enabled	centralOnboardingEnabled	Checkbox; must be on when mode is central
Platform onboarding path	platformOnboardingPath	Optional path for platform-hosted onboarding UI
Metadata	metadata	JSON object (default {})

Click Register platform.

What happens next

1. Central creates an active platform row and generates BFF credentials.
2. Card shows a one-time banner: Save these credentials now with clientId and clientSecret.
3. The secret is shown only once. Store it in the platform’s secret manager; never leave it in the browser.
4. Hand the platformKey, callback, return URL roots, onboarding mode, and Basic credentials to the platform team so they can implement Platform integration.

Ongoing platform actions on the same page

For each registered platform Card also supports:

• Save changes → PATCH /v1/platforms/{platformKey}
• Deactivate / Activate → DELETE / POST …/activate
• Rotate secret → POST …/credentials/rotate (again shows credentials once; previous secret stops working immediately)

An active platform must keep a callback URL, at least one allowed return URL, and configured credentials.

2. Add onboarding fields

Open Onboarding Admin at /admin/onboarding.

1. Select the target Platform from the dropdown (keys come from the platform registry).
2. Card loads GET /v1/platforms/{platformKey}/onboarding/fields and shows the current requirement version.

Option A — Add standard fields (presets)

Use Add standard fields when you want the built-in English catalog (profile + common game/social customs).

1. Tick the presets to add (grouped by category: Basic information, Location and preferences, Game integrations, Social accounts).
2. Optionally tick Required next to each selected preset.
3. Click Add selected fields.

Each selected preset becomes a POST /v1/platforms/{platformKey}/onboarding/fields. Already-present fieldKeys are hidden from the preset list.

Preset PROFILE_FIELD entries bind to canonical profile columns (firstName, dateOfBirth, …). Preset custom entries (steam64Id, riotId, social handles, …) are CUSTOM_FIELD values.

Option B — Create a custom field

Expand Create onboarding field and submit:

UI field	Notes
Field key	^[A-Za-z][A-Za-z0-9_]{1,63}$; immutable after create
Label	Display label
Field type	TEXT, TEXTAREA, NUMBER, BOOLEAN, DATE, SELECT, MULTI_SELECT, COUNTRY, PHONE, EMAIL, URL
Source	CUSTOM_FIELD (default) or PROFILE_FIELD
Profile field	Required when source is PROFILE_FIELD; must be empty for CUSTOM_FIELD
Required	Whether completion checks need a value
Sort order	Rendering order
Options / Validation / UI config	JSON; SELECT / MULTI_SELECT need a non-empty unique options array

Click Create field.

Edit / archive

Each existing field can be updated (Save field → PATCH) or archived (Archive → DELETE). Archive soft-deactivates the definition; historical values remain.

Effect on users

Every create / update / archive increments platforms.requirement_version and moves previously COMPLETE memberships back to IN_PROGRESS. The next login or status check re-evaluates missing fields against the new schema. No SQL migration is required.

Recommended order for a new platform

1. Register the platform key and save the one-time BFF credentials (/admin/platforms).
2. Configure onboarding fields for that key (/admin/onboarding).
3. Give the platform team: platformKey, callback URL, allowed return roots, onboarding mode, and Basic credentials.
4. Platform implements start → callback → exchange (Platform integration).

Related pages

• Platform integration — what the platform BFF must implement after registration
• Onboarding — modes and user-facing completion APIs
• API reference — admin endpoint map