tripl (0.1.0)

Self-service sign-up.

Self-hosted: into the default organization (the first account owns it and is a platform admin); org_name / org_slug are ignored.

Hosted: org_name and org_slug are required and the account creates and owns that organization. It starts unverified — the verification link is mailed through the operator relay after the commit (a failed send is logged; the user can resend) — so 503 up front when that relay cannot send.

Show who an invitation is for, before the invitee has an account.

Unauthenticated by necessity — the whole point is that this person cannot sign in yet. It discloses nothing the token holder does not already have: the address it was issued to, the organization role it grants, and when it lapses. It does not reveal whether the instance has other users, or who they are.

Shares the cheap /status bucket rather than the register bucket: previewing is a read, and it must not consume the quota the invitee needs to actually redeem. Unknown, expired and used tokens all return the same 400.

Redeem an invitation: into a new account, or into the signed-in one.

Signed in (a browser session cookie): the invitation adds a membership of its organization to THIS account, but only when the account's email is the invitation's (case-insensitive) — else 403 and the invitation stays unused; on a hosted instance the account must also have verified its address (403); 409 when the account is already a member. Answers 200 and leaves the session as it is (F20 PR6).

Not signed in: the new-account path. password is required, the account is created with the invitation's address and the new user is signed straight in (201). Self-hosted the account counts as email-verified. Hosted it starts unverified — the inviter was handed the raw link, so redeeming it proves nothing about the address — and a verification link is mailed through the operator relay after the commit (a failed send is logged; the user can resend). Reachable regardless of registration_mode — an owner-issued, single-use, expiring, address-bound invitation is a different mechanism from the instance-wide door, so a closed instance can still onboard exactly the people its owner named.

On the register rate-limit bucket, so guessing tokens costs the same as hammering signup.

Public demos require an already signed-in, verified account matching the invitation. Anonymous password redemption is refused with 403, without creating an account or sending verification mail. Acceptance grants the member organization role and viewer access to its existing ready demos; existing project grants are preserved. A full demo organization returns 409.

Mail the signed-in account a fresh verification link (a resend).

A browser session only (an API key is 403). 204 without doing anything when the address is already verified or the instance does not require verification (self-hosted); 503 when the operator relay cannot send. Otherwise every earlier link of the account stops working and the new one goes out after the response (a failed send is logged).

Redeem a verification link, signed in as the account it was issued to.

Needs a browser session (401 without one): the link alone proves only that someone read the mail, the session proves it is the account holder who did. A session of a different account gets the same 400 as an unknown, expired or used token, and the token stays usable. On success every other session of the account is signed out, and on a hosted instance an address listed in PLATFORM_ADMIN_EMAILS becomes a platform admin — the only place that grant happens. On the login bucket, like the password reset confirm, so guessing tokens costs what guessing passwords does.

The signed-in account with its organization role(s) and the platform-admin flag.

For an API key it also names the key's organization (org) and scope (api_key_scope): what tripl whoami prints. Read from the database on every call, so a membership added, changed or removed shows at once.

Send the browser to Google's account chooser.

Google's redirect back: signed in and into the app, or back to sign-in.

Send the browser to the instance's OpenID Connect provider.

The provider's redirect back: signed in and into the app, or back to sign-in.

Outstanding invitations into the organization: the roster of pending access.

Invite one person into the request's organization, at an organization role.

OwnerUserDep is org owner/admin-only AND rejects API keys of any scope, so minting an account always requires an interactive session — an automation token can never conjure a new identity. Inviting at owner takes an owner: an admin cannot mint an account more privileged than their own.

The redeem link is returned in the body, not merely emailed: SMTP is optional and unconfigured on many instances, so a body-only path is the one that always works. It appears here and nowhere else. When the operator has SMTP configured the link is also mailed, through the operator's relay (never an organization's), after the response.

On a public demo the link is the only delivery: no mail is prepared or sent. Only the member organization role is allowed, with at most ten members plus unexpired pending invitations (409 when full), and ten mints per rolling hour per organization and inviter (429 when exhausted).

The invitation belongs to the organization the request acts in: the one an /orgs/{org}/users/invitations URL names, else the legacy default.

Revoke an invitation into the organization; its link stops working immediately.

The members of the request's organization with their organization role.

Any member may see the roster (it feeds the member pickers); a signed-in account outside the organization gets 403.

Change a member's ORGANIZATION role (owner | admin | member).

404 for an account outside the organization, 400 when it would leave the organization without an owner, 403 when an admin tries to make or unmake an owner. The member stays signed in; the new role applies from their next request.

Start a demo: the response is its seeding shell; the worker seeds it.

Poll GET /projects/{slug} until generation_status reads ready (or failed). The project.create audit row is filed by the worker once the demo is ready, so a cancelled or failed demo leaves none.

Abandon this user's in-flight demo provision, if one is still seeding.

Deliberately ungated by the kill switch: it only ever removes work. Declared before /demo/{slug}/reset so the literal path is never shadowed.

Re-seed a demo in place. Restricted to the demo's creator or an owner.

Delete a demo and its owned synthetic warehouse. Creator or owner only.

Owner-only: clear every anomaly (+ breakdown) in the project's period.

Destructive and irreversible. Derived monitoring signals disappear with the anomalies they are computed from. dry_run only counts.

Owner-only: clear every schema + distribution drift in the project's period.

Destructive and irreversible. dry_run only counts.

Owner-only: drop the variables a scan minted that nothing refers to.

A scan creates a variable for every placeholder it discovers and has never retired one, so a project whose warehouse holds a JSON column keyed by user-typed text accumulates a row per key forever. This deletes only rows that a scan created, no human has edited, no event field value names, and that carry no observed context, drift or override — see core.variable_retirement for why "no observed context" alone is not enough to be safe.

dry_run defaults to true, so the first call is always a preview. It returns the same counts the real pass would, broken down by why each surviving row was kept.