Returns MRR, ARR, active tenants, paying tenants, plan distribution, 30/60/90-day growth cohorts, and top tenant usage.

{
  "revenue": { "mrr": 5998, "arr": 71976, "active_tenants": 2 },
  "growth": { "30d": { "new_signups": 2, "new_activated": 2 } },
  "top_tenants": [...]
}

MRR and ARR grouped by plan tier with per-plan tenant count.

Scan counts, framework usage, and quota consumption across all tenants.

Live Azure Cost Management data grouped by resource type. Requires AZURE_SUBSCRIPTION_IDS env var.

Returns all tenant records from Cosmos DB including plan, scan counts, trial status, and masked API key.

Creates a tenant outside the Marketplace flow (e.g. direct sales, pilots, internal accounts). Generates an API key automatically.

{
  "email": "cto@example.com",
  "plan_id": "starter",
  "company": "Acme Corp"
}

Suspends the tenant's API key — all scan attempts return 403. Reversible via /reinstate.

Restores an active status for a previously suspended tenant.

Marks the tenant as cancelled and expires their API key. Data is retained in Cosmos DB.

⚠️ Destructive. Permanently removes the tenant record and all associated data from Cosmos DB. Cannot be undone.

Generates a new gai-... key and invalidates the previous one immediately. The new key is returned in the response.

Immediately expires the tenant's API key. The tenant will receive 401 on all subsequent requests until a new key is rotated or issued.

Returns the current global governance scan execution settings: mode (serial or parallel) and parallel limit. Applies to all automated CCM scan runs across all tenants.

{ "governance_scan_mode": "serial", "governance_parallel_limit": 3 }

Updates governance scan mode and parallel limit platform-wide. Changes apply to all future automated scans.

{
  "governance_scan_mode":      "serial",   // "serial" | "parallel"
  "governance_parallel_limit": 3           // 1-20, used when mode = "parallel"
}

Verifies that the platform can authenticate to the PMK Key Vault and retrieve the encryption secret. Accepts optional query params to test an alternative vault or secret before changing environment variables.

{
  "status":      "ok",
  "vault_url":   "https://guardia-ai-saas-kv.vault.azure.net/",
  "secret_name": "guardia-report-encr-creds",
  "secret_len":  44,
  "latency_ms":  123
}

Tests the Azure OpenAI connection used for scan narrative generation. Returns model, endpoint, latency, and a sample completion. Use to verify AI narration is functional before a scan cycle.

{
  "status":     "ok",
  "endpoint":   "https://guardia-aoai.openai.azure.com/",
  "model":      "gpt-4.1-mini",
  "latency_ms": 412
}

Returns aggregate statistics about the Azure Blob Storage report archive and audit log. Scoped to a single tenant via ?tenant_id= or platform totals when omitted.

{
  "env":            "prod",
  "storage_ok":     true,
  "archive_count":  342,
  "audit_blobs":    28,
  "last_archived":  "2026-05-19T14:30:22+00:00",
  "tenants_seen":   ["tenant-id-1", "..."],
  "error":          null
}

Archive layout: report-archive-{env}/{tenant_id}/{YYYY}/{report_id}.json.gz
Audit layout: audit-log-{env}/{tenant_id}/{YYYY-MM}.jsonl
Audit actions: manual_bulk_delete · manual_single_delete · governance_history_delete · tenant_purged

Returns all configured promotions including active state, type, validity window, and applicable plan.

Creates a new promotion offer — extended trial, plan upgrade, or scan quota boost.

{
  "name":          "Launch — 30-day Extended Trial",
  "type":          "extended_trial",
  "days":          30,
  "plan_override": "professional",
  "active":        true,
  "expires_at":    "2026-06-30T23:59:59Z"
}

Flips the active state of a promotion. Inactive promotions are not applied to new tenants during onboarding.

Returns a count and summary of currently active promotions including nearest expiry. Used by the admin dashboard status badge.