# Management API

> Manage RPC Gateway resources with scoped personal access tokens.

Canonical page: https://rpc.aurpay.net/docs/management-api

The Management API exposes the same account-owned Apps, Gateways, Endpoints, Providers, routes, usage, and platform controls used by the dashboard. It is intended for CLI tools and AI agents. It is separate from the public blockchain Gateway API.

## What you can manage

Every resource below is scoped to your own Account. Paths are relative to the Management API base URL.

| Resource | Path prefix | Typical operations |
| --- | --- | --- |
| Overview | `/v2/overview` | Read a summary of the Account |
| Apps | `/v2/apps` | Create and update Apps; list, rotate, and revoke API Keys; update Gateways in bulk; set or clear the App Provider |
| Gateways | `/v2/gateways` | List Gateways and change their settings |
| Endpoints | `/v2/endpoints` | Create, update, and delete Endpoints; read Route bindings and remove individual bindings |
| Providers | `/v2/providers` | Create and update Providers, inspect deletion impact, trigger a sync, list persistent sync runs, and list synchronized Endpoints |
| JSON-RPC routes | `/v2/gateways/{gateway_id}/jsonrpc-route` and `.../jsonrpc-method-routes` | Replace the default route and manage per-method routes |
| HTTP API routes | `/v2/gateways/{gateway_id}/http-api-route` | Read and replace the HTTP API route |
| Usage | `/v2/usage` | Read totals, time series, and breakdowns by method, network, Route, and actual upstream Endpoint attempts |
| Metadata | `/v2/meta` | Read the RPC Method Catalog |

Accounts and rate-limit policies have routes as well, but their scopes are restricted to platform administrators.

## Start integrating

1. [Create a PAT and authenticate](https://rpc.aurpay.net/docs/management-api/authentication.md).
2. [Choose the minimum required scopes](https://rpc.aurpay.net/docs/management-api/scopes.md).
3. [Make write retries idempotent](https://rpc.aurpay.net/docs/management-api/idempotency.md).
4. [Handle response envelopes and stable error codes](https://rpc.aurpay.net/docs/management-api/errors.md).

## Execution model

For a PAT request, the server validates authentication, the operation's required scopes, Account ownership, and any supplied idempotency key before executing the operation immediately. Audit recording follows execution.

Dashboard confirmation dialogs are client-side safeguards shown before the dashboard sends a request. The server flow is direct validation, execution, and audit recording, without a server-side approval queue.

## Create a personal access token

Sign in to the dashboard, open **Settings → Personal access tokens**, and create a personal access token (PAT). Select only the scopes the client needs. The complete token is shown once; store it in a secret manager or protected environment variable.

PATs expire after 90 days by default and cannot exceed 365 days. Each account can have at most 20 active PATs; revoked and expired tokens do not count toward this limit. Revoke a token from the same Personal access tokens page when it is no longer needed or may have been exposed.

> Use a PAT for the Management API. Use an App API Key for JSON-RPC and TRON HTTP API traffic.

## OpenAPI contract

The versioned [OpenAPI v2 contract](https://rpc.aurpay.net/openapi/v2.json) contains all available paths, models, security schemes, and each operation's `x-required-pat-scopes` extension.

Some session-only dashboard routes also appear in the complete contract. Provider credential reveal is a dashboard-only operation authenticated by the dashboard session.