Admin token
Read-only. The token is kept in this tab's sessionStorage only (never in the URL, never in localStorage) and is sent as X-Admin-Token.
Customers by status
Customers by tier
Domains by status
Domains by tier
Webhooks by type
How the numbers are computed
Domains that proved ownership but tripped a risk check. None is routed until you release it. Release sends it on to provisioning and emails the customer. Reject removes it from the account and blocklists the name; the customer is not emailed.
Blocklist
A blocked domain (and everything under it) cannot be added. A blocked email or mail domain cannot register. Nothing already routed is touched.
Identities
Hostmap (what the issuer / gateways consume)
Each button pulls GET /api/admin/export?what=… (newline-delimited JSON, one object per line, same shapes as the tables) and saves it from a blob. Optional query filters are the same as the list routes (e.g. status=active&tier=echonod).
The API keeps the last 200 admin calls in memory (route, client IP, outcome, time), newest first; lost on restart. The journal carries the same lines as [ADMIN] entries.