apiportal

Overview ¶

Package apiportal holds steps that create real subscription, application, and API-key artifacts through api-portal's own REST API — the product that issues subscription tokens and API keys, which reach platform-api (and from there the gateway) as signed webhook events. See core/catalog/apiportal's own doc comment for why the portal, not platform-api, is the thing under test here.

api-portal accepts the platform-api admin JWT directly as a bearer token: it verifies the RS256 signature against the shared keypair's public half (auth.local.public_key_path in portals/api-portal/configs/config.toml, wired to the same jwt_public.pem core/catalog/apiportal.portalCryptoFiles copies from the control plane's own key material) and takes the organization from the token's org_handle claim. Every call in this package reuses that same bearer token — no session cookie, no CSRF handshake.