Onboarding

Endpoints for managing tenant onboarding lifecycle and certification.

Onboarding State Machine


created → network_pending → identity_pending → byok_pending
    → validation_pending → certification_pending → go_live_ready → live
                                                                ↘ blocked

State	Description
`created`	Tenant record created
`network_pending`	Waiting for private network setup
`identity_pending`	Waiting for OIDC identity configuration
`byok_pending`	Waiting for BYOK credential upload
`validation_pending`	Credential uploaded, validation pending
`certification_pending`	Validation passed, certification pending
`go_live_ready`	All checks passed, ready for production
`live`	Active in production
`blocked`	Error state requiring remediation

GET /v1/admin/onboarding/status

Returns comprehensive onboarding progress for the current tenant.

Property	Value
Auth	`tenant_admin` or `tenant_viewer` role

Response includes:

Current state and checklist (pending/completed/blocked steps)
Blockers with retryable flags
BYOK summary (configured, validation_status, fingerprint, timestamps)
Certification summary (status, last_run_operation_id, passed)

POST `/v1/admin/integrations/{integration_id}/certifications`

Run integration-scoped certification workflow. Always returns 202 (async).

Property	Value
Auth	`tenant_admin` role
Idempotent	Yes
Async	Always

Modes

Mode	Tests
`quick`	Proofread test + operation poll verification
`full`	Proofread test + essay-critique test + operation poll verification

Preconditions (409 if unmet)

BYOK credential must be configured and validated
Integration must be active
Integration auth config must be active
Integration connectivity must be verified
No other certification currently running

Route Retirement

POST /v1/admin/onboarding/certify is retired and returns 410.

See the Certification Guide for a complete walkthrough.