Admin, SSO, SCIM & tokens
Everything you need to run Reloqui for a team.
Roles & RBAC
Section titled “Roles & RBAC”Reloqui uses additive, org- and project-scoped roles:
| Role | Can |
|---|---|
org_admin |
Everything in the org (implies all project roles). |
project_admin |
Manage a project’s catalog, integrations, members. |
release_manager |
Create/reconcile/publish releases, request approvals. |
governance_admin |
Own policies, freezes and approvals (without full project-admin). |
project_member |
Read + contribute within a project. |
executive_viewer |
Trimmed, high-level read (evidence detail withheld). |
demo_viewer |
Full read of the public demo; all writes blocked. |
See Roles & permissions for the full matrix.
Single sign-on (OIDC)
Section titled “Single sign-on (OIDC)”Configure per-org OIDC SSO (Settings → SSO): issuer, client id/secret, and a default role for just-in-time provisioned users.
PUT /api/v1/orgs/{orgId}/sso{ "issuer": "https://acme.okta.com", "clientId": "…", "clientSecret": "…", "defaultRole": "project_member" }Users then sign in with “Sign in with SSO”; new users are JIT-provisioned at the default role. (Reloqui supports OIDC; SAML is out of scope.)
SCIM 2.0 provisioning
Section titled “SCIM 2.0 provisioning”Automate user/group lifecycle from your IdP with a scim-scoped service token:
POST/GET/PUT/DELETE /api/v1/scim/v2/Users— provision, read, replace, deactivate (deactivation revokes sessions).POST /api/v1/scim/v2/Groups— group→role mapping.
Service-principal tokens
Section titled “Service-principal tokens”Create scoped rat_… tokens for CI and automation (Admin → API tokens):
- Scopes:
releases:read|write,catalog:read|write,scim. - Project-scoped or org-scoped; secrets are shown once and masked thereafter.
- Use as
Authorization: Bearer rat_….
Data retention
Section titled “Data retention”Set per-org retention windows (Settings → Retention): raw events, delivery logs, audit logs. A nightly purge enforces them.
PUT /api/v1/orgs/{orgId}/retention{ "rawEventDays": 90, "deliveryLogDays": 90, "auditLogDays": 365 }GDPR erasure
Section titled “GDPR erasure”Org admins can run a data-subject erasure (POST /api/v1/orgs/{id}/gdpr/erasure-requests) that anonymizes a user’s PII, scrambles credentials, deactivates the account, revokes sessions, and audits the action. Self-erasure is blocked.
Audit log
Section titled “Audit log”Every mutation is recorded. The Audit log explorer supports filters (event type, actor, date) and cursor pagination:
GET /api/v1/audit/events?eventType=release.published&actorId=user_…Password & sessions
Section titled “Password & sessions”Users manage their password under Settings; a password change revokes all sessions. Sessions use rotating refresh tokens.