Tenant

Lists every tenant of the platform with its status and purpose.

get

/api/tenants

Restricted to the Global Administrator role. Not paged: every tenant is returned in one response. A tenant whose configuration cannot be read is listed as onboarding / test.

Authorizations

OAuth2implicitRequired

Authorization URL:

Responses

200

Tenant directory entries returned.

One tenant of the platform, as listed in the tenant directory.

tenantIdstringRequired

Identifier of the tenant; the tenantId of every tenant-scoped route.

statusstring · enumOptional

Lifecycle status of the tenant.

Possible values:

purposestring · enumOptional

Usage of the tenant.

Possible values:

401

The caller is not authenticated.

application/problem+json

403

The caller does not hold the global:administrator role.

application/problem+json

get/api/tenants

GET /api/tenants HTTP/1.1
Host: app.neostore.cloud
Authorization: Bearer YOUR_OAUTH2_TOKEN
Accept: */*

[
  {
    "tenantId": "text",
    "status": "onboarding",
    "purpose": "demo"
  }
]

Downloads the tenant's configuration files as a zip archive, current or as of a past date.

get

/api/tenants/{tenantId}

The archive always includes the .version file, which records the version of each file; uploading the archive back uses it to detect files changed on the server in the meantime. It is named {yyyyMMdd-HHmmss}[-partial]-{tenantId}.fctwc, from datetime or the current time in UTC, with -partial when files is given. A files filter that matches nothing returns an archive holding only .version.

Required scopes

This endpoint requires the following scopes:

Authorizations

OAuth2implicitRequired

Authorization URL:

Path parameters

tenantIdstringRequired

Identifier of the tenant.

Query parameters

filesstring[]Optional

File paths to include, exact and case-sensitive, or with * as a wildcard (layouts/*). Omitted, every file is included.

datetimestring · date-timeOptional

Point in time to export the configuration as it was then. Omitted, the current configuration is exported.

Responses

200

Configuration archive returned.

No content

401

The caller is not authenticated.

application/problem+json

403

The caller lacks the tenant.configuration:read scope.

application/problem+json

404

The tenant does not exist or had no configuration at datetime.

429

Over 1200 requests per minute to this endpoint for the tenant (default limit); retry after Retry-After.

application/problem+json

get/api/tenants/{tenantId}

GET /api/tenants/{tenantId} HTTP/1.1
Host: app.neostore.cloud
Authorization: Bearer YOUR_OAUTH2_TOKEN
Accept: */*

No content

Replaces the whole configuration of an existing tenant with the files of a zip archive.

post

/api/tenants/{tenantId}

Files that differ are written and server files absent from the archive are deleted. Unless force is set, the configuration is validated first, and a file changed on the server since the archive's .version was exported fails validation. The server keeps its own .version. Emits the tenant configuration updated event when anything changed.

Required scopes

This endpoint requires the following scopes:

Authorizations

OAuth2implicitRequired

Authorization URL:

Path parameters

tenantIdstringRequired

Identifier of the tenant.

Query parameters

forcebooleanOptional

true to save even when validation fails or files changed on the server. Defaults to false.

Body

filestring · binaryOptional

Zip archive (multipart form field file) holding every configuration file.

Responses

200

Configuration saved.

Identifies one state of a tenant's whole configuration: which files exist and when each was last written.

versionstringRead-onlyOptional

Opaque token for the configuration as a whole, computed from Neo.Configuration.Tenants.TenantConfigurationVersionInformation.Files. It changes whenever any file is written, added or deleted, so two equal values mean the same configuration; empty when the tenant has no file.

appliedMigrationsstring[]Optional

Names of the platform's configuration upgrades this configuration is up to date with. An upgrade not listed here is still to be applied.

400

The file is missing, empty or not a zip archive, or the configuration fails validation (the errors are listed under file).

401

The caller is not authenticated.

application/problem+json

403

The caller lacks the tenant.configuration:write scope.

application/problem+json

404

The tenant does not exist; use PUT to create it.

429

Over 1200 requests per minute to this endpoint for the tenant (default limit); retry after Retry-After.

application/problem+json

post/api/tenants/{tenantId}

POST /api/tenants/{tenantId} HTTP/1.1
Host: app.neostore.cloud
Authorization: Bearer YOUR_OAUTH2_TOKEN
Content-Type: multipart/form-data
Accept: */*
Content-Length: 17

{
  "file": "binary"
}

{
  "version": "text",
  "files": {
    "ANY_ADDITIONAL_PROPERTY": 1
  },
  "appliedMigrations": [
    "text"
  ]
}

Creates a tenant from a zip archive of its configuration files.

put

/api/tenants/{tenantId}

The only tenant-scoped route that accepts a tenantId that does not exist yet. The configuration is validated before anything is written, unless force is set. Entries under __MACOSX, .DS_Store files and folder entries are not imported.

Required scopes

This endpoint requires the following scopes:

Authorizations

OAuth2implicitRequired

Authorization URL:

Path parameters

tenantIdstringRequired

Identifier of the new tenant.

Query parameters

forcebooleanOptional

true to save even when validation fails. Defaults to false.

Body

filestring · binaryOptional

Zip archive (multipart form field file) holding every configuration file.

Responses

200

Tenant created.

Identifies one state of a tenant's whole configuration: which files exist and when each was last written.

versionstringRead-onlyOptional

Opaque token for the configuration as a whole, computed from Neo.Configuration.Tenants.TenantConfigurationVersionInformation.Files. It changes whenever any file is written, added or deleted, so two equal values mean the same configuration; empty when the tenant has no file.

appliedMigrationsstring[]Optional

Names of the platform's configuration upgrades this configuration is up to date with. An upgrade not listed here is still to be applied.

400

The file is missing, empty or not a zip archive, or the configuration fails validation (the errors are listed under file).

401

The caller is not authenticated.

application/problem+json

403

The caller lacks the tenant.configuration:write scope.

application/problem+json

409

The tenant already exists.

429

Over 1200 requests per minute to this endpoint for the tenant (default limit); retry after Retry-After.

application/problem+json

put/api/tenants/{tenantId}

PUT /api/tenants/{tenantId} HTTP/1.1
Host: app.neostore.cloud
Authorization: Bearer YOUR_OAUTH2_TOKEN
Content-Type: multipart/form-data
Accept: */*
Content-Length: 17

{
  "file": "binary"
}

{
  "version": "text",
  "files": {
    "ANY_ADDITIONAL_PROPERTY": 1
  },
  "appliedMigrations": [
    "text"
  ]
}

Deletes every configuration file of the tenant, which removes the tenant from the platform.

delete

/api/tenants/{tenantId}

Restricted to the Global Administrator role. Only configuration files are removed; passes and other tenant data are left in place. Tenant-scoped routes then answer 404, apart from PUT, which can create the tenant again.

Authorizations

OAuth2implicitRequired

Authorization URL:

Path parameters

tenantIdstringRequired

Identifier of the tenant.

Responses

200

Configuration deleted.

No content

401

The caller is not authenticated.

application/problem+json

403

The caller does not hold the global:administrator role.

application/problem+json

404

The tenant does not exist.

429

Over 1200 requests per minute to this endpoint for the tenant (default limit); retry after Retry-After.

application/problem+json

delete/api/tenants/{tenantId}

DELETE /api/tenants/{tenantId} HTTP/1.1
Host: app.neostore.cloud
Authorization: Bearer YOUR_OAUTH2_TOKEN
Accept: */*

No content

Adds, replaces or removes individual configuration files; files absent from the archive are kept.

patch

/api/tenants/{tenantId}

Each archive entry replaces the server file at the same path; an empty entry deletes it. The resulting full configuration is then saved as by POST, including validation unless force is set.

Required scopes

This endpoint requires the following scopes:

Authorizations

OAuth2implicitRequired

Authorization URL:

Path parameters

tenantIdstringRequired

Identifier of the tenant.

Query parameters

forcebooleanOptional

true to save even when validation fails. Defaults to false.

Body

filestring · binaryOptional

Zip archive (multipart form field file) of the files to change; an empty file removes that path from the configuration.

Responses

200

Configuration saved.

Identifies one state of a tenant's whole configuration: which files exist and when each was last written.

versionstringRead-onlyOptional

Opaque token for the configuration as a whole, computed from Neo.Configuration.Tenants.TenantConfigurationVersionInformation.Files. It changes whenever any file is written, added or deleted, so two equal values mean the same configuration; empty when the tenant has no file.

appliedMigrationsstring[]Optional

Names of the platform's configuration upgrades this configuration is up to date with. An upgrade not listed here is still to be applied.

400

The file is missing, empty or not a zip archive, or the resulting configuration fails validation (the errors are listed under file).

401

The caller is not authenticated.

application/problem+json

403

The caller lacks the tenant.configuration:write scope.

application/problem+json

404

The tenant does not exist.

429

Over 1200 requests per minute to this endpoint for the tenant (default limit); retry after Retry-After.

application/problem+json

patch/api/tenants/{tenantId}

PATCH /api/tenants/{tenantId} HTTP/1.1
Host: app.neostore.cloud
Authorization: Bearer YOUR_OAUTH2_TOKEN
Content-Type: multipart/form-data
Accept: */*
Content-Length: 17

{
  "file": "binary"
}

{
  "version": "text",
  "files": {
    "ANY_ADDITIONAL_PROPERTY": 1
  },
  "appliedMigrations": [
    "text"
  ]
}

Gets the configuration a front-end app boots with: the tenant's base configuration merged with the named layout, the layout winning on conflicts.

get

/api/tenants/{tenantId}/{layoutId}

The response also carries the public settings the app needs (sign-in providers, locales, public documents, analytics and similar settings). A layout restricted to the tenant's redirect links is served only to a page opened from one of those links; otherwise 401.

Path parameters

tenantIdstringRequired

Identifier of the tenant.

layoutIdstringRequired

Name of the layout, without file extension.

Responses

200

Merged layout configuration returned.

anyOptional

401

The layout is restricted to the tenant's redirect links and the page was not opened from one.

404

The tenant does not exist, or it has no such layout.

429

Over 1200 requests per minute to this endpoint for the tenant (default limit); retry after Retry-After.

application/problem+json

get/api/tenants/{tenantId}/{layoutId}

GET /api/tenants/{tenantId}/{layoutId} HTTP/1.1
Host: app.neostore.cloud
Accept: */*

No content

Lists the saved versions of the tenant configuration, newest first, with the files each one changed and who saved it.

get

/api/tenants/{tenantId}/config/history

Each entry's user is resolved to a display name and email when the user still exists; a change made with an API key shows as API Key - {key name}. With files, only versions that changed a matching file are listed and total counts those.

Required scopes

This endpoint requires the following scopes:

Authorizations

OAuth2implicitRequired

Authorization URL:

Path parameters

tenantIdstringRequired

Identifier of the tenant.

Query parameters

filesstring[]Optional

File paths to filter on, case-insensitive, exact or with * as a wildcard. Omitted, every version is listed.

offsetinteger · int32Optional

Number of versions to skip, 0 or more; negative returns 400. Defaults to 0.

Default: 0

limitinteger · int32Optional

Maximum number of versions to return, 1 or more; 0 or less returns 400. Defaults to 50.

Default: 50

Responses

200

History returned; possibly empty.

One page of the saved versions of a tenant's configuration, newest first.

offsetinteger · int32Optional

Number of matching versions skipped before this page, as requested.

limitinteger · int32Optional

Maximum number of versions the page holds, as requested.

totalinteger · int32Optional

Number of versions matching the request across all pages: every saved version without a file filter, only those that changed a matching file with one. 0 when the tenant has no history.

400

offset is negative or limit is not positive.

401

The caller is not authenticated.

application/problem+json

403

The caller lacks the tenant.configuration:read scope.

application/problem+json

404

The tenant does not exist.

429

Over 1200 requests per minute to this endpoint for the tenant (default limit); retry after Retry-After.

application/problem+json

get/api/tenants/{tenantId}/config/history

GET /api/tenants/{tenantId}/config/history HTTP/1.1
Host: app.neostore.cloud
Authorization: Bearer YOUR_OAUTH2_TOKEN
Accept: */*

{
  "offset": 1,
  "limit": 1,
  "total": 1,
  "items": [
    {
      "id": "text",
      "date": "2026-01-01T00:00:00.000Z",
      "user": {
        "userName": null,
        "name": null,
        "email": null
      },
      "files": [
        "text"
      ]
    }
  ]
}

Runs every configuration check against the tenant's current configuration, and tells an authenticated back-office caller who the platform sees it as.

get

/api/tenants/{tenantId}/test

On success the body is tenantId and user: a back-office caller's userName, roles and permissions, otherwise null. On failure a back-office caller gets the error list under the empty key of errors.

Authorizations

OAuth2implicitOptional

Authorization URL:

Path parameters

tenantIdstringRequired

Identifier of the tenant.

Responses

200

Configuration valid.

No content

400

Configuration invalid; the errors are listed for a back-office caller.

401

The credentials sent are invalid.

application/problem+json

404

The tenant does not exist.

429

Over 1200 requests per minute to this endpoint for the tenant (default limit); retry after Retry-After.

application/problem+json

get/api/tenants/{tenantId}/test

GET /api/tenants/{tenantId}/test HTTP/1.1
Host: app.neostore.cloud
Authorization: Bearer YOUR_OAUTH2_TOKEN
Accept: */*

No content