Retire Bootstrap Admin

POST 
/api/v1/auth/setup/retire-admin

Retire the bootstrap admin: disable it and record the fact in the deploy repo.

The deployment mints the admin password and the engine reissues it whenever the injected value changes, so until it is retired anyone able to write the Secret or .env can issue themselves the admin at the next boot. Retiring ends the reseed: the account stays disabled, the password may be deleted, and breakglass is the recovery path.

The console keeps the bootstrap admin. Retiring it is an operator's policy choice made here. Refused unless the deployment already has an enabled admin-role account of its own -- retire_admin_available on the setup status is the same predicate. Returns the setup status, which now reports admin_retired. Reversal is not an API: remove admin_retired from governance/settings/auth.yaml in the deploy repo and restart.

Responses

200

Successful Response

401

No valid session: the credentials are missing, invalid or expired, or the account behind them is disabled or blocked

403

Refused: the session lacks the action this route checks, or its account must replace an issued password first. A SCIM route answers a refused action in the RFC 7644 error envelope

default

Problem details (RFC 9457)