Maif Otoroshi Admin API

Name: Otoroshi Admin API
Brand: Otoroshi Admin API
Availability: InStock

✓ Official Vendor SpecDeveloper ToolsMonitoring Observabilitybasic102 EndpointsREST

For Agents

Configure an Otoroshi reverse proxy through 102 admin endpoints — register services, mint API keys with quotas, manage JWT verifiers, and update routing live without restarting the gateway.

Install Jentic One Beta

Connect the Otoroshi Admin API to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Otoroshi Admin API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with Otoroshi Admin API.

Issue API keys scoped to a service or group and enforce per-key quota limits

Configure global JWT verifiers and authentication module configs for protected services

GET STARTED

Start building with Otoroshi Admin API

Explore with Jentic

View OpenAPI Document

Use Cases

Patterns agents use Otoroshi Admin API for, with concrete tasks.

★ Microservice Gateway Provisioning

Onboard a new microservice behind Otoroshi by creating a service descriptor that maps a public host to upstream targets, attaching it to a service group, and minting scoped API keys for downstream consumers. The Admin API exposes service, group, and apikey resources so the entire onboarding can run from a CI pipeline rather than the Otoroshi UI. A typical onboarding takes minutes once the descriptor template is parameterised.

Create a service descriptor named orders-api routing orders.example.com to two upstream targets, attach it to the production group, then create an API key with a 5000-call daily quota.

API Key Quota Management

Operate an internal API marketplace by issuing per-consumer API keys with read-only quota visibility. Each key sits inside a service or group, and the quotas endpoint reports remaining call budget so an agent can renew, throttle, or revoke keys before consumers hit hard limits. Resetting a quota is a single DELETE call against the quotas resource.

Fetch the quota state for clientId abc123 on serviceId orders-api, and if remaining calls are below 100, reset the quota and notify the owning team.

JWT and Auth Module Lifecycle

Manage authentication configuration centrally by maintaining global JWT verifiers and auth module configs through the API. Verifiers can be created, patched with a JSON diff, or deleted as identity providers rotate keys, so an agent can reconcile gateway auth with an upstream IdP without operator intervention.

List all global JWT verifiers, find the one named auth0-prod, and PATCH it to add a new audience value of orders-api.

Agent-Managed Gateway Operations

An AI agent invoked through Jentic can run end-to-end Otoroshi operations such as adding a target to a service, compiling a transformer script, and verifying that the new configuration is live. The agent receives basic-auth credentials from the Jentic vault and never sees raw secrets, which makes Otoroshi safe to expose to autonomous workflows that touch production routing.

Add a new upstream target with weight 20 to serviceId orders-api, then GET the targets list and confirm the addition before exiting.

Key Endpoints

102 endpoints — otoroshi is an open-source layer of lightweight api management developed by maif.

METHOD

PATH

DESCRIPTION

GET

/api/services

List all service descriptors

POST

/api/services

Create a new service descriptor

POST

/api/groups/{groupId}/apikeys

Mint an API key for a service group

GET

/api/services/{serviceId}/apikeys/{clientId}/quotas

Read the current quota state for an API key

POST

/api/verifiers

Create a global JWT verifier

POST

/api/scripts/_compile

Compile a transformer script

POST

/api/services/{serviceId}/targets

Add an upstream target to a service descriptor

GET

/api/services

List all service descriptors

POST

/api/services

Create a new service descriptor

POST

/api/groups/{groupId}/apikeys

Mint an API key for a service group

GET

/api/services/{serviceId}/apikeys/{clientId}/quotas

Read the current quota state for an API key

POST

/api/verifiers

Create a global JWT verifier

Why Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

Otoroshi admin client_id and client_secret pairs are stored encrypted in the Jentic vault. Agents receive a scoped basic-auth token at execution time and the raw credentials never enter the agent context.

Intent-based discovery

Agents search Jentic by intent (e.g., "create an otoroshi api key") and Jentic returns the matching POST /api/groups/{groupId}/apikeys operation with its input schema, so the agent calls the right endpoint without browsing the Otoroshi docs.

Time to first call

Direct Otoroshi integration: 1-3 days to set up the basic-auth flow, schema handling, and error recovery for 102 endpoints. Through Jentic: under 1 hour — search, load, execute.

FAQs

Specific to using Otoroshi Admin API through Jentic.

What authentication does the Otoroshi Admin API use?

The Otoroshi Admin API uses HTTP Basic authentication via the otoroshi_auth scheme. Requests must include an Authorization header with a base64-encoded admin client_id and client_secret pair issued from the Otoroshi UI. Through Jentic, the credentials are stored encrypted in the vault and injected at execution time, so the agent never sees the raw secret.

Can I manage API key quotas with the Otoroshi Admin API?

Yes. GET /api/services/{serviceId}/apikeys/{clientId}/quotas returns the current consumption state for a key, and DELETE on the same path resets the counter. The same pattern is available under /api/groups/{groupId}/apikeys/{clientId}/quotas for keys scoped to a service group.

What are the rate limits for the Otoroshi Admin API?

The Admin API itself does not publish a rate limit — Otoroshi is a self-hosted gateway, so admin throughput is bounded by the resources of the instance you operate. If you put the admin endpoint behind another Otoroshi service, you can apply your own quota policy to it.

How do I register a new service through Jentic?

Search Jentic for "register a service in otoroshi" to load the POST /api/services operation, then call execute with a service descriptor JSON body that names the upstream targets, host, and group. A template is available from GET /new/service to seed the descriptor.

Is the Otoroshi Admin API free to use?

Yes. Otoroshi is open-source software released by MAIF under the Apache 2.0 licence. There is no per-call fee — you only pay for the infrastructure that runs the gateway.

Can I deploy custom transformer scripts through the Admin API?

Yes. POST /api/scripts/_compile compiles a script source against the running Otoroshi version and returns errors if it does not type-check. Once compiled, POST /api/scripts persists the script and it can be referenced from a service descriptor for request or response transformation.

Maif Otoroshi Admin API

Connect the Otoroshi Admin API to your agent

Capabilities

Start building with Otoroshi Admin API

Use Cases

Key Endpoints

Why Jentic?

Related APIs

FAQs