canonical: https://jentic.com/apis/nblocks.cloud/nblocks

# nBlocks API

The nBlocks API provides a multi-tenant SaaS platform backend for app management, user authentication, tenant management, role-based access control, feature flags, and payment plan handling. Developers integrate it to bootstrap a SaaS product without building auth, billing, or tenant isolation from scratch. The API exposes 50 endpoints covering app profile configuration, branding (custom CSS and translations), email templates, role definitions, and credential rotation through an x-api-key header.

## For AI agents

Configure SaaS app settings, manage tenants, roles, feature flags, and payment plans, and customise authentication branding and email templates for an nBlocks-powered application.

## Scope

Does not handle end-user sign-in flows, MFA challenges, or session token issuance - use for app, tenant, role, and branding configuration only.

## Capabilities

- Update app branding by uploading custom CSS and translation files for the login UI
- Define and assign roles with granular permission sets for multi-tenant access control
- Manage email templates used for verification, password reset, and tenant invitations
- Rotate app credentials and inspect credential state without redeploying the app
- Configure feature flags and payment plans that gate access to product tiers
- Provision and manage tenants under a single nBlocks app profile

## Use cases

### SaaS Tenant Onboarding Bootstrap

Use nBlocks to launch a multi-tenant SaaS product without building authentication, tenant isolation, role management, or billing plumbing. The API lets a backend service create the app profile, define roles, configure email templates, and wire up payment plans in a single integration. Time-to-launch drops from weeks of auth and billing work to a few days of configuration.

Example prompt: Create an admin role with permission to manage users and assign it to the first tenant via PUT `/role/{roleId}`

### Custom Branding for Login and Emails

White-label the nBlocks-hosted login experience by uploading custom CSS, translations, and per-template email content. Agencies and product teams use this to deliver a branded auth flow per customer, with branding changes applied at runtime without redeploying. The flow uses POST `/brand/css`, POST `/brand/translations`, and PUT `/email/template/{templateName}.`

Example prompt: Upload a custom CSS file via POST `/brand/css` and update the welcome email template via PUT `/email/template/welcome`

### Role and Permission Management

Define application-wide roles with permission sets, assign them to tenants, and update permissions over time as the product evolves. The role endpoints (GET /role, POST /role, PUT `/role/{roleId}`) give programmatic control over RBAC without touching the auth UI. Suitable for products with admin, member, and viewer tiers across hundreds of tenants.

Example prompt: List existing roles via GET /role and create a new viewer role with read-only permissions via POST /role

### Agent-Driven SaaS Configuration

AI agents use nBlocks through Jentic to provision new tenants, rotate credentials, and update branding on behalf of an administrator. Jentic stores the x-api-key in an isolated vault so the agent never sees the raw secret, and the agent searches by intent to find the right endpoint. Useful for ops automation, support bots, and internal admin agents.

Example prompt: Search Jentic for 'rotate nBlocks app credentials' and execute PUT `/app/credentials` with a new key

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| GET | `/app` | Get app profile |
| PUT | `/app/credentials` | Update app credentials |
| POST | `/role` | Create a new role |
| PUT | `/email/template/{templateName}` | Update an email template |
| POST | `/brand/css` | Upload custom CSS |
| POST | `/brand/translations` | Set custom translations |

## Key resources

- **App** — Manage the application profile and credentials
- **Brand** — Upload custom CSS and translations for the login UI
- **Email Templates** — Manage transactional email templates by name
- **Roles** — Define and update RBAC roles and permissions
- **Plans** — Configure payment plans and feature flags

## Why Jentic

- **Setup:** Wiring nBlocks by hand means learning its x-api-key header auth, splitting traffic between the account-api.nebulr-core.com and auth.nblocks.cloud hosts, and handling errors across app, tenant, and role calls yourself. Through Jentic you install once, import the nBlocks API from the API Directory, store the key once, and your agent calls it.
- **Permission scoping:** Most nBlocks operations carry their targets in the request body rather than in the URL path, so scope the agent to the operations it needs, such as reading the app config and creating a role. You choose the operations it may call, so writes like updating app credentials or branding CSS are not included unless you add them.
- **Credential handling:** Your nBlocks x-api-key is stored once, encrypted, by your own Jentic One instance and injected into the header at execution time. It never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'create a tenant role in nBlocks', and Jentic returns the matching operation with its input schema so the agent calls POST /role without browsing the reference docs.

## Related APIs

- **Auth0 Management API** — Auth0 covers authentication and user management at enterprise scale; nBlocks bundles auth with tenant, billing, and branding for SaaS bootstrapping.
- **Stytch API** — Stytch is a passwordless and password-based auth platform; nBlocks adds tenant, role, and payment-plan management on top.
- **Okta API** — Okta can act as the upstream identity provider for an nBlocks-powered SaaS via SSO.

## FAQ

### What authentication does the nBlocks API use?

The nBlocks API uses an API key passed in the `x-api-key` header (security scheme `apiKeyAuth`). Through Jentic, this key is stored in the encrypted vault and never enters the agent's context - agents call the API via scoped execution tokens.

### Can I manage roles and permissions with the nBlocks API?

Yes. The /role endpoints support listing all roles (GET /role), creating new roles (POST /role), and updating role permissions (PUT `/role/{roleId}`). Roles can be assigned to tenants to enforce RBAC across the SaaS application.

### What are the rate limits for the nBlocks API?

Public rate limits are not declared in the OpenAPI spec. Refer to the nBlocks documentation at nebulr-group.github.io/nblocks-api-docs for current quotas. Jentic surfaces 429 responses back to the agent so retries can be handled with exponential backoff.

### How do I customise the login page branding through Jentic?

Search Jentic for 'upload custom CSS to nBlocks' to find the POST `/brand/css` operation, load its schema, then execute with the CSS payload. Use POST `/brand/translations` for localisation strings on the same login UI.

### Can I rotate nBlocks app credentials programmatically?

Yes. PUT `/app/credentials` updates the credentials and GET `/app/credentialsState` returns the current rotation status. Jentic agents can call these directly without exposing the raw API key.

### Can I limit what my agent is allowed to do with the nBlocks API?

Yes. Because Jentic One is self-hosted, you decide which nBlocks operations your agent may call, so you can grant read-only access like GET /app while withholding everything else. Most nBlocks operations carry their targets in the request body rather than the URL, so scope the agent to exactly the operations it needs, such as reading the app config and creating a role via POST /role. Write operations like updating credentials through PUT `/app/credentials` or uploading branding CSS via POST `/brand/css` are not available to the agent unless you add them.