# Admin API Overview

> Manage trunks, service accounts, certificates, and AI agent DAGs.

The FirstByte gateway exposes a second RPC surface: the **Admin API**.
This is in addition to the call-control RPCs documented under
[RPC](/rpc/overview). Tenants and operators use the Admin API to
configure the platform itself. Tasks include: provision SIP trunks,
rotate service-account keys, swap TLS certificates without a restart,
and publish AI agent DAGs.

> **WARNING:**
> **No SDK is provided for the Admin API.** The public-facing SDKs
> (`clutchcall-agents`, `@clutchcall/agents`, `github.com/clutchcall/clutchcall-sdk/go`, …) cover
> *call-control* RPCs only. They deliberately do not include admin
> methods. Tenants and operators talk to the admin gateway directly with
> the [raw RPC envelope](/rpc/envelope-format) over QUIC. The schemas on
> the following pages give you all that you need to drive it from any
> QUIC client.

## Endpoint

```
quic://admin.firstbyte.fast:9090   (ALPN: h3)
```

The admin gateway is a logically distinct service on the same QUIC port.
It terminates a different `service_name` (`admin_gateway` instead of
`clutchcall`). Method IDs are CRC-derived from the admin
namespace. They will not collide with the public RPC table.

## Authentication

Every admin request carries an `admin_token` field on the wire. The token
is a JWT minted from a service account with the `admin` role. It is
signed in the same way as the regular SDK JWTs (see
[Authentication](/concepts/authentication)).

`BootstrapOrg` is the only exception. It accepts a one-shot bootstrap
secret instead, because it is the call that mints the first admin
service account for a new tenant.

## What's covered

  - **[Trunks](/admin/trunks)** — `AddTrunk`, `UpdateTrunk`, `RemoveTrunk`, `GetTrunk`. Configure SIP/RTP
    addressing, codec preferences, inbound rules, and AI handoff URLs.
  - **[Service Accounts](/admin/service-accounts)** — `SessionAuth`, `PublishServiceAccount`, `RevokeServiceAccount`.
    Lifecycle for the JWT signing keys that your SDKs use.
  - **[Certificates](/admin/certificates)** — `ReloadCertificates`. Hot-swap the gateway's TLS material without
    dropping in-flight QUIC connections.
  - **[Organisation](/admin/organisation)** — `BootstrapOrg`. One-shot setup for a new tenant.
  - **[Agent DAGs](/admin/agent-dags)** — `PublishAgentDag`, `GetAgentDag`, `ListAgentDags`, `DeleteAgentDag`.
    Define the AI orchestration graphs that calls bind to.

## Method table

| Method                  | Request DTO                       | Response DTO                  |
| ----------------------- | --------------------------------- | ----------------------------- |
| `AddTrunk`              | `AddTrunkRequest`                 | `Empty`                       |
| `UpdateTrunk`           | `UpdateTrunkRequest`              | `Empty`                       |
| `RemoveTrunk`           | `RemoveTrunkRequest`              | `Empty`                       |
| `GetTrunk`              | `GetTrunkRequest`                 | `GetTrunkResponse`            |
| `ReloadCertificates`    | `ReloadCertificatesRequest`       | `ReloadCertificatesResponse`  |
| `SessionAuth`           | `SessionAuthRequest`              | `SessionAuthResponse`         |
| `PublishServiceAccount` | `PublishServiceAccountRequest`    | `Empty`                       |
| `RevokeServiceAccount`  | `RevokeServiceAccountRequest`     | `Empty`                       |
| `BootstrapOrg`          | `BootstrapOrgRequest`             | `BootstrapOrgResponse`        |
| `PublishAgentDag`       | `PublishAgentDagRequest`          | `PublishAgentDagResponse`     |
| `GetAgentDag`           | `GetAgentDagRequest`              | `GetAgentDagResponse`         |
| `ListAgentDags`         | `ListAgentDagsRequest`            | `ListAgentDagsResponse`       |
| `DeleteAgentDag`        | `DeleteAgentDagRequest`           | `Empty`                       |

The wire envelope is identical to the public RPC. It uses the same
`[u32 length][u32 method_id][serde body]` framing. See
[Envelope Format](/rpc/envelope-format).