Scope
This guide documents approved admin/team-management routes with behavior-level detail and explicit redaction boundaries.Published admin/team endpoints
/api/admin/teams/api/admin/teams/{teamId}/api/admin/teams/{teamId}/members/api/admin/teams/{teamId}/members/{userId}/api/admin/teams/{teamId}/upload-logo/api/admin/team-assignments/api/admin/stats(high-level contract)/api/admin/notifications/announce(behavior-level contract)/api/admin/leagues/sync/api/admin/teams/sync/api/admin/users/{userId}/rep(D-Sports Direct grant;isAdminonly)/api/admin/players/{playerId}/availability(platform admin; manual availability/injury. Null status clears back to available)- Additional team-manager surfaces exist under
/api/admin/*(entities, mint lock, pins, analytics period). Document RBAC only; redact ops internals.
RBAC requirements
- Requests require authenticated user context.
- Routes enforce role-gated access (platform role and/or team assignment role).
- Ownership/last-owner safeguards are enforced server-side for assignment/member mutations.
Redacted/excluded capabilities
- Internal remediation/fix endpoints and privileged internals are omitted.
- Secret values, bootstrap pathways, and debug-only controls are intentionally excluded from this guide.