Admin SDK

The admin SDK is Dart only. There is no JavaScript or Python admin client.

Package: kataflax_admin_sdk. KataflaxAdminClient holds a platform JWT or personal access token and exposes typed sub-APIs for management routes under /api/....

Use it in scripts, MCP, and internal tools. Do not embed it in an end-user mobile or web app.

Install

kataflax_admin_sdk has publish_to: none. It is not on pub.dev, and it only works inside this repo. shared is already a path dependency of the admin package (path: ../../../shared); add the admin package only.

dependencies:
  kataflax_admin_sdk:
    path: ../kataflax_sdks/dart/admin_sdk

Adjust path to the app.

Sign in

auth.login stores the platform JWT. createApiKey returns UserApiKey; key.token is set only on create. That value is a personal access token (kfx_…). See Personal access tokens. The KATAFLAX_TOKEN comment is the env var MCP reads.

import 'package:kataflax_admin_sdk/kataflax_admin_sdk.dart';

final client = KataflaxAdminClient(baseUrl: 'https://api.tefily.com');

final session = await client.auth.login(
  email: 'owner@example.com',
  password: 'secret',
);

final key = await client.auth.createApiKey(name: 'MCP');
client.setToken(key.token!); // or export as KATAFLAX_TOKEN

final orgs = await client.organizations.list();
final projects = await client.projects.list(organizationId: orgs.first.id);
final schemas = await client.schemas.list(projects.first.id);

client.close();

Use either auth.login or setToken for a script that continues. A later login replaces the bearer with a new platform JWT. createApiKey(name: 'MCP') is how you mint the PAT. It is not a step in the provisioning script below.

Provision a project

This script sets up Database objects: a schema, fields, an endpoint toggle, and an access rule. schemas.create sends only { name }. Tefily then inserts every endpoint method with enabled: true: list, get, create, update, delete, upload, download, fileDelete. Turning delete off is a separate toggle. Compare e.method.value (a string). Rules attach to an endpoint id, not a schema id. fieldType is one of string, number, boolean, datetime, array, map, reference, file. ruleType: 'requireAuth' matches Access rules.

Shapes and the HTTP routes live on Schemas API, Collections, Endpoints, and Access rules.

createServiceToken returns ProjectServiceToken. .token is non-null only in that response. Print the kfxs_… value and stop. Do not setToken it onto this admin client. See Service tokens.

Optional arguments, not used in the script: createServiceToken also takes readOnly (default false) and expiresAt. fields.create also takes isArray, orderIndex, referencedSchemaId, and referencedCollection. schemas.create already inserts the endpoint rows, so this script does not call endpoints.create.

import 'package:kataflax_admin_sdk/kataflax_admin_sdk.dart';

final client = KataflaxAdminClient(baseUrl: 'https://api.tefily.com');

// Console login. Stores the platform JWT.
await client.auth.login(email: 'owner@example.com', password: 'secret');

// Or skip login and attach a personal access token:
// client.setToken('kfx_…');

final projectId = 'YOUR_PROJECT_ID';

final schema = await client.schemas.create(projectId, name: 'posts');
await client.fields.create(
  projectId,
  schema.id,
  name: 'title',
  fieldType: 'string',
  isRequired: true,
);
await client.fields.create(
  projectId,
  schema.id,
  name: 'status',
  fieldType: 'string',
);

final endpoints = await client.endpoints.list(projectId, schema.id);
final deleteEndpoint = endpoints.firstWhere((e) => e.method.value == 'delete');
await client.endpoints.toggle(
  projectId,
  schema.id,
  deleteEndpoint.id,
  enabled: false,
);

final listEndpoint = endpoints.firstWhere((e) => e.method.value == 'list');
await client.rules.create(
  projectId,
  listEndpoint.id,
  ruleType: 'requireAuth',
);

final minted = await client.projects.createServiceToken(projectId, name: 'backend');
print(minted.token); // kfxs_… once. Not an admin bearer.

client.close();

Sub-APIs

One method per property. Project management is client.lenast. UI builder is client.strala.

await client.lenast.projects.list(projectId);
await client.strala.getProject(projectId);

Property	Surface	One method
auth	Console sign-in and PATs	auth.login(email:, password:)
organizations	Organizations	organizations.list()
teams	Teams	teams.list(organizationId)
roles	Roles	roles.list(organizationId)
access	Access bindings	access.listBindings(organizationId)
projects	Projects and service tokens	projects.createServiceToken(projectId, name:)
schemas	Database tables	schemas.create(projectId, name:)
fields	Fields	fields.create(projectId, schemaId, name:, fieldType:)
endpoints	Endpoints	endpoints.toggle(projectId, schemaId, endpointId, enabled:)
rules	Access rules	rules.create(projectId, endpointId, ruleType:)
tableData	Console row browser (not the data-API client)	tableData.list(projectId, tableName)
files	Project file metadata	files.listProjectFiles(projectId)
webhooks	Data API webhooks	webhooks.list(projectId)
emailTriggers	Data API email triggers	emailTriggers.list(projectId)
dashboards	Dashboards	dashboards.list(projectId)
query	Saved widget query	query.execute(projectId, widgetQuery)
usage	Usage	usage.getApiCalls(projectId)
hosting	Hosting	hosting.listApps(projectId)
git	Git	git.listRepos(projectId)
dns	DNS	dns.listZones(projectId)
lenast	Project management	lenast.projects.list(projectId)
agents	Agents	agents.list(projectId)
strala	UI builder	strala.getProject(projectId)
assistant	Assistant	assistant.sendMessage(projectId:, sessionId:, content:)
conversationWorkspace	Assistant workspace on a repo	conversationWorkspace.ensureWorkspace(projectId, sessionId, repositoryId:)
llmCredentials	Model credentials	llmCredentials.listProjectCredentials(projectId)
billing	Billing	billing.getAccount(organizationId)
ops	Platform operator tools	ops.search(q)

client.lenast also has workItems, cycles, pages, admin, config, members, attachments, modules, views, intake, notifications, and workspace. See Project management and UI builder.

assistant.sendMessage returns Stream<AssistantEvent> (SSE). createSession(projectId) creates the session id that sendMessage takes.

ops is staff tooling: search, billing overrides, and support access.

Failures throw KataflaxException (statusCode, message, errors, and optional code, limitKey, limit, current, retryAfterSeconds). The client SDK exception has statusCode, message, and errors only. Pass onUnauthorized to clear a UI session on 401.

Tefily service tokens are created with projects.createServiceToken. They are not the admin client bearer. Admin calls need a platform JWT or a kfx_… PAT.

Related

• Service tokens
• Personal access tokens
• Platform auth
• MCP