Tenants
Every customer on this platform. A tenant owns its own zones, users, policies and keys. Suspending a tenant refuses every request from its accounts until it is re-activated.
Filter
| Name | Slug | Status | Zones | Users | Quotas | Created | |
|---|---|---|---|---|---|---|---|
| Loading… | |||||||
Read-only mode — enable via
KNS_OPS_WRITE_ENABLED to activate the write surface.
Overview
Tenant
- Loading…
Zones
—
Records
—
Sum across all zones
Last backup
—
Outbox backlog
—
kns_outbox_pending
Health
—
Zones
Create zone
Filter
| Name | Type | Status | Serial | Records | Updated | |
|---|---|---|---|---|---|---|
| Loading… | ||||||
Zones › —
Add record
Assistant — describe a change in plain language
Records
| Name | Type | Content | TTL | Prio | |
|---|---|---|---|---|---|
| Loading… | |||||
Credentials
API keys
| Name | ID | Status | Created | Last used | |
|---|---|---|---|---|---|
| Loading… | |||||
Webhooks
| Name | URL | Events | Status | |
|---|---|---|---|---|
| Loading… | ||||
Users & roles
Users belong to this tenant. Roles (Zone Admin, Record Editor, Viewer) are granted per zone; a role assigned here applies on every zone it has permissions for. Deactivate leavers rather than deleting them so their audit history stays attributable.
Filter
| Username | Name | Roles | Admin | Status | ||
|---|---|---|---|---|---|---|
| Loading… | ||||||
Create user
Policies
Guardrails evaluated on every record write, in priority order.
DENY rules refuse a write when they match; ¬ marks a negated rule,
which fires on the non-compliant case. That is how TTL ranges and type whitelists are enforced.
Zone-scoped policies apply to one zone only.
| Priority | Policy | Scope | Rules | Status | |
|---|---|---|---|---|---|
| Loading… | |||||
Dry-run a record against the policies
Audit — most recent 50 entries
| When | Actor | Action | Resource | Detail | IP |
|---|---|---|---|---|---|
| Loading… | |||||
Ops-Health
Live counters scraped from /metrics.
Thresholds are advisory. See the runbook for escalation.
Last backup
—
< 26h < 48h ≥ 48h
Outbox backlog
—
kns_outbox_pending
0 < 100 ≥ 100
HTTP requests
—
kns_http_requests_total (all labels)
/health
—
Certificate issuance
Runs the four moves a certificate client makes: publish the
_acme-challenge record, wait for the authoritative
server to answer it, then remove it again. A real record is
written to your zone and removed, and the run is recorded in the
audit trail. No certificate is requested.
Tenant zones
Reading one named tenant. Nothing on this page is your own tenant's data.
| Zone | Setup | Where it is served | Records | State | Last change | Actions |
|---|---|---|---|---|---|---|
| Loading… | ||||||
People with a login here
| Username | Roles | State | |
|---|---|---|---|
| Loading… | |||
What has happened lately
| When | Who | Action | Result | What |
|---|---|---|---|---|
| Loading… | ||||
Records
| Name | Type | Content | TTL | State |
|---|
Adapters
Loading…
| Name | Role | Scope | Implementation | Configured | Healthy | Circuit breaker | Queue | DLQ | Drift | Last success | Last error | Capabilities | Actions |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Loading… | |||||||||||||
Integration
—
Configuration
Values live in /opt/kns/.env on the platform host; only presence is shown here. Restart kns-api, kns-worker and kns-beat after a change.
Run an action
Capabilities
| Capability | What it does | Required payload | Optional | Vendor call |
|---|---|---|---|---|
| Loading… | ||||
Outbox
| Updated | Capability | Tenant | Status | Attempts | Vendor id | Idempotency key | Last error | Payload |
|---|---|---|---|---|---|---|---|---|
| Loading… | ||||||||