Control CoreDocs

OEM API-First Embedding

Audience: DevOps / Platform engineers building embedded PBAC controls
Time: ~20 min (after Control Plane + first Bouncer are deployed)

Use this guide when your platform needs Control Core as a behind-the-scenes authorization engine with minimal UI dependency.

Prerequisites

  • Control Plane is reachable (/devdocs, /health/ready)
  • At least one bouncer is registered to the target resource path
  • Sandbox and production API keys are available
  • Parent platform can call Control Core APIs with bearer auth

Troubleshooting: If /health/ready is not ready, check /health/database, /health/redis, and /health/bouncers before continuing. Full reference: /troubleshooting

Architecture Pattern

Click to enlarge

Golden API Flow

  1. POST /developer-portal/token
  2. POST /api/v2/oem/generate
  3. POST /api/v2/oem/validate
  4. POST /api/v2/oem/test
  5. POST /api/v2/oem/deploy (sandbox)
  6. Verify via POST /decisions/evaluate and GET /audit/logs or GET /audit/export
  7. Disable/archive/reactivate using policy lifecycle status updates

Troubleshooting: If deploy succeeds but enforcement does not change, verify resource/bouncer binding and run a fresh /health/bouncers plus /audit/logs query. Common causes: wrong environment, stale binding, or bypass traffic path. Full reference: /troubleshooting

Temporary vs Permanent Controls

  • Temporary controls: include expires_at metadata and pair it with explicit parent callbacks that disable/archive the control.
  • Permanent controls: keep active and promote with production workflow controls.

OEM Operator Automation

Use the bundled OEM support scripts from the deployment package:

  • bash scripts/oem_status_check.sh for post-deploy readiness checks
  • bash scripts/oem_support_bundle.sh for audit/troubleshooting evidence bundles

Troubleshooting: If script output is empty, verify CONTROL_CORE_API_URL and CONTROL_CORE_TOKEN values and confirm token permissions. Full reference: /guides/admin/troubleshooting

Next Steps