Supreme API: Tenants, Plans, Users, and RFID Config

The Supreme API gives Dragon Guard WMS platform operators full cross-tenant control from a single privileged interface. Through these endpoints, a Supreme administrator can onboard new tenant companies, assign subscription plans, bootstrap tenant admin users, and configure RFID hardware integration settings and per-module policies for each tenant. Every endpoint under /api/supreme/* enforces the SUPERADMIN_SUPREMO role at the backend — the Angular route guard (supremeGuard) provides a UI-level check only and must never be relied upon as a security boundary.

Backend authorization is mandatory and cannot be bypassed. The supremeGuard applied in the Angular router is a convenience layer that prevents accidental navigation — it does not replace server-side role enforcement. Every request to /api/supreme/* must carry a valid session token for a SUPERADMIN_SUPREMO user; the backend rejects all others with 401.

Dashboard

GET /api/supreme/dashboard

Returns a high-level SaaS summary dashboard with platform-wide metrics across all tenants. Used to populate the Supreme home screen.

GET /api/supreme/dashboard

Response

totalCompanies

integer

Total number of registered tenant companies on the platform.

activeCompanies

integer

Number of companies with active subscription status.

totalUsers

integer

Combined user count across all tenants.

planBreakdown

array

Show PlanSummary

planId

string

Subscription plan identifier.

planName

string

Human-readable plan name.

companyCount

integer

Number of companies currently on this plan.

Error Responses

Status	Description
`401`	Missing or invalid `SUPERADMIN_SUPREMO` session.
`500`	Internal server error.

Companies

GET /api/supreme/companies

Returns the list of all tenant companies registered on the platform.

GET /api/supreme/companies

Response

data

array

Show CompanySummary

string

Unique company identifier.

name

string

Legal or display name of the tenant company.

planId

string

Identifier of the subscription plan assigned to this company.

status

string

Company status (e.g., ACTIVE, INACTIVE, SUSPENDED).

createdAt

string (ISO 8601)

Timestamp when the company was registered.

POST /api/supreme/companies

Creates a new tenant company on the platform. After creation, use POST /api/supreme/companies/{tenantId}/users to bootstrap the initial admin user.

POST /api/supreme/companies

Request Body

name

string

required

Display name for the new tenant company.

planId

string

required

Subscription plan to assign. Use GET /api/supreme/plans to retrieve valid plan IDs.

taxId

string

Tax or legal registration identifier for the company.

contactEmail

string

Primary contact email for the tenant.

settings

object

Optional initial configuration settings for the tenant.

Response

Returns the newly created company object. Shape mirrors GET /api/supreme/companies/{id}.

Error Responses

Status	Description
`400`	Validation error — missing required fields or invalid `planId`.
`401`	Insufficient privileges.
`500`	Internal server error.

GET /api/supreme/companies/

Returns full detail for a single tenant company, including all integration settings configured for that tenant.

GET /api/supreme/companies/{id}

Path Parameters

string

required

Unique identifier of the tenant company.

Response

string

Unique company identifier.

name

string

Display name of the tenant company.

planId

string

Assigned subscription plan identifier.

status

string

Company status: ACTIVE, INACTIVE, or SUSPENDED.

taxId

string

Tax or legal registration identifier.

contactEmail

string

Primary contact email.

integrationSettings

object

Show IntegrationSettings

rfid

object

RFID integration configuration. See RFID Settings and RFID Policies sections below.

createdAt

string (ISO 8601)

Timestamp when the company was registered.

PUT /api/supreme/companies/

Updates company information for the specified tenant. All updatable fields should be included in the request body even if unchanged (full replacement semantics).

PUT /api/supreme/companies/{id}

Path Parameters

string

required

Unique identifier of the tenant company.

Request Body

name

string

Updated display name for the company.

planId

string

Updated subscription plan identifier.

taxId

string

Updated tax or legal registration identifier.

contactEmail

string

Updated primary contact email.

status

string

Updated company status: ACTIVE, INACTIVE, or SUSPENDED.

Response

Returns the updated company object. Shape mirrors GET /api/supreme/companies/{id}.

Error Responses

Status	Description
`400`	Validation error or invalid field values.
`401`	Insufficient privileges.
`500`	Internal server error.

Plans

GET /api/supreme/plans

Returns all available subscription plans that can be assigned to tenant companies.

GET /api/supreme/plans

Response

data

array

Show Plan

string

Unique plan identifier. Use this value when creating or updating a company.

name

string

Human-readable plan name displayed in the UI.

description

string

Optional description of plan features or limits.

isActive

boolean

Whether this plan is currently available for assignment.

Error Responses

Status	Description
`401`	Insufficient privileges.
`500`	Internal server error.

Tenant Users

GET /api/supreme/companies//users

Returns the list of users belonging to the specified tenant company.

GET /api/supreme/companies/{tenantId}/users

Path Parameters

tenantId

string

required

Unique identifier of the tenant company.

Response

data

array

Show TenantUser

string

Unique user identifier.

username

string

User email address.

role

string

Role assigned to this user within their tenant.

isActive

boolean

Whether the user account is currently active.

createdAt

string (ISO 8601)

Timestamp when the user was created.

POST /api/supreme/companies//users

Bootstraps a tenant admin user for the specified company. On first call, a new admin user is created and a one-time temporary password is returned. If a tenant admin already exists, the backend may reuse the existing user record.

POST /api/supreme/companies/{tenantId}/users

The temporary password (following the 123456789 seed pattern) is returned once in the creation response. Store it securely immediately — it cannot be retrieved again from this endpoint. The tenant admin must change this password on first login.

Path Parameters

tenantId

string

required

Unique identifier of the tenant company for which to bootstrap an admin user.

Request Body

username

string

required

Desired username for the tenant admin account.

string

required

Email address for the new admin user.

firstName

string

First name of the admin user.

lastName

string

Last name of the admin user.

Response

string

Unique identifier of the created or reused user.

username

string

Username for the admin account.

string

Email address of the admin user.

temporaryPassword

string

One-time temporary password. Present only on initial creation. Not returned if an existing admin was reused.

isExisting

boolean

true if the backend reused an existing admin user rather than creating a new one.

Error Responses

Status	Description
`400`	Missing required fields or invalid `tenantId`.
`401`	Insufficient privileges.
`500`	Internal server error.

RFID Settings

PATCH /api/supreme/companies//integration/rfid-settings

Updates the global RFID integration settings for the specified tenant. This controls whether RFID is enabled and which warehouse modules are in scope.

PATCH /api/supreme/companies/{id}/integration/rfid-settings

Path Parameters

string

required

Unique identifier of the tenant company.

Request Body

enabled

boolean

required

Whether RFID integration is active for this tenant.

mode

string

RFID operating mode (e.g., READ_ONLY, READ_WRITE). Accepted values depend on tenant hardware configuration.

moduleScopes

object

Controls which warehouse modules participate in RFID processing.

Show moduleScopes fields

moduleScopes.inquiry

boolean

Enable RFID for inventory inquiry operations.

moduleScopes.receipts

boolean

Enable RFID for goods receipt operations.

moduleScopes.shipments

boolean

Enable RFID for shipment operations.

moduleScopes.movements

boolean

Enable RFID for internal inventory movement operations.

Response

Returns the updated RFID settings object for the tenant.

Error Responses

Status	Description
`400`	Invalid field values or missing required fields.
`401`	Insufficient privileges.
`500`	Internal server error.

RFID Policies

GET /api/supreme/companies//integration/rfid-policies

Returns per-module RFID behavior policies for the specified tenant. If no policy has been persisted for a module, the frontend should render it using system defaults rather than treating the absence as an error.

GET /api/supreme/companies/{id}/integration/rfid-policies

Path Parameters

string

required

Unique identifier of the tenant company.

Response

Returns a policy object keyed by module. Each module — inquiry, receipts, shipments, and movements — carries the following fields:

{module}

object

Policy configuration for each module scope.

Show RfidModulePolicy fields

manualFallback

boolean

Whether operators may manually enter tag data when RFID reads fail.

barcodeFallback

boolean

Whether barcode scanning is permitted as a fallback when RFID is unavailable.

exactMatch

boolean

Whether tag data must exactly match the expected value; partial matches are rejected when true.

duplicateReadWindow

integer

Time window in milliseconds during which duplicate tag reads are suppressed.

evidenceFlag

boolean

Whether RFID read evidence (e.g., signal strength, timestamp) is stored alongside transactions.

auditFlag

boolean

Whether RFID events for this module are written to the audit log.

ignoreDuplicateReadsWithinWindow

boolean

When present and true, the duplicateTagBehavior dropdown in the UI is derived from this value and should be disabled to prevent conflicting configuration.

PUT /api/supreme/companies//integration/rfid-policies

Replaces the per-module RFID policies for the specified tenant. If the backend returns ignoreDuplicateReadsWithinWindow: true in the response, the duplicateTagBehavior selection is derived automatically and the corresponding UI control must be treated as read-only.

PUT /api/supreme/companies/{id}/integration/rfid-policies

Path Parameters

string

required

Unique identifier of the tenant company.

Request Body

inquiry

object

Policy settings for the inventory inquiry module. Fields mirror the response schema described under GET /api/supreme/companies/{id}/integration/rfid-policies.

receipts

object

Policy settings for the goods receipt module.

shipments

object

Policy settings for the shipment module.

movements

object

Policy settings for the internal movement module.

Response

Returns the full updated policy object. Shape mirrors GET /api/supreme/companies/{id}/integration/rfid-policies.

Error Responses

Status	Description
`400`	Invalid policy values or conflicting configuration.
`401`	Insufficient privileges.
`500`	Internal server error.

RFID Events and Tags

The following RFID endpoints are shared with the tenant context but are accessible from the Supreme interface when scoped by companyId. Supreme operators use these to inspect raw RFID activity and manage tag registrations for any tenant.

GET /api/rfid/events

Returns RFID reader events filtered to a specific tenant. Accepts the same filters as the tenant-facing RFID events view.

GET /api/rfid/events?companyId={id}

Query Parameters

companyId

string

required

Tenant company identifier. Required when called from the Supreme context to scope results to a single tenant.

GET /api/rfid/tags

Returns registered RFID tags for the specified tenant.

GET /api/rfid/tags?companyId={id}

Query Parameters

companyId

string

required

Tenant company identifier.

POST /api/rfid/tags

Registers a new RFID tag for the authenticated tenant.

POST /api/rfid/tags

POST /api/rfid/tags/bulk

Bulk-registers multiple RFID tags in a single request.

POST /api/rfid/tags/bulk

GET /api/rfid/tags/

Returns detail for a single registered RFID tag.

GET /api/rfid/tags/{id}

Path Parameters

string

required

Unique identifier of the RFID tag record.

PUT /api/rfid/tags//deactivate

Deactivates a registered RFID tag, preventing it from being recognized in future reads.

PUT /api/rfid/tags/{id}/deactivate

Path Parameters

string

required

Unique identifier of the RFID tag to deactivate.

Error Responses (all RFID endpoints)

Status	Description
`400`	Missing or invalid parameters.
`401`	Unauthenticated or unauthorized request.
`500`	Internal server error.

Authentication

Inventory

Commercial

Admin

Documentation Index

​Dashboard

​GET /api/supreme/dashboard

​Response

​Error Responses

​Companies

​GET /api/supreme/companies

​Response

​POST /api/supreme/companies

​Request Body

​Response

​Error Responses

​GET /api/supreme/companies/

​Path Parameters

​Response

​PUT /api/supreme/companies/

​Path Parameters

​Request Body

​Response

​Error Responses

​Plans

​GET /api/supreme/plans

​Response

​Error Responses

​Tenant Users

​GET /api/supreme/companies//users

​Path Parameters

​Response

​POST /api/supreme/companies//users

​Path Parameters

​Request Body

​Response

​Error Responses

​RFID Settings

​PATCH /api/supreme/companies//integration/rfid-settings

​Path Parameters

​Request Body

​Response

​Error Responses

​RFID Policies

​GET /api/supreme/companies//integration/rfid-policies

​Path Parameters

​Response

​PUT /api/supreme/companies//integration/rfid-policies

​Path Parameters

​Request Body

​Response

​Error Responses

​RFID Events and Tags

​GET /api/rfid/events

​Query Parameters

​GET /api/rfid/tags

​Query Parameters

​POST /api/rfid/tags

​POST /api/rfid/tags/bulk

​GET /api/rfid/tags/

​Path Parameters

​PUT /api/rfid/tags//deactivate

​Path Parameters

​Error Responses (all RFID endpoints)

Build docs developers (and LLMs) love

Dashboard

GET /api/supreme/dashboard

Response

Error Responses

Companies

GET /api/supreme/companies

Response

POST /api/supreme/companies

Request Body

Response

Error Responses

GET /api/supreme/companies/

Path Parameters

Response

PUT /api/supreme/companies/

Path Parameters

Request Body

Response

Error Responses

Plans

GET /api/supreme/plans

Response

Error Responses

Tenant Users

GET /api/supreme/companies//users

Path Parameters

Response

POST /api/supreme/companies//users

Path Parameters

Request Body

Response

Error Responses

RFID Settings

PATCH /api/supreme/companies//integration/rfid-settings

Path Parameters

Request Body

Response

Error Responses

RFID Policies

GET /api/supreme/companies//integration/rfid-policies

Path Parameters

Response

PUT /api/supreme/companies//integration/rfid-policies

Path Parameters

Request Body

Response

Error Responses

RFID Events and Tags

GET /api/rfid/events

Query Parameters

GET /api/rfid/tags

Query Parameters

POST /api/rfid/tags

POST /api/rfid/tags/bulk

GET /api/rfid/tags/

Path Parameters

PUT /api/rfid/tags//deactivate

Path Parameters

Error Responses (all RFID endpoints)