The sandbox above signs you into a shared tenant. To stand up your own tenant and gate an action, here is the full sequence. Self serve tenant creation is gated per account, so if the first call returns missing_token or a 403 that is the gate, not a mistake on your part. Your base URL is https://api.instruxi.dev (live now). Replace the placeholder values as you go. Values like $TENANT_CODE, $GROUP_ID and $ACCOUNT_ID come from the responses of earlier steps, noted inline below. Single quoted JSON does not expand shell variables, so substitute the real values by hand when you run these.

1. Create your tenant, no human in the loop

   Self serve tenant creation makes the caller the tenant admin and hands back the new tenant. The response carries the tenant (note its id and code) and your tenant admin session token. Use that token as $ADMIN_JWT and the tenant code as $TENANT_CODE below. The exact field names are in the worked reference, generated from the live spec.

   requestCOPY

   curl -X POST "$ENFORCER_BASE_URL/api/v1/enforcer/tenants/self-serve" \
     -H "Content-Type: application/json" \
     -d '{
       "name": "Acme Pay",
       "admin_email": "you@acme.com"
     }'
   
   # response: the new tenant (id, code) plus your tenant-admin session token

2. Mint a server API key

   Use the tenant admin token from the step above as the bearer. The plaintext key is shown once, store it now.

   requestCOPY

   curl -X POST "$ENFORCER_BASE_URL/api/v1/enforcer/api-keys" \
     -H "Authorization: Bearer $ADMIN_JWT" \
     -H "Content-Type: application/json" \
     -d '{ "name": "server-key" }'

   Response

   {
     "success": true,
     "data": { "key": "ek_live_9f3c...a71b", "api_key": { "id": "key_01J...", "name": "server", "key_prefix": "ek_live_9f3c" } }
   }

3. Register a user and request an OTP

   Register the account, then request an email OTP scoped to your tenant. In development the OTP is returned to you so you can script the flow.

   requestCOPY

   # register
   curl -X POST "$ENFORCER_BASE_URL/api/v1/enforcer/auth/register" \
     -H "Content-Type: application/json" \
     -d '{ "provider": "email_otp", "email": "user@acme.com" }'
   
   # request the OTP
   curl -X POST "$ENFORCER_BASE_URL/api/v1/enforcer/auth/otp/request" \
     -H "Content-Type: application/json" \
     -d '{ "email": "user@acme.com", "tenant_code": "$TENANT_CODE" }'

4. Log in to get a user JWT

   Exchange the OTP for a user bearer token plus a refresh token.

   requestCOPY

   curl -X POST "$ENFORCER_BASE_URL/api/v1/enforcer/auth/login" \
     -H "Content-Type: application/json" \
     -d '{
       "provider": "email_otp",
       "email": "user@acme.com",
       "otp": "123456",
       "tenant_code": "$TENANT_CODE"
     }'
   
   # response includes: token, refresh_token, expires_at, account

5. Add the user to the gating group

   The group is the capability gate. Membership is what unlocks the route the group protects. List your tenant's groups to find the one you want to gate on (its id is $GROUP_ID), then add the account ($ACCOUNT_ID from the login response above). The API key goes in the X-API-Key header. Groups are provisioned with your tenant, confirm with your Enforcer contact how your gating groups are seeded.

   requestCOPY

   # list this tenant's groups, take the id of the one you gate on
   curl "$ENFORCER_BASE_URL/api/v1/enforcer/groups" \
     -H "X-API-Key: $API_KEY"
   
   # add the account to it -> capability now unlocked
   curl -X POST "$ENFORCER_BASE_URL/api/v1/enforcer/groups/$GROUP_ID/members" \
     -H "X-API-Key: $API_KEY" \
     -H "Content-Type: application/json" \
     -d '{ "account_id": "$ACCOUNT_ID" }'