5.A Admin-only and excluded endpoints (mapped, NOT implemented)

**Parent:** Story 5 (#7232)
**Type:** Tracking / documentation only - no tools built

## Why this exists

Per the requirement, every endpoint is mapped even when it will not become an MCP tool, so the decision is reversible. We build no admin tools: no MCP tool exposes admin behaviour, so admin operations are not reachable through MCP even for a PAT that has explicitly opted into admin (`adminOptIn = true`). If that policy ever changes, this list is the ready-made backlog.

This appendix is the aggregate roll-up. Admin endpoints that sit inside a scope which also has buildable tools are additionally tracked in that scope's `-d` sub-issue (e.g. 5.4-d for the `PUT /teams/:teamId` `properties` branch, 5.10-d for catalog writes, 5.14-d for billing manual/trial). Admin-only domains that have no buildable tools at all (`users.js`, `admin/*`, SSO providers, `settings PUT`) live only here.

## Admin-only (40 endpoints - excluded)

Every endpoint whose `needsPermission` scope maps to `role: Roles.Admin` in `forge/lib/permissions.js` (excluding `self: true` own-account routes, which are eligible - see 5.9).

**Platform administration** (`forge/routes/api/admin.js`, `users.js`, `settings.js`):
- `POST/DELETE /api/v1/admin/stats-token`, `GET /api/v1/admin/stats` - `platform:stats*` (there is no `GET /stats-token`; the GET is `/stats`)
- `GET/PUT /api/v1/admin/license` - `license:read`/`license:edit`
- `GET /api/v1/admin/audit-log` (+export) - `platform:audit-log`
- `GET /api/v1/admin/invitations` - `invitation:list`
- `POST/DELETE /api/v1/admin/expert-agent-creds` - `platform:expert-agent:creds`
- `POST /api/v1/admin/announcements` - `user:announcements:manage`
- `PUT /api/v1/settings` - `settings:edit`
- `GET/POST/PUT/DELETE /api/v1/users*` - `user:list`/`user:read`/`user:create`/`user:edit`/`user:delete`/`user:team:list` (arbitrary users; the `self` variants under `/api/v1/user/*` are eligible)

**Platform catalog writes** (list/read variants ARE eligible - see 5.10):
- `POST/PUT/DELETE /api/v1/stacks*` - `stack:create`/`edit`/`delete`
- `POST/PUT/DELETE /api/v1/templates*` - `template:create`/`edit`/`delete`
- `POST/PUT/DELETE /api/v1/project-types*` - `project-type:create`/`edit`/`delete`
- `POST/PUT/DELETE /api/v1/team-types*` - `team-type:create`/`edit`/`delete`
- `POST/PUT/DELETE/import /api/v1/flow-blueprints*` and `GET /export` - `flow-blueprint:create`/`edit`/`delete`

**Platform listings:**
- `GET /api/v1/teams` - `team:list` (platform-wide; per-team `GET /teams/:teamId` is eligible)
- `GET /api/v1/devices` - `device:list` (platform-wide; team/app device lists are eligible)

**Billing admin:**
- `POST/DELETE /ee/billing/teams/:teamId/manual` - `team:billing:manual`
- `POST /ee/billing/teams/:teamId/trial` - `team:billing:trial`

**SSO providers** (root-mounted `/ee/sso`, not part of the `/api/v1` mechanical scan): `GET/POST/PUT/DELETE /ee/sso/providers*` and `/test` - all `saml-provider:*` (Admin).

## Agent-facing (4 endpoints - excluded)

Device-agent runtime routes gated by device-token `ownerType`, no user permission - `forge/routes/api/deviceLive.js`:
- `POST/GET /api/v1/devices/:deviceId/live/state`, `GET .../live/snapshot`, `GET .../live/settings`

(The Node-RED runtime `/storage/*` flows/credentials/settings routes are similarly agent-token-only and were not part of the platform API scan.)

## Excluded by security / design (eligible-scope but not suitable)

- **Credential-issuing** (PAT-escalation, #7513): `POST /teams/:teamId/comms-credentials`, `POST /user/expert-creds`, `POST/PUT/DELETE /teams/:teamId/devices/provisioning*` (create returns the raw provisioning token; list summary is safe and eligible), broker `POST /client` & `/client/:username/link` & `PUT /client/:username` (can set the client password), 3rd-party broker `POST` & `GET /:brokerId/credentials`, `POST /teams/:teamId/databases`, `POST /teams/:teamId/git/tokens`, `GET/POST /teams/:teamId/npm/userToken`, `PUT /devices/:id/editor`, device `POST /:id/generate_credentials`, device `POST /:id/logs` & `/resources` (MQTT streams).
- **Sensitive self-service:** `PUT /user/change_password`, `DELETE /user`, `PUT/DELETE /user/mfa*`, `GET/POST/PUT/DELETE /user/tokens*` (token management via PAT - circular creation, #7515).
- **Anonymous / signature / token-type:** `GET /settings` (public tiers), `POST /ee/billing/callback` (Stripe), `GET /teams/:teamId/npm/catalogue` & `PUT /npm/subflow`, `GET /flow-blueprints/export-public`, device editor `/token`, `/comms/:access_token`, `/proxy/*`.
- **Internal MCP / expert / assistant plumbing:** `/api/v1/mcp` (405 stub, Story 1/3), `/api/v1/teams/:teamId/mcp` (NR-instance MCP registrations, self-registered by instance tokens), `/api/v1/expert/*` (first-party agent, mints instance MCP tokens), `/api/v1/assistant/*` (Node-RED editor AI, `assistant:call`, feature/tier-gated).

## Note
The full classified endpoint list and the per-endpoint gating detail behind these exclusions come from a line-by-line audit of the route handlers under `forge/routes/` and the scope-to-role map in `forge/lib/permissions.js`.

Read forge/lib/permissions.js and the route handlers under forge/routes/, starting with forge/routes/api/admin.js, users.js, settings.js, and deviceLive.js. Verify that the appendix accurately reflects excluded endpoints, permission scopes, and security/design exclusions. Done means the aggregate list and its endpoint counts remain consistent with the source routes and related sub-issues.

Written by the indexing model from the issue text.