Admin API

The cluster admin REST surface mounted under /minio/admin/v3. It's what mc admin and the embedded console call. The wire types live in github.com/minio/madmin-go/v3; the server side is split across many files in cmd/.

Purpose

• Cluster operations: status, info, profile, trace, heal, decommission, rebalance.
• Configuration management: read/write the per-cluster config tree.
• IAM management: users, groups, policies, service accounts.
• Identity providers: LDAP, OpenID, mTLS, plugin.
• Site replication, bucket replication targets, KMS, tiers, batch jobs.

Layout

cmd/
├── admin-router.go                   # All routes
├── admin-handlers.go                 # ~100 KB grab bag
├── admin-handler-utils.go            # Auth + arg parsing
├── admin-server-info.go
├── admin-bucket-handlers.go
├── admin-handlers-config-kv.go
├── admin-handlers-idp-config.go
├── admin-handlers-idp-ldap.go
├── admin-handlers-idp-openid.go
├── admin-handlers-pools.go           # Decom + rebalance
├── admin-handlers-site-replication.go
├── admin-handlers-users.go           # IAM
├── admin-heal-ops.go                 # Heal endpoints
├── kms-handlers.go                   # KMS endpoints
└── tier-handlers.go                  # ILM tier admin

Key abstractions

Symbol	File	What it is
validateAdminReq	cmd/admin-handler-utils.go	Auth gate.
madmin.Client (external)	madmin-go	The Go client for the API.
Per-area handlers	cmd/admin-handlers-<area>.go	Implement the API.

Routes

The full route table is in cmd/admin-router.go. Examples:

• GET /minio/admin/v3/info — cluster overview.
• GET /minio/admin/v3/storageinfo — drive-level usage.
• GET /minio/admin/v3/datausageinfo — bucket-level usage.
• POST /minio/admin/v3/heal/<bucket>/<prefix> — start a heal job.
• GET /minio/admin/v3/heal/<bucket>/<prefix>?status=true — poll heal job.
• POST /minio/admin/v3/site-replication/add — bootstrap site replication.
• POST /minio/admin/v3/start-job — submit a batch job.
• GET /minio/admin/v3/trace?call=all — server-sent stream of trace events.
• POST /minio/admin/v3/profile?action=start&type=cpu — start a pprof profile.

The full list spans many files; the router is the single source of truth.

Auth

Admin requests must be signed with credentials that have admin privileges. validateAdminReq checks the action against the caller's policies via IAMSys.IsAllowed. The mc admin CLI auto-detects the right credentials from the alias.

Integration points

• Reads/writes cluster config via cmd/config-current.go.
• Drives heal jobs via cmd/admin-heal-ops.go.
• Drives decom/rebalance via cmd/admin-handlers-pools.go → cmd/erasure-server-pool-decom.go and cmd/erasure-server-pool-rebalance.go.
• IAM operations propagate via cmd/iam.go and (when enabled) via cmd/site-replication.go.

Entry points for modification

• New admin endpoint. Add a handler to the right admin-handlers-*.go file, register it in cmd/admin-router.go, add the wire type to madmin-go. Update mc admin separately.
• New action label. Extend pkg/v3/policy admin actions and the policy evaluator.