Identity and tenancy
Mursil does not store users. Kayan, or any OIDC server, authenticates. Mursil authorizes the JWT.
Authority
Identity:Authority is the issuer. Identity:Audience for the API is mursil-api. The admin client id is mursil-admin-panel.
An empty authority does not open the portal and does not fall back to a local issuer. Admin refuses to start until Identity:Authority and Identity:ClientSecret are set. Server validates bearer tokens against the configured authority.
The dev issuer exists only for local click-through. Mursil:DevIssuer defaults to false. AppHost turns it on for local development. Published images do not. See Getting started.
Roles
The claim type is role. These are the six values.
| Role | What it is for |
|---|---|
| SystemAdmin | Platform owner. Opens the full operator surface. SuperAdmin is an alias. |
| TenantOwner | Tenant-level ownership, including provider creation and application registration. |
| TenantAdmin | Tenant administration. |
| TemplateEditor | Template catalog, versions, preview, and publish. |
| Operator | Delivery operations: retry, suppress, resolve, provider pause, audit. |
| Viewer | Read dashboards and health. |
Send and status use the policy Mursil.TransactionalSend: scope mursil.messages.send, or one of SystemAdmin, TenantOwner, TenantAdmin, Operator. Template management uses mursil.templates.manage or the template-management roles.
API scopes on the local issuer are mursil.messages.send and mursil.templates.manage.
Tenancy
Mursil:MultiTenancy defaults to false for a direct run and for the Docker image. Keep it false until one deployment serves many customer organizations.
When the switch is false:
- Callers omit the tenant id.
- URLs do not contain a tenant id.
- A tenant id that is sent is ignored.
- The migrator keeps one internal deployment tenant for templates, branding, and delivery. That id is not part of the public API.
When the switch is true:
- The integration package and tenant routes require a tenant id.
- The header is
X-Mursil-TenantId. - More than one tenant row is allowed.
- Public tracking and preference URLs include the tenant id.
Tenant isolation still applies to queries, provider routing, audit, and export. Platform-owner support is the explicit exception, not a default that skips the tenant scope.
Headers on send
| Header | When |
|---|---|
Authorization: Bearer | Whenever Identity:Authority is set. Always, in a real deployment. |
X-Mursil-ApplicationId | Every send and status call. Application guid. |
X-Mursil-ClientId | OAuth client id registered for that application. |
X-Mursil-TenantId | Only when Mursil:MultiTenancy is true. |