JENNi Portal API
The partner self-service portal: what a signed-in partner USER does with their account — see who they are and which keys their tenant holds, ask JENNi for a key, more scope, production access or help, follow those requests, and claim an approved key (the one moment its secret is shown). Where the deployment advertises `self_serve.keys` (`GET /provider/v1/portal/me`), a sandbox tenant also mints its own keys (`POST /provider/v1/portal/keys`) and rotates or revokes them (`POST /provider/v1/portal/keys/{id}/transitions`) without an operator; `GET /provider/v1/portal/health` is the integration card — tenant, key summary and recent ingestion in one read that degrades section by section instead of failing. These routes are called with a partner access token (`Authorization: Bearer …`, obtained from identity-service's public `POST /v1/partner/auth/login`), never with an API key: a key on a portal route is a `403`, and a partner token on a key route is a `401`. provider-bff forwards each call to identity-service, which owns partner accounts, requests, grants and keys; identity's own refusal comes back with its status and problem `type`. Ships dark behind `ENABLE_PORTAL_ROUTES`.