Identity & Tenant Service

The centralized gatekeeper for the ranQup composable ecosystem — RoleWeaver, TalentProfiler, CompetenceScore and HPO Analytics. Multi-tenant, GDPR-compliant, OIDC-standard.

Hierarchical RBAC

Platform Admin → Org Admin → Dept/Team Manager → Member → External.

OIDC + MFA

Email/password + TOTP, ready for Azure AD and Google Workspace SSO.

Modular licensing

Per-tenant, per-module expiry drives JWT scopes downstream services enforce.

Audit-first

Append-only audit log for every access to sensitive HR data.

Public API surface

GET /api/public/identity/jwks.json — public keys for feedback tokens
POST /api/public/identity/introspect — validate a Supabase bearer, return roles + scopes
POST /api/public/identity/feedback/verify — verify a 360° feedback token