healthcloud-tenantadmin 0.1.0__tar.gz

healthcloud_tenantadmin-0.1.0/.gitignore

@@ -0,0 +1,81 @@
+# Logs
+logs/
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+pnpm-debug.log*
+
+# Environment files
+.env
+.env.*
+!.env.example
+**/live-state.json
+
+# Node / npm
+node_modules/
+.npm/
+.pnpm-store/
+dist/
+!packages/npm/dist/
+!packages/npm/dist/**
+build/
+
+# packages/cli/npm bundles the manifest from packages/cli/contracts at build/
+# test time (scripts/copy-manifest.cjs) — that copy is generated, not source.
+packages/cli/npm/contracts/
+coverage/
+*.tsbuildinfo
+
+# Python / pip
+__pycache__/
+*.py[cod]
+*.pyo
+.Python
+.venv/
+venv/
+env/
+pip-wheel-metadata/
+*.egg-info/
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+htmlcov/
+
+# Java / Maven
+target/
+.mvn/timing.properties
+.mvn/wrapper/maven-wrapper.jar
+*.class
+*.jar
+*.war
+*.ear
+
+# .NET / NuGet
+# Scoped to packages/nuget/ specifically — an unscoped `bin/`/`obj/` matches
+# a directory of that name at ANY depth (gitignore has no implicit anchor),
+# which silently swallowed the real source file packages/cli/npm/src/bin/hc.ts
+# and broke that package's CI build (the file was never committed).
+packages/nuget/**/bin/
+packages/nuget/**/obj/
+TestResults/
+*.nupkg
+*.snupkg
+*.user
+*.suo
+
+# IDEs and editors
+.idea/
+.vscode/
+*.swp
+*.swo
+.DS_Store
+Thumbs.db
+
+# Build outputs and caches
+out/
+tmp/
+temp/
+.cache/
+.parcel-cache/
+.turbo/

healthcloud_tenantadmin-0.1.0/PKG-INFO

@@ -0,0 +1,58 @@
+Metadata-Version: 2.4
+Name: healthcloud-tenantadmin
+Version: 0.1.0
+Summary: HealthCloud Tenant Admin SDK for Python — manage tenant admins and auth.
+Project-URL: Repository, https://github.com/healthcloudservices/healthcloud-sdk
+Author: Healthcheck Systems Inc
+License-Expression: MIT
+Keywords: api,health-cloud,healthcare,healthcloud,sdk,tenant-admin
+Requires-Python: >=3.9
+Requires-Dist: httpx>=0.27.0
+Provides-Extra: dev
+Requires-Dist: pytest>=8.0; extra == 'dev'
+Requires-Dist: respx>=0.21; extra == 'dev'
+Requires-Dist: ruff>=0.6; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# healthcloud-tenantadmin
+
+Python SDK for the HealthCloud Tenant Admin API — Python counterpart to the
+`@healthcloudai/hc-tenantadmin` npm package (`packages/npm-tenantadmin`).
+Same routes, same behavior, same field names — kept in sync with
+`HEALTH_CLOUD/healthcloud-services/hc/apis/tenantadmin/src/app.py`.
+
+## Install
+
+This public package is published to PyPI alongside the other HealthCloud SDKs:
+
+```bash
+pip install healthcloud-tenantadmin
+```
+
+Pin the version in applications and CI when reproducible installs are required:
+
+```
+healthcloud-tenantadmin==0.1.0
+```
+
+## Usage
+
+```python
+from healthcloud_tenantadmin import HCTenantAdminSDK
+
+sdk = HCTenantAdminSDK(environment="dev", tenant_id="acme")
+sdk.admin.login(email="admin@acme.com", password="...")
+
+# List all Tenant Admins for the caller's own tenant (resolved from the
+# verified JWT — tenant_id is never accepted as a parameter)
+admins = sdk.admin.get_admins_for_tenant()
+for a in admins:
+    print(a.admin_id, a.email, a.status)
+```
+
+## Development
+
+```bash
+pip install -e ".[dev]"
+pytest
+```

healthcloud_tenantadmin-0.1.0/README.md

@@ -0,0 +1,42 @@
+# healthcloud-tenantadmin
+
+Python SDK for the HealthCloud Tenant Admin API — Python counterpart to the
+`@healthcloudai/hc-tenantadmin` npm package (`packages/npm-tenantadmin`).
+Same routes, same behavior, same field names — kept in sync with
+`HEALTH_CLOUD/healthcloud-services/hc/apis/tenantadmin/src/app.py`.
+
+## Install
+
+This public package is published to PyPI alongside the other HealthCloud SDKs:
+
+```bash
+pip install healthcloud-tenantadmin
+```
+
+Pin the version in applications and CI when reproducible installs are required:
+
+```
+healthcloud-tenantadmin==0.1.0
+```
+
+## Usage
+
+```python
+from healthcloud_tenantadmin import HCTenantAdminSDK
+
+sdk = HCTenantAdminSDK(environment="dev", tenant_id="acme")
+sdk.admin.login(email="admin@acme.com", password="...")
+
+# List all Tenant Admins for the caller's own tenant (resolved from the
+# verified JWT — tenant_id is never accepted as a parameter)
+admins = sdk.admin.get_admins_for_tenant()
+for a in admins:
+    print(a.admin_id, a.email, a.status)
+```
+
+## Development
+
+```bash
+pip install -e ".[dev]"
+pytest
+```

healthcloud_tenantadmin-0.1.0/healthcloud_tenantadmin/__init__.py

@@ -0,0 +1,16 @@
+from __future__ import annotations
+
+from .config import Environment, TenantAdminSDKConfig
+from .errors import SDKError
+from .models import TenantAdmin, TenantAdminProfile, TenantAccountProfile
+from .sdk import HCTenantAdminSDK
+
+__all__ = [
+    "Environment",
+    "TenantAdminSDKConfig",
+    "SDKError",
+    "TenantAdmin",
+    "TenantAdminProfile",
+    "TenantAccountProfile",
+    "HCTenantAdminSDK",
+]

healthcloud_tenantadmin-0.1.0/healthcloud_tenantadmin/clients/__init__.py

@@ -0,0 +1,3 @@
+from .tenant_admin import TenantAdminClient
+
+__all__ = ["TenantAdminClient"]

healthcloud_tenantadmin-0.1.0/healthcloud_tenantadmin/clients/tenant_admin.py

@@ -0,0 +1,134 @@
+from __future__ import annotations
+
+from typing import Any, Optional
+
+from ..config import TenantAdminSDKConfig, with_tenant_id
+from ..http import HttpClient
+from ..models import TenantAdmin, TenantAdminProfile
+
+
+class TenantAdminClient:
+    """Service client for the HC Tenant Admin API.
+
+    Covers:
+    - Tenant/account registration (public — also creates the first admin)
+    - Tenant Admin auth: self-registration, invite, login, refresh,
+      verify-email, reset-password
+    - Profile: current admin (JWT identity) and admin CRUD by id, plus
+      listing all admins for the caller's own tenant
+    """
+
+    def __init__(self, http: HttpClient, config: TenantAdminSDKConfig):
+        self._http = http
+        self._config = config
+
+    # ─── Tenant/account registration (public) ────────────────────────────
+
+    def register_tenant_account(self, **data: Any) -> dict:
+        """Create a tenant/account, provision all four Cognito pools
+        (patient, provider, person, tenantadmin), and create the tenant's
+        first (primary) Tenant Admin user.
+        POST /tenants/register (public)"""
+        return self._http.post("/tenants/register", auth=False, json=data)
+
+    # ─── Tenant Admin registration — self vs. invite ─────────────────────
+
+    def self_register_tenant_admin(
+        self, *, tenant_id: str, first_name: str, last_name: str, email: str,
+        password: str, phone: Optional[str] = None,
+    ) -> dict:
+        """Public self-registration into an existing tenant. Requires the
+        tenant and its tenantadmin Cognito pool to already exist (404
+        otherwise). No JWT required.
+        POST /auth/register, mode=self (public)"""
+        body = {
+            "tenant_id": tenant_id, "first_name": first_name, "last_name": last_name,
+            "email": email, "password": password, "phone": phone, "mode": "self",
+        }
+        return self._http.post("/auth/register", auth=False, json=body)
+
+    def invite_tenant_admin(self, *, first_name: str, last_name: str, email: str) -> dict:
+        """Invite another Tenant Admin into the caller's own tenant. Requires
+        a Tenant Admin JWT (tenantadmin pool only); the tenant is always the
+        inviter's own.
+        POST /auth/register, mode=invite (Bearer required)"""
+        body = {"first_name": first_name, "last_name": last_name, "email": email, "mode": "invite"}
+        return self._http.post("/auth/register", json=body)
+
+    # ─── Auth (public, no Bearer token) ──────────────────────────────────
+
+    def login(self, *, email: str, password: str, tenant_id: Optional[str] = None) -> dict:
+        """Log in an existing tenant admin. Returns access, ID and refresh
+        tokens.
+        POST /auth/login (public)"""
+        body = with_tenant_id({"email": email, "password": password}, tenant_id or self._config.tenant_id)
+        response = self._http.post("/auth/login", auth=False, json=body)
+        if response and response.get("access_token"):
+            self._http.set_access_token(response["access_token"])
+        return response
+
+    def login_tenant_admin(self, *, email: str, password: str, tenant_id: Optional[str] = None) -> dict:
+        """Alias of :meth:`login`, matching the SDK's cross-package naming."""
+        return self.login(email=email, password=password, tenant_id=tenant_id)
+
+    def refresh_tenant_admin_token(self, *, refresh_token: str, tenant_id: Optional[str] = None) -> dict:
+        """Renew an access token via Cognito's refresh-token flow.
+        POST /auth/refresh (public)"""
+        body = with_tenant_id({"refresh_token": refresh_token}, tenant_id or self._config.tenant_id)
+        return self._http.post("/auth/refresh", auth=False, json=body)
+
+    def verify_email(self, *, email: str, otp: str, tenant_id: Optional[str] = None) -> dict:
+        """Verify a tenant admin's email address with OTP.
+        POST /auth/verify-email (public)"""
+        body = with_tenant_id({"email": email, "otp": otp}, tenant_id or self._config.tenant_id)
+        return self._http.post("/auth/verify-email", auth=False, json=body)
+
+    def reset_password(self, *, email: str, tenant_id: Optional[str] = None) -> dict:
+        """Initiate password reset flow (sends code to email).
+        POST /auth/reset-password (public)"""
+        body = with_tenant_id({"email": email}, tenant_id or self._config.tenant_id)
+        return self._http.post("/auth/reset-password", auth=False, json=body)
+
+    def confirm_password(
+        self, *, email: str, new_password: str, confirmation_code: str, tenant_id: Optional[str] = None,
+    ) -> dict:
+        """Confirm password reset with code.
+        POST /auth/confirm-reset-password (public)"""
+        body = with_tenant_id(
+            {"email": email, "new_password": new_password, "confirmation_code": confirmation_code},
+            tenant_id or self._config.tenant_id,
+        )
+        return self._http.post("/auth/confirm-reset-password", auth=False, json=body)
+
+    # ─── Current admin (authenticated — identity from the verified JWT) ──
+
+    def get_current_tenant_admin(self) -> TenantAdminProfile:
+        """Get the currently authenticated Tenant Admin's own profile.
+        Identity is resolved server-side from the verified access token's
+        claims — there is no admin id to pass.
+        GET /admins/me (Bearer required, tenantadmin pool only)"""
+        return TenantAdminProfile.from_dict(self._http.get("/admins/me"))
+
+    # ─── Admin CRUD (authenticated) ───────────────────────────────────────
+
+    def get_admins_for_tenant(self) -> list[TenantAdmin]:
+        """List all Tenant Admins for the caller's own tenant, resolved from
+        the verified Tenant Admin JWT — the tenant is never accepted as a
+        parameter. Sorted by email. Per-item `account` is not populated
+        here (unlike :meth:`get_admin`); fetch it via `get_admin` if needed.
+        GET /tenant-admins (Bearer required, tenantadmin pool only)"""
+        return [TenantAdmin.from_dict(item) for item in self._http.get("/tenant-admins")]
+
+    def get_admin(self, admin_id: str) -> TenantAdmin:
+        """Get a tenant admin by ID, including the tenant's business info
+        (account.name/status/tier).
+        GET /admins/{admin_id}"""
+        data = self._http.get("/admins/{admin_id}", path_params={"admin_id": admin_id})
+        return TenantAdmin.from_dict(data)
+
+    def update_admin(self, admin_id: str, **fields: Any) -> dict:
+        """Update a tenant admin's profile fields (first_name, last_name, phone).
+        PATCH /admins/{admin_id}"""
+        return self._http.patch(
+            "/admins/{admin_id}", path_params={"admin_id": admin_id}, json=fields,
+        )

healthcloud_tenantadmin-0.1.0/healthcloud_tenantadmin/config.py

@@ -0,0 +1,37 @@
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Literal, Optional
+
+Environment = Literal["dev", "uat", "prod"]
+
+SERVICE_NAME = "tenantadmin"
+
+
+@dataclass
+class TenantAdminSDKConfig:
+    environment: Environment = "dev"
+    tenant_id: Optional[str] = None
+    access_token: Optional[str] = None
+    timeout: float = 30.0
+
+
+def assert_environment(environment: Environment) -> None:
+    if environment not in ("dev", "uat", "prod"):
+        raise ValueError(f'Unsupported HealthCloud environment: "{environment}"')
+
+
+def resolve_base_url(environment: Environment) -> str:
+    assert_environment(environment)
+    prefix = "" if environment == "prod" else f"{environment}-"
+    return f"https://{prefix}api-{SERVICE_NAME}.health.cloud"
+
+
+def with_tenant_id(data: dict, tenant_id: Optional[str]) -> dict:
+    """Always enforces the SDK-configured tenant on request bodies — never
+    lets a caller-supplied tenant_id override it."""
+    if not tenant_id:
+        return dict(data)
+    out = dict(data)
+    out["tenant_id"] = tenant_id
+    return out

healthcloud_tenantadmin-0.1.0/healthcloud_tenantadmin/errors.py

@@ -0,0 +1,13 @@
+from __future__ import annotations
+
+from typing import Any, Optional
+
+
+class SDKError(Exception):
+    def __init__(self, message: str, status_code: int, response: Optional[Any] = None):
+        super().__init__(message)
+        self.status_code = status_code
+        self.response = response
+
+    def __str__(self) -> str:
+        return f"[SDKError {self.status_code}] {super().__str__()}"

healthcloud_tenantadmin-0.1.0/healthcloud_tenantadmin/http.py

@@ -0,0 +1,69 @@
+from __future__ import annotations
+
+from typing import Any, Mapping, Optional
+
+import httpx
+
+from .config import TenantAdminSDKConfig, resolve_base_url
+from .errors import SDKError
+
+
+class HttpClient:
+    def __init__(self, config: TenantAdminSDKConfig):
+        self._config = config
+        self._client = httpx.Client(timeout=config.timeout)
+
+    def set_access_token(self, token: Optional[str]) -> None:
+        self._config.access_token = token
+
+    def close(self) -> None:
+        self._client.close()
+
+    def _headers(self, auth: bool, headers: Optional[Mapping[str, str]] = None) -> dict:
+        out = {"Accept": "application/json", "Content-Type": "application/json"}
+        if headers:
+            out.update(dict(headers))
+        if auth and self._config.access_token:
+            out["Authorization"] = f"Bearer {self._config.access_token}"
+        return out
+
+    def request(
+        self,
+        method: str,
+        path: str,
+        *,
+        auth: bool = True,
+        path_params: Optional[Mapping[str, str]] = None,
+        params: Optional[Mapping[str, Any]] = None,
+        json: Optional[Any] = None,
+        headers: Optional[Mapping[str, str]] = None,
+    ) -> Any:
+        url = f"{resolve_base_url(self._config.environment)}{path}"
+        if path_params:
+            for key, value in path_params.items():
+                url = url.replace(f"{{{key}}}", str(value))
+
+        resp = self._client.request(
+            method, url, params=params, json=json, headers=self._headers(auth, headers)
+        )
+        if resp.status_code >= 400:
+            try:
+                detail: Any = resp.json()
+            except Exception:
+                detail = resp.text
+            raise SDKError(f"HealthCloud API error {resp.status_code}: {detail}", resp.status_code, detail)
+        if not resp.content:
+            return None
+        try:
+            return resp.json()
+        except Exception:
+            return resp.text
+
+    def get(self, path: str, **kwargs: Any) -> Any:
+        return self.request("GET", path, **kwargs)
+
+    def post(self, path: str, **kwargs: Any) -> Any:
+        return self.request("POST", path, **kwargs)
+
+    def patch(self, path: str, **kwargs: Any) -> Any:
+        return self.request("PATCH", path, **kwargs)

healthcloud_tenantadmin-0.1.0/healthcloud_tenantadmin/models.py

@@ -0,0 +1,102 @@
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from typing import Any, Optional
+
+
+@dataclass
+class TenantAccountProfile:
+    tenant_id: str
+    name: str
+    status: str
+    tier: str
+
+    @classmethod
+    def from_dict(cls, data: Optional[dict]) -> Optional["TenantAccountProfile"]:
+        if not data:
+            return None
+        return cls(
+            tenant_id=data["tenant_id"],
+            name=data["name"],
+            status=data["status"],
+            tier=data["tier"],
+        )
+
+
+@dataclass
+class TenantAdmin:
+    """A Tenant Admin resource, as returned by GET /tenant-admins (list) and
+    GET /admins/{admin_id} (single). Fields present differ slightly by
+    route — see field docstrings."""
+
+    admin_id: str
+    email: str
+    tenant_id: str
+    first_name: str
+    last_name: str
+    status: str
+    phone: Optional[str] = None
+    title: Optional[str] = None
+    # Cognito User Pool sub. Only present on GET /tenant-admins (list).
+    cognito_sub: Optional[str] = None
+    permissions: list[str] = field(default_factory=list)
+    is_primary: bool = False
+    created_at: Optional[str] = None
+    updated_at: Optional[str] = None
+    last_login_at: Optional[str] = None
+    # admin_id of the creator/inviter. Only present on GET /tenant-admins (list).
+    created_by: Optional[str] = None
+    invited_by: Optional[str] = None
+    account: Optional[TenantAccountProfile] = None
+
+    @classmethod
+    def from_dict(cls, data: dict) -> "TenantAdmin":
+        return cls(
+            admin_id=data["admin_id"],
+            email=data["email"],
+            tenant_id=data["tenant_id"],
+            first_name=data["first_name"],
+            last_name=data["last_name"],
+            status=data["status"],
+            phone=data.get("phone"),
+            title=data.get("title"),
+            cognito_sub=data.get("cognito_sub"),
+            permissions=data.get("permissions", []),
+            is_primary=data.get("is_primary", False),
+            created_at=data.get("created_at"),
+            updated_at=data.get("updated_at"),
+            last_login_at=data.get("last_login_at"),
+            created_by=data.get("created_by"),
+            invited_by=data.get("invited_by"),
+            account=TenantAccountProfile.from_dict(data.get("account")),
+        )
+
+
+@dataclass
+class TenantAdminProfile:
+    """GET /admins/me — identity resolved from the verified access token's
+    claims; no admin_id is ever accepted from the caller for this route."""
+
+    admin_id: str
+    tenant_id: str
+    email: str
+    first_name: str
+    last_name: str
+    status: str
+    is_primary: bool = False
+    permissions: list[str] = field(default_factory=list)
+    account: Optional[TenantAccountProfile] = None
+
+    @classmethod
+    def from_dict(cls, data: dict) -> "TenantAdminProfile":
+        return cls(
+            admin_id=data["admin_id"],
+            tenant_id=data["tenant_id"],
+            email=data["email"],
+            first_name=data["first_name"],
+            last_name=data["last_name"],
+            status=data["status"],
+            is_primary=data.get("is_primary", False),
+            permissions=data.get("permissions", []),
+            account=TenantAccountProfile.from_dict(data.get("account")),
+        )

healthcloud_tenantadmin-0.1.0/healthcloud_tenantadmin/sdk.py

@@ -0,0 +1,55 @@
+from __future__ import annotations
+
+from typing import Optional
+
+from .clients.tenant_admin import TenantAdminClient
+from .config import Environment, TenantAdminSDKConfig, assert_environment
+from .http import HttpClient
+
+
+class HCTenantAdminSDK:
+    """Entry point for the HealthCloud Tenant Admin SDK.
+
+    >>> sdk = HCTenantAdminSDK(environment="dev", tenant_id="acme")
+    >>> sdk.login(email="admin@acme.com", password="...")
+    >>> sdk.admin.get_admins_for_tenant()
+    """
+
+    def __init__(
+        self,
+        environment: Environment = "dev",
+        tenant_id: Optional[str] = None,
+        access_token: Optional[str] = None,
+        timeout: float = 30.0,
+    ):
+        assert_environment(environment)
+        self._config = TenantAdminSDKConfig(
+            environment=environment, tenant_id=tenant_id, access_token=access_token, timeout=timeout,
+        )
+        self._http = HttpClient(self._config)
+
+        # Tenant admin auth + profile management
+        self.admin = TenantAdminClient(self._http, self._config)
+
+    @property
+    def environment(self) -> str:
+        return self._config.environment
+
+    @property
+    def tenant_id(self) -> Optional[str]:
+        return self._config.tenant_id
+
+    def set_access_token(self, token: str) -> None:
+        self._http.set_access_token(token)
+
+    def clear_access_token(self) -> None:
+        self._http.set_access_token(None)
+
+    def close(self) -> None:
+        self._http.close()
+
+    def __enter__(self) -> "HCTenantAdminSDK":
+        return self
+
+    def __exit__(self, *exc: object) -> None:
+        self.close()

healthcloud_tenantadmin-0.1.0/pyproject.toml

@@ -0,0 +1,31 @@
+[build-system]
+requires = ["hatchling>=1.25"]
+build-backend = "hatchling.build"
+
+[project]
+name = "healthcloud-tenantadmin"
+version = "0.1.0"
+description = "HealthCloud Tenant Admin SDK for Python — manage tenant admins and auth."
+readme = "README.md"
+requires-python = ">=3.9"
+license = "MIT"
+authors = [{ name = "Healthcheck Systems Inc" }]
+keywords = ["healthcloud", "health-cloud", "tenant-admin", "sdk", "api", "healthcare"]
+dependencies = ["httpx>=0.27.0"]
+
+[project.optional-dependencies]
+dev = ["pytest>=8.0", "respx>=0.21", "ruff>=0.6"]
+
+[project.urls]
+Repository = "https://github.com/healthcloudservices/healthcloud-sdk"
+
+[tool.hatch.build.targets.wheel]
+packages = ["healthcloud_tenantadmin"]
+
+[tool.ruff]
+line-length = 100
+
+[tool.pytest.ini_options]
+markers = [
+  "live: live HealthCloud API integration tests, skipped unless HC_RUN_INTEGRATION=true",
+]

healthcloud_tenantadmin-0.1.0/tests/test_tenant_admin_client.py

@@ -0,0 +1,70 @@
+from __future__ import annotations
+
+import httpx
+import pytest
+import respx
+
+from healthcloud_tenantadmin import HCTenantAdminSDK
+
+BASE_URL = "https://dev-api-tenantadmin.health.cloud"
+
+
+@pytest.fixture
+def sdk() -> HCTenantAdminSDK:
+    return HCTenantAdminSDK(environment="dev", tenant_id="acme", access_token="test-token")
+
+
+@respx.mock
+def test_get_admins_for_tenant_maps_all_fields(sdk: HCTenantAdminSDK) -> None:
+    payload = [
+        {
+            "admin_id": "11111111-1111-1111-1111-111111111111",
+            "tenant_id": "acme",
+            "email": "a@acme.com",
+            "first_name": "Ana",
+            "last_name": "Admin",
+            "phone": "+15551234567",
+            "title": "Owner",
+            "cognito_sub": "22222222-2222-2222-2222-222222222222",
+            "status": "active",
+            "is_primary": True,
+            "permissions": ["users:read", "users:write"],
+            "created_at": "2026-01-01T00:00:00",
+            "updated_at": "2026-01-02T00:00:00",
+            "last_login_at": None,
+            "created_by": None,
+            "invited_by": None,
+        }
+    ]
+    route = respx.get(f"{BASE_URL}/tenant-admins").mock(
+        return_value=httpx.Response(200, json=payload)
+    )
+
+    admins = sdk.admin.get_admins_for_tenant()
+
+    assert route.called
+    assert route.calls.last.request.headers["Authorization"] == "Bearer test-token"
+    assert len(admins) == 1
+    admin = admins[0]
+    assert admin.admin_id == payload[0]["admin_id"]
+    assert admin.email == "a@acme.com"
+    assert admin.cognito_sub == payload[0]["cognito_sub"]
+    assert admin.is_primary is True
+
+
+@respx.mock
+def test_get_admins_for_tenant_empty(sdk: HCTenantAdminSDK) -> None:
+    respx.get(f"{BASE_URL}/tenant-admins").mock(return_value=httpx.Response(200, json=[]))
+    assert sdk.admin.get_admins_for_tenant() == []
+
+
+@respx.mock
+def test_get_admins_for_tenant_unauthorized_raises(sdk: HCTenantAdminSDK) -> None:
+    from healthcloud_tenantadmin import SDKError
+
+    respx.get(f"{BASE_URL}/tenant-admins").mock(
+        return_value=httpx.Response(401, json={"error": "Authorization required"})
+    )
+    with pytest.raises(SDKError) as exc_info:
+        sdk.admin.get_admins_for_tenant()
+    assert exc_info.value.status_code == 401