Re: making the `tenantAlias` part of the path, it should be possible to do if we make `update` requests `HTTP PUT` requests rather than POST. It would allow us to have more space in the URL paths and the endpoints would be more semantically accurate.

I'm not a huge advocate of blocking the admin UI PR with that magnitude of change, though.