This is looking good so far, but it needs to be behind authentication. Feel free to pull in Flask Security and add users and all that, or else we need to make it an authenticated route and introduce the idea of "admin" API users. I don't want just anyone to get access to flask admin, I want it to be a select set of users that are assigned through a people process.

If you go the flask security route, you can take some inspiration from this example https://github.com/sasaporta/flask-security-admin-example