Is there a mechanism or hook in place to update an external metadata store when an admin makes changes to an identity (e.g. creates, deletes, updates traits, etc). I know there is a hook available for when a user updates their own traits, but there doesn't seem to be an equivalent for Admins?

No, I would expect that the part doing the admin API call can also do the update in the external store as well.

So I would need to build a layer in front of the admin APIs in order to achieve this?

Aren't you building that any way because of the required authentication for the admin API?

Yes, but it's essentially just a proxy layer + authentication interceptors (similar to oathkeeper). This is sort of adding more meat to what sits in front of the Kratos APIs. That's fine, I just wasn't sure if that was the "correct" or recommended approach. Thanks!