Tenant Admins¶

Your account with VirtualSutra AI is a tenant. A tenant holds one or more organizations, and each person has a role in each organization they belong to.

An organization admin manages their own organization. A tenant admin is an organization admin who can also manage the tenant's other organizations and the settings the whole tenant shares.

What a tenant admin can do¶

A tenant admin has no access to other tenants.

An organization admin who is not a tenant admin keeps full control of their own organization through the API and the rest of the console. An API request to manage another organization of the tenant is answered as if that organization did not exist.

Who is a tenant admin¶

• The person who created the tenant. If you signed up yourself, you are its first tenant admin. If the tenant was created for you, the first admin named at creation is.
• On a self-hosted install, an address listed in AUTH_ADMIN_EMAILS becomes an admin of the deployment's organization and a tenant admin when it signs in for the first time. Adding an address to the list after that person has already signed in does not make them one.
• Anyone a tenant admin has granted it to.

A tenant admin must be an enabled user who is an admin of at least one organization of the tenant. Someone who stops being an admin of every organization of the tenant stops being a tenant admin at the same moment. Making them an organization admin again does not restore it; a tenant admin has to grant it again.

Granting and revoking¶

Go to Admin > Tenant. The Tenant Admins section lists the current tenant admins. An organization admin who is not a tenant admin sees a one-line notice there instead of the list.

To grant: choose a person under Add a tenant admin and confirm Make Tenant Admin. Only people who are already an admin of one of the tenant's organizations can be chosen. To grant it to someone else, first make them an admin of an organization under Settings > Admin > Organizations.

To revoke: use Revoke on the person's row. They keep their organization roles and lose the ability to manage the tenant's other organizations.

Every grant and revoke is recorded in the audit log.

The last tenant admin¶

A tenant's last tenant admin who can act cannot be taken away. For that person, each of these is refused:

• revoking the role, including by that person themselves;
• changing their role in, or removing them from, the last organization they are an admin of;
• disabling their account.

Grant the role to another person first, then make the change.

With the API¶

The caller must be a tenant admin of that tenant. Each entry in the list has usable, which is false when the holder cannot currently act, for example because their account is disabled.

A personal API key acts as its owner, so a tenant admin's key can make these requests if the key carries the admin scope. A service account cannot be a tenant admin, whatever scopes it holds. Requests that need a tenant admin, including the LLM configuration, must be made by a person's console session or personal API key.

Creating organizations under your tenant¶

A tenant admin creates another organization from Settings > Admin > Organizations > New Organization, or with POST /tenants/{tenant_id}/orgs.

By default the tenant admin who creates the organization becomes its first admin. With the API, send "creator_as_admin": false to create it with no member, then add its first admin with POST /orgs/{org_id}/members.

Deleting an organization¶

Deleting an organization removes everything it owns: its runs, findings, reports, schedules, connections, API keys and service accounts. The tenant's own records, such as billing, stay. It cannot be undone, so you confirm it by name.

Who can delete. Only a tenant admin can delete an organization that still has members; the memberships are removed with it. Anyone else, including an organization admin or a platform admin who is not a tenant admin of this tenant, is refused while the organization has members. An organization's last admin cannot be removed, so in practice a tenant admin deletes it. Anyone who was a tenant admin only through an admin membership in the deleted organization stops being a tenant admin.

Confirm by name. In the console, Delete asks you to type the organization's exact name, matching case and spaces. With the API, pass the organization's id or exact name as confirm:

DELETE /orgs/{org_id}?confirm={org_id or name}

Without confirm the answer is 400 with detail.code confirmation_required. With any other value it is 400 with confirmation_mismatch. Nothing is deleted.

What blocks a delete. A delete is refused while any of these remain:

All of them are reported together in one 409, by kind and count:

{
  "detail": {
    "code": "org_delete_blocked",
    "message": "Cannot delete organization: 2 enabled schedule(s) — disable or delete them first",
    "blockers": [{"kind": "enabled_schedules", "count": 2}]
  }
}

When a delete is refused this way, the console's confirmation lists the blockers.

Other refusals have a plain sentence as detail:

• 409 "Cannot delete this organization: it holds the only admin membership of the tenant's last tenant admin — grant another tenant admin first".
• 403 "Cannot modify a platform administrator": in the operator organization, a member is a platform admin, and only a platform admin can remove them.
• 409 "Organization is busy", with a Retry-After header: a run of the organization is being written, or another delete is in progress. Try again.
• 503: the run queue could not be checked, and nothing else blocks the delete. Try again.

Nothing is deleted on any of these.

Records with no organization (older runs, schedules, remediations and API keys, see Admin Console) are not the organization's: a delete neither counts nor removes them.

If the organization is deleted while you are changing its members, teams or group mappings, the change is answered 404 "not found" and nothing is written.

Audit. A completed delete is recorded as org_deleted. A delete refused for its blockers, its confirmation or the tenant's last tenant admin is recorded as org_delete_refused.