Tenant

Assign an eligible current member as a tenant administrator. This is separate from functional-role assignment.

Inspect the selected tenant's protected administrator roster.

Revoke a tenant-administrator assignment, subject to administrator-target safeguards.

Inspect the tenant's authentication and identity-provider configuration.

Change the tenant's authentication or federation configuration through supported identity operations.

Represents branding-read authority derived from tenant administration or branding update. It is not independently assignable in a custom role.

Change or reset tenant theme settings and upload or remove its logo.

Inspect embedding configuration and available embedding choices.

Change embedding configuration or delete an eligible inactive embedding collection. Configuration changes also require tenant.update; starting reindexing also requires tenant.reindex.start.

Create an ordinary group inside the tenant's managed group hierarchy.

Delete an ordinary tenant group. Protected administration groups are excluded.

Inspect the tenant's group directory. The combined identity-directory view also requires tenant.member.list.

Add or remove members of ordinary tenant groups, subject to group-target restrictions.

Update an ordinary tenant group.

Add an existing identity to the tenant.

Create a local identity in the tenant where local-user creation is permitted by its identity configuration.

Inspect tenant members. The combined identity-directory view also requires tenant.group.list.

Remove an ordinary tenant membership without deleting the identity from the entire platform.

Create a model preset in the tenant.

Delete a tenant model preset.

List tenant model presets and their available choices.

Read a tenant model preset's configuration.

Edit an existing tenant model preset.

Add, edit or delete web-search provider configurations and replace their credentials.

List or inspect the tenant's web-search provider configurations without revealing stored secrets.

Read the selected tenant context. This is baseline membership access, not permission to administer the tenant.

Cancel the tenant's active reindex operation.

Inspect the progress and result of the tenant's reindex operation.

Start reindexing tenant documents into the configured target collection. The endpoint also requires tenant.embedding.update.

Assign a system or custom role to eligible tenant users or groups. This does not grant tenant membership or administrator status.

Create a tenant-owned custom role. System-role definitions cannot be created through this operation.

Delete a custom role and schedule removal of its grants. System roles cannot be deleted.

Inspect system and custom roles, their direct assignments, and the custom-role permission catalogue.

Remove a direct system or custom role assignment. Independent grants and group-inherited access remain effective.

Change a custom role's name, description or permission bundle. System-role definitions remain read-only.

Add a platform runtime profile to the tenant's allowed set. This does not create a new platform compute profile.

Remove a runtime profile from the tenant's allowed set without deleting the platform profile.

List runtime profiles allowed for the tenant. Reading the platform catalogue additionally requires platform.runtime_profile.read.

Represents profile-read authority implied by tenant.runtime_profile.list; it is not a separately assignable custom-role permission.

Represents profile-update authority derived from Inference Deployer or tenant.runtime_profile.delete. Allowed-profile changes use the add/remove API operations.

Represents tenant service-installation authority in the authorization model. It does not grant the platform-wide model-installer permission.

Read the private Service Desk section of tenant configuration, including its Agent and folder bindings. The separate public Service Desk metadata route uses tenant.read.

Change the tenant's Service Desk Agent, retrieval scope, enabled state and presentation settings.

Read the tenant's translated interface text.

Create or replace tenant translation overrides.

Update the selected tenant's general configuration.