Onboard an organization
Create an organization, set its ceiling, and add its first team.
An organization is the top of the tenancy and budget hierarchy. Teams, users, keys and budgets all hang beneath one. Create it first — retrofitting an organization under existing keys means reissuing them.
Steps
1. Open /organizations.
2. Click Create Org.
| Field | Notes |
|---|---|
| Name | Display name, shown throughout the console. |
| Alias | Stable short identifier used in reporting and API calls. Choose it deliberately — it is what appears in spend attribution, and changing it later breaks continuity in historical reports. |
3. Set the organization budget. See Set up the budget hierarchy. Do this before issuing keys beneath it, so nothing runs uncapped even briefly.
4. Create teams at /teams, scoped to the organization.
5. Add users at /users, or invite them from /invitations.
6. Issue keys — see Issue and scope an API key.
Reviewing an organization
Open any row to see teams, members, spend and budget in one place.
Organizations, tenants and schemas are not the same thing
Worth being precise about, because the terms get used interchangeably and the distinction determines what is isolated from what.
- An organization is an application-level grouping. Several organizations can live in the same database schema, separated by scoping rules in the query.
- A tenant is a Postgres schema holding its own copy of the tenant-resident tables — and its own independent audit chain.
Creating an organization does not provision a tenant schema. That is a
separate operation (tenant-provision), and it is the one that gives hard
isolation. If you need a customer’s data physically separated rather than
query-scoped, an organization alone will not do it.
Access scoping follows the hierarchy
A principal’s tier determines reach: instance-tier sees everything, org-tier sees
only its own organization’s resources, team-tier only its team’s. Scoping is
compiled into the SQL WHERE clause, so out-of-scope resources return 404
rather than 403 — see
Management API authentication.
The practical consequence when onboarding: an org-tier administrator will not see the organization until their identity context carries that organization’s id. “The org I just created is missing” is almost always this, not a creation failure.
API equivalent
curl -X POST https://<gateway>/organization/new \
-H "X-Aoedge-Identity-Context: <attested context>" \
-H "Content-Type: application/json" \
-d '{"organization_alias":"acme","max_budget":10000,"budget_duration":"monthly"}'