Admin API overview
The Admin API is an Enterprise-only feature that lets Organization administrators and solutions engineers automate account management. Use it to provision users, manage Workspaces and groups, rotate API keys, set spend and rate limits, and retrieve usage and audit logs.
Enterprise plans only
The Admin API is available only on Enterprise plans, and access isn't self-serve. On other plans, you can't create an Admin API key, and a standard API key doesn't work with admin endpoints. To request access, contact your Mistral account team or our sales team.
The Admin API is in Preview. Endpoints and fields can change as we refine the API.
Concepts
Most Admin docs describe one Organization. Some Enterprise customers also have an Enterprise Account, which groups several Organizations when they need stronger isolation between groups of users than Workspaces provide.
The Admin Panel ↗ manages Enterprise Accounts, their Organizations, their members, and each Organization's Admin API keys. For the product model, see Enterprise Accounts.
An Enterprise Account is not the same as an Organization on an Enterprise plan. The Enterprise plan is a billing tier that unlocks features like the Admin API for a single Organization. An Enterprise Account is an administrative layer that links multiple Organizations and is only available to Enterprise plan customers.
A user group bundles users so you can manage them together. For example, create a group, add members, then assign the group to a Workspace with a given role. See Groups.
Authentication
The Admin API uses a dedicated Admin API key, created in the Admin Panel (enterprise section) and passed in the x-api-key header. A user's standard API key never grants admin access. See Authentication and Admin API keys for details.
Capabilities
Use the Admin API to manage:
- Users and invitations: see User management
- Groups: see Groups
- Workspaces: see Your first Workspace
- API keys: see API keys
- Spend and rate limits: see Usage and limits
- Usage: see Usage metrics with the Admin API
- Audit logs: see Audit logs
Roles and permissions
Several endpoints accept role fields by UUID (roles) or by name (role_names). Workspace assignment endpoints accept workspace_role (UUID) or workspace_role_name (name). When RBAC is enabled, list the available roles and their UUIDs with GET /v1/admin/roles.
Singular role fields (role, role_name) are deprecated. Use the plural equivalents (roles, role_names), which support assigning multiple roles to a user.
For the full role model, see Roles and permissions.