Admin API overview

The Admin API lets Organization administrators and solutions engineers automate account management. Use it to provision users, manage Workspaces and groups, rotate API keys, set spend and rate limits, and retrieve usage and audit logs.

Enterprise Accounts sit on top of Organizations. An Enterprise Account can group several Organizations, while an Organization belongs to at most one Enterprise Account (most Organizations are standalone). They give enterprise customers full isolation between groups of users, beyond what Workspaces provide.

The Backoffice (backoffice.mistral.ai ↗) is the customer-facing app for managing an Enterprise Account: its Organizations, its members, and the Admin API keys of each Organization.

A user group bundles users so you can manage them together. For example, create a group, add members, then assign the group to a Workspace with a given role. See Groups.

The Admin API uses a dedicated Admin API key, created in the Backoffice and passed in the x-api-key header. A user's standard API key never grants admin access. See Authentication and Admin API keys for details.

Use the Admin API to manage:

• Users and invitations: see User management
• Groups: see Groups
• Workspaces: see Your first Workspace
• API keys: see API keys
• Spend and rate limits: see Usage and limits
• Usage: see Usage metrics with the Admin API
• Audit logs: see Audit logs

Several endpoints accept role fields by UUID (roles) or by name (role_names). Workspace assignment endpoints accept workspace_role (UUID) or workspace_role_name (name). When RBAC is enabled, list the available roles and their UUIDs with GET /api/admin/roles.

For the full role model, see Roles and permissions.