The admin workspace
The admin workspace is the console for the people who run the hub. It works like any other workspace, and it lives at the reserved address /admin. Only an account whose email is on the staff list is offered it.
Topics
- Topics: each part of running the hub, and what it looks after.
What a member of staff does in the admin workspace, a program with the same standing can do over the API.
Each topic has a family of routes. Users is the user routes. Feature flags is the system feature-flag routes under system. Sync enrollment is the admin sync routes, one per table. Messaging is the announcements routes. LLM providers is the persona provider-template routes under persona. Usage is the usage routes across every tenant.
Admin tables are plain resources at the admin tier. The audit log and team permissions are reached through the generated routes, exposed only to admin.
An admin read names its bypass. The hub keeps every tenant's data apart, and an admin read crosses that line only by naming a bypass scope on the one call that needs it. Nothing crosses it by default.
The full list of routes, with each one's parameters, body and responses, is the REST reference on the help site. The tools an agent gets are listed in the MCP reference.
Admin is a workspace. It uses the same shell and the same gate as every other workspace, so there is one layout to keep up and one place where "which workspaces can you see" is answered.
The address is reserved. The slug admin is on the reserved list, so no person and no organization can take it.
Bypass is named, never assumed. An admin read names its bypass on the one call that needs it. Nothing crosses the tenant boundary by default.