An organization can also be run from code. Five tools are available, each with its own key and URL. They all apply to a team workspace; a personal workspace has none of them.
Which tool for which needLink to the Which tool for which need section
| Need | Tool | Authentication |
|---|---|---|
| Manage members, invitations, groups, roles, labels, rules, models, licenses and resources; read usage and the audit log | Admin API | Admin key moai_adm_… |
| Get notified when a member joins or leaves, a license pool is full, the rules change or the contract nears its end | Webhooks | HMAC signature with a whsec_… secret |
| Create, suspend and remove accounts from your directory, and keep groups in sync there | SCIM 2.0 | moai_scim_… token |
| Let members sign in with your organization’s credentials | Single sign-on | OpenID Connect application from your identity provider |
| Use Moon AI chat on behalf of a workspace | Workspace keys | moai_org_… key |
The SCIM directory only adds addresses from a verified domain, and single sign-on can only be made mandatory once at least one domain is verified. To call the models from your own programs, with a wallet and pay-as-you-go billing, use the developer API instead.
URLsLink to the URLs section
| Service | URL |
|---|---|
| Admin API and webhooks | https:// |
| OpenAPI description of the admin API | https:// |
| SCIM 2.0 | https:// |
| Single sign-on redirect URL | https:// |
| Chat with a workspace key | https:// |
The organization ID (org_id) is in the admin console › “API and keys”, on the “Getting started” card, in the “First call” example.
Get started with the admin APILink to the Get started with the admin API section
- Create an admin key with only the scopes your program needs.
- Check it with
GET /me. - Call the routes for the area you need, for example list members or invite people.
- Subscribe your server to webhooks instead of polling the API.
Shared securityLink to the Shared security section
- Each key and each token only acts on its own organization. A request to another organization gets the same response as a resource that does not exist.
- An admin key never has more rights than the person who created it, and stops working when that person leaves the organization.
- Keys, tokens and secrets are shown only once, when they are created. Treat them like passwords and keep them server-side only.
- Every action taken by a key or by the directory is recorded in the organization’s audit log, under the name of the key or the directory.
In this section
Admin API
- Authentication and conventionsCreate a moai_adm_ admin key, send it and pick its scopes, then follow the rules shared by the whole API: pagination, errors, rate limits and idempotency.
- Organization and settingsRead the overview and the “To do” list, then update the organization’s identity and settings, how long chats are kept and the member directory.
- MembersList and filter members, read a member’s record, suspend, reactivate or remove them, act in bulk, and export or import a CSV file with the admin API.
- Invitations and access codesInvite people with their groups, roles, labels and license, read the invitation limits, resend or revoke invitations, and manage access codes.
- Member accountsRead a member’s account, sign them out, reset their two-factor authentication, disable it, offboard them and manage account requirements through the API.
- GroupsCreate static or dynamic groups, write a label rule, add members and appoint managers with the admin API of a Moon AI organization.
- RolesCreate roles with their permissions and assign them to members, groups or labels through the admin API, with the full catalog of permissions.
- LabelsCreate key and value labels, put them on members, groups or resources, and mark a resource as sensitive, all through the admin API.
- RulesThe format of rules for the organization, roles, groups and member exceptions, how they combine, and the routes that read and write them.
- Organization modelsList the models your rules allow, create organization models with a system prompt and knowledge bases, and set instructions per base model.
- Licenses and contractRead the license pools, set the assignment rules and the fallback pool, assign licenses by hand, and read the contract and invoices through the API.
- ResourcesAdd, test and share the organization’s MCP servers, set up its own file storage, and share knowledge bases and agents through the admin API.
- DomainsAdd and verify your organization’s domains with a DNS TXT record, set up automatic joining, and invite existing accounts through the admin API.
- Usage and audit logRead usage by member, by group and by model, export it as CSV, then read, filter and export the organization’s audit log through the API.
- WebhooksReceive the organization’s events as signed requests, verify the signature, handle retries and manage your webhooks through the admin API.
Directory and sign-in
- SCIM 2.0The SCIM 2.0 service of a managed organization: directory token, Users and Groups resources, filters, PATCH operations, limits and SCIM-format errors.
- Single sign-on (SSO)What Moon AI expects from your OpenID Connect provider, how a sign-in works, which claims are read, and the routes that read or save the configuration.