Admin API and admin keys

With the Admin API, code can manage your Syntic organization: workspaces, members, invites, API keys, spend limits, and usage, cost and audit reports. Everything lives under /v1/organizations/*, and every call needs a special credential, an admin key, that can manage the organization but can never call a model.

Keeping the two kinds of key apart means a leaked inference key cannot change who is in your organization, and a leaked admin key cannot run up a model bill.

Admin keys at a glance

Create an admin key

Admin keys cannot be created through the API. This is deliberate: an admin key that could mint more admin keys would make a leak impossible to contain.

Whose authority a key carries

An admin key acts with its creator’s current role:

• Keys made by an Owner can do everything in the Admin API.
• Keys made by an Administrator can do what an Administrator can do in the Console. They cannot, for example, change an Owner’s role or another Administrator’s role.
• If the creator stops being an Owner or Administrator, or leaves, the key stops working with 403 permission, code admin_key_owner_ineligible. Replace it under a current Owner or Administrator.

Calling the Admin API

export SYNTIC_ADMIN_KEY="sk_admin_..."
 
curl -sS https://app.syntic.ai/v1/organizations/me \
  -H "Authorization: Bearer $SYNTIC_ADMIN_KEY" \
  -H "syntic-beta: admin-2026-11-01"

const admin = (path, init = {}) =>
  fetch(`https://app.syntic.ai/v1/organizations${path}`, {
    ...init,
    headers: {
      Authorization: `Bearer ${process.env.SYNTIC_ADMIN_KEY}`,
      'Content-Type': 'application/json',
      'syntic-beta': 'admin-2026-11-01',
      ...init.headers,
    },
  }).then(async (r) => {
    const body = await r.json()
    if (!r.ok) throw new Error(`${body.error.code}: ${body.error.message} (${body.request_id})`)
    return body
  })
 
console.log(await admin('/me'))

import os, requests
 
class Admin:
    base = "https://app.syntic.ai/v1/organizations"
 
    def __init__(self):
        self.s = requests.Session()
        self.s.headers.update({
            "Authorization": f"Bearer {os.environ['SYNTIC_ADMIN_KEY']}",
            "syntic-beta": "admin-2026-11-01",
        })
 
    def __call__(self, method, path, **kw):
        r = self.s.request(method, self.base + path, **kw)
        body = r.json()
        if not r.ok:
            raise RuntimeError(f"{body['error']['code']}: {body['error']['message']} ({body['request_id']})")
        return body
 
admin = Admin()
print(admin("GET", "/me"))

What the Admin API covers

Organization-level settings for inference hooks, customer-managed keys, webhooks and data retention are documented on those pages.

Managing admin keys

{
  "id": "adminkey_01JCC2E4G6J8L0N2Q4S6",
  "type": "admin_key",
  "name": "terraform-org",
  "prefix": "sk_admin_7d3e",
  "status": "active",
  "created_by": { "id": "user_01J9...", "email": "ops@example.com", "role": "owner" },
  "allowed_ips": ["203.0.113.0/24"],
  "created_at": "2026-11-01T09:00:00Z",
  "last_used_at": "2026-11-05T02:00:13Z"
}

Revoking (deleting) an admin key is done in the Console. Setting it inactive through the API takes effect at once and can be undone.

Audit of every request

Each Admin API request writes an audit event admin_api.request with the key id, method, path, status, IP address and request ID. Writes also produce their own specific events, such as member.change_role or workspace.archived. Read them with the audit feed.

Errors

Good practice

• One admin key per automation, named after it.
• Always set an IP allowlist on admin keys.
• Store admin keys in a secret manager with tighter access than inference keys.
• Review Last used monthly and revoke keys that are idle.

Build notes for the platform team

• Add a kind column (inference, admin) to the key table; do not create a second table. The auth step routes by kind before any handler runs.
• Resolve the creator’s role on every request (cached for 60 seconds) so demotion takes effect quickly.
• Rate-limit the Admin API separately from inference traffic.

Related

• Organization info
• Managing API keys
• Organizations & roles