oto_admin_tenant
[platform admin] Tenant tracking (identity tier, ADR 0052). op=list → one row per declared tenant: issuer + jwks + hosts + oauth client + dashboard url, the tool-name prefix shown to its accounts (tool_prefix declared vs tool_prefix_effectif actually applied), whether it is LOADED in this process's issuer registry (declared but not restarted ⇒ its tokens are still rejected), orgs (via orgs.tenant_id), accounts (via sub qualification), active accounts + MCP calls over days (default 30), and orgs_desalignees — orgs attached to this tenant whose creator is qualified under another one. op=get (slug) adds the lists behind those counters (orgs, accounts by activity, misaligned orgs). Declaring a tenant remains a provisioning runbook, not an API — but op=reload (super_admin) makes THIS process re-read the declarations without a restart: the issuer registry and the accepted issuers are swapped live, which clears pending_restart. Per-process: prod and preprod share the DB but not their registry. op=keys (slug) → the connector keys posed on the tenant (never the secret): one shared key serves every org of the tenant that has no closer key (member/team/org), resolved before the platform key. op=key_clear (slug, provider, optional account; super_admin) removes one. Posing a key is REST only: PUT /api/admin/tenants/{slug}/keys/{provider}. op=admins (slug) → the tenant's admins (accounts qualified under it: they manage the tenant's keys and org grants from the REST face); admin_add / admin_remove (slug, sub; super_admin). op=org_grants (slug, provider) → orgs granted the tenant's key with their shared daily budget and usage; org_grant (org_id, optional daily_quota, 0 = unlimited; replaces) / org_revoke (org_id; the org falls back to the platform key) — super_admin. Without any grant the key serves every org of the tenant; the anonymous endpoint of an org gets it only through a live grant. op=disable (slug, reason; super_admin) disables the tenant: every request of its accounts is refused from the next one on (any token, dashboard sessions included), new authorizations on its hosts are refused, its API/delegation tokens are revoked — counts by type returned. op=enable (slug) reopens new connections only; revoked tokens stay revoked. Never edit issuer by hand to disable a tenant.
Tool call template
This tool declares no required parameters. Add optional parameters from the input schema as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {},
"name": "oto_admin_tenant"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| op | No | list | |
| sub | No | ||
| _org | No | ||
| days | No | ||
| slug | No | ||
| org_id | No | ||
| reason | No | ||
| account | No | ||
| provider | No | ||
| daily_quota | No |