Manage the shared AI provider and model catalog
Open Account AI administration with provider/model administration permissions. Complete Account setup. The catalog is tenant-scoped and shared across products.
Providers, models, and tenant defaults live in authorization.providers, authorization.models, and authorization.catalog_states. MailGen, FormGen, and RecGen can reference the same model IDs. Group model grants use authorization.group_model_grants without a product dimension. Product permission remains a separate decision.
Admin API
| Signed AdminService route | Content | Permission |
|---|---|---|
GET/POST /providers, PATCH/DELETE /providers/:id | Tenant provider list and ID-based changes. | admin.ai.providers.read/manage |
GET/POST /models, PATCH/DELETE /models/:id | Tenant models, including isDefault. | admin.ai.models.read/manage |
POST /models/:id/default | Select tenant default model. | admin.ai.models.manage |
GET /groups and group save | Shared modelGrants. | admin.groups.read/manage, plus admin.ai.models.assignToGroup for assignment |
GET /llm-usage | Tenant summary and paginated invocation ledger. | admin.ai.usage.read |
Account's /api/admin/* proxy sends a server-signed actor proof. That proof supplies tenant and actor. Database queries remain tenant-scoped. Public provider lists expose only hasApiKey and hasConfiguration, never encrypted field values.
Keys and configuration use separate access with admin.ai.providers.apiKeys and audit events. Usage includes tokens, costs, and states, not prompts, keys, or secret configuration.
Existing provider/model edits retain IDs. Omitting a new key preserves the encrypted key. An in-use provider target or model identity cannot be redirected under the same ID.
Legacy MailGen msintegrationv2.provider and msintegrationv2.model records remain. Sorter mappings use authorization_provider_id and authorization_model_id UUIDs without copying secret keys. These records do not constitute separate product catalogs.
Default model lifecycle
A tenant default is a preference, not a grant. Selection requires an active model/provider and excludes embedding models. Runtime still checks the user's model grant.
Deleting or deactivating the selected model/provider, or changing the model to embedding, clears stale default_model_id in the same transaction. Other tenants' defaults remain unchanged. If inherited model resolution fails, inspect the active default and user grant before retrying.