> ## Documentation Index
> Fetch the complete documentation index at: https://developers.resistant.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Overview

> Provision and manage isolated tenants and region-specific machine-to-machine applications under a single organization.

The **Tenant Management API** is designed for **partners** who handle data from multiple downstream customers. It enables you to provision and manage **isolated tenants** under a single parent organization, ensuring customer data remains segregated while still being managed centrally.

With this API you can:

* Create and manage tenants under your organization
* Provision applications within each tenant for machine-to-machine (M2M) submissions
* Manage lifecycle operations such as listing, fetching, and deleting tenants and applications

This separation allows you to enforce data isolation, support per-customer customization, and simplify monitoring across multiple clients.

***

## Key model (control plane vs data plane)

Resistant AI separates **tenant management** from **document processing**, and each uses different credentials and access scopes:

### Tenant Management API (control plane)

* Uses **organization-level** credentials (admin scope).
* Access tokens are used **only** for Tenant Management API operations:
  * create/list/delete tenants
  * create/manage tenant applications
* These tokens **cannot** be used for document submission or result retrieval.

### Documents API (data plane)

* Document submission and result retrieval must be done using credentials issued for a **tenant application**.
* The token scopes for Documents API are different (e.g., read/write submission scopes).

## Workflow

<Steps>
  <Step title="User organization-level credentials to call Tenant Management API (control-plane)" />

  <Step title="Create one tenant per downstream customers (recommended)" />

  <Step title="Create one or more tenant applications per tenant (per region/cell)" />

  <Step title="Use tenant application credentials to call Documents API (data plane)" />
</Steps>

## Provisioning limits & lifecycle

<Tip>
  **Default tenant quota:** organizations can provision up to **20 tenants** by default.\
  If you need more, contact Resistant AI to increase the quota.
</Tip>

### Treat tenants as lifecycle-managed resources

Tenants are intended to represent real downstream customers and should be managed over time:

* **Create** a tenant when onboarding a downstream customer.
* **Operate** with one or more tenant applications (per cell/region as needed).
* **Delete** tenants you no longer need to keep the organization tidy and reduce administrative overhead.

<Note>
  To delete a tenant, you must first delete all **tenant applications** inside that tenant.
</Note>

***

## Core concepts

### Organization

The **organization** is the top-level container, provisioned by Resistant AI.

* Acts as a parent for all your tenants
* Users (via SSO integration) can belong to one or more tenants within the organization
* Organization-level applications are used to manage tenants and tenant-level applications

### Tenant

A **tenant** represents an isolated scope for data and configuration.

* Primary isolation boundary for data and configuration
* Each tenant can have its own users and applications
* Submissions created under one tenant are not visible to another, ensuring strict data segregation
* Tenants are multi-regional: they exist globally within the organization but host their own **region-specific applications**

**Recommended mapping (partner best practice):**

* Use a **one-to-one mapping between your downstream customers and Resistant AI tenants** (one tenant per downstream customer).

### Application

An **application** is an OAuth2 client credential representing machine-to-machine access.

There are two important categories:

#### Organization-level application

A special application used at the organization level.

Required to:

* Create tenants
* Create tenant applications

It returns a `client_id` and either requires an RSA key or supports the client credentials flow.

#### Tenant application

A tenant application:

* Belongs to **exactly one tenant**
* Is used **only for authentication** (machine-to-machine access to the Documents API)
* Each tenant can have **one or more** tenant applications (e.g., one per region)

Applications are **region-specific**, since submissions and results processing occur within a defined AWS region (e.g., EU, US, CA, AP).

<Info>
  Cell = our short region identifier used when creating tenant applications.
</Info>