parent_id, so orgs form a hierarchy, and a parent can administer everything beneath it without being a member of each child.
Access is gated by the child_organizations:manage scope. Holders of that scope act on any org in their subtree purely through the parent-child relationship — they do not need to be a native member of a child to list it, view it, manage its members, or read its usage. Interactive login to a child org still requires native membership, which is why creating a child adds you to it as an admin.
Authorization model
Every partner-console route runs the same checks:- The caller is authenticated.
- The caller holds the
child_organizations:managescope. - The target org is the caller’s current org or a descendant of it.
is_descendant_of) rooted at the caller’s organization. If the target is not in your subtree, the request is rejected.
Because user PATs (
pat_) do not carry an organization, send the X-Anyreach-Org: <organization_id> header naming the org whose scope and subtree should apply. Org API keys (ak_) carry their org implicitly.Capabilities
| Capability | What it does |
|---|---|
| List direct children | Returns one level of children for a given parent. The console expands rows lazily, calling this per expanded node to load deeper levels. |
| Search descendants | Recursive substring search over the whole subtree (by slug or id), returning each match with a breadcrumb path. |
| View a child | Fetches a single child org’s details. |
| List child members | Lists the members of a child org. |
| Update member roles | Sets a child member’s organization roles. |
| Remove a member | Removes a member from a child org. |
| List invitations | Lists a child org’s pending invitations. |
| Create an invitation | Invites a user to a child org by email. |
| Usage view | Aggregated usage across the whole subtree, or a single child’s own usage. |
Endpoints
All partner-console routes live under the/admin/partner-console prefix.
| Method | Path | Description |
|---|---|---|
GET | /admin/partner-console/organizations | List direct children. Optional parent_id query (defaults to your current org); must be in your subtree. |
GET | /admin/partner-console/organizations/search | Recursive descendant search. Query params: q (substring), limit (1–100, default 25). |
GET | /admin/partner-console/organizations/{child_id} | View one child org. |
GET | /admin/partner-console/organizations/{child_id}/members | List a child’s members. |
PUT | /admin/partner-console/organizations/{child_id}/members/{user_id}/roles | Update a member’s roles. |
DELETE | /admin/partner-console/organizations/{child_id}/members/{user_id} | Remove a member. |
GET | /admin/partner-console/organizations/{child_id}/invitations | List a child’s invitations. |
POST | /admin/partner-console/organizations/{child_id}/invitations | Invite a user to a child org. |
GET | /admin/partner-console/usage-summary | Usage summary for the subtree or a single child. |
List direct children
parent_id defaults to your current org. The search root for descendant search is always your own org, read from your token, so you cannot probe a subtree you do not own.
id, slug, domain, domain_setup_status, and parent_id.
Search descendants
id, slug, domain, parent_id, depth, and path — where path is a breadcrumb of slugs joined with › from the root to that node, so a picker can show where a deep match sits in the tree.
Manage child members and invitations
These mirror the in-org member and invitation routes, but target a child bychild_id and authorize through the subtree check instead of native membership. See /organizations/members-and-invitations for the member and invitation model.
When you update a member’s roles, only roles that are valid organization roles are applied; unrecognized role IDs are dropped.
Usage view
The usage summary serves the Usage tab and supports two scopes.| Scope | Returns |
|---|---|
all (default) | Your current org plus every descendant, aggregated. No org_id needed. |
single | Only the selected child’s own usage, excluding its nested descendants. Requires org_id, which must be in your subtree. |
| Query param | Required | Description |
|---|---|---|
from | Yes | Start of the window (ISO 8601). |
to | Yes | End of the window (ISO 8601). Must be after from. |
scope | No | all (default) or single. |
org_id | When scope=single | Target child org; must be in your subtree. |
Create a child organization
Children are created through the standard org-create route with aparent_id, not a separate partner-console endpoint. When parent_id is set, the create flow verifies you hold child_organizations:manage and that parent_id is in your subtree before creating the org. You are added to the new org as an admin so you can sign in to it.
parent_id to create a standalone top-level org instead.
Open the Partner Console
The page is visible to users with the
child_organizations:manage scope. It loads your direct children as a tree.Pick a parent
Browse the tree or search descendants. Use the + affordance on any node — or New organization — to choose where the child is created.
Name the child
Enter a Name and Slug. The slug must be available. The dialog notes you will be added as the child’s admin.
Related
Members and invitations
How members, roles, and email invitations work within an org.
Usage and metering
What is metered and how usage summaries are computed.

