Streamline Sub-Tenant Management

Role / Permission	What they can do
Parent Tenant Admin	Create, list, and update sub-tenants via API; set usage allocations
Parent org users (any role inherited from parent)	Switch into sub-tenants via the org switcher and work there per their role
Sub-Tenant Admin	Manage users and settings within their own sub-tenant; no visibility into the parent org or other sub-tenants

Sub-tenant management APIs require the Sub-tenant feature to be enabled on your parent organization. Contact your Intellistack account team if you need this enabled.

Note: Sub-tenant provisioning and allocation management are API-only. There is no self-service UI for fleet management. Parent users with inherited roles can still access sub-tenants through the existing org switcher.

 

Key Capabilities

API-driven provisioning and management

• Create sub-tenants with only an organization name required
• Optionally add an initial admin user and per-feature usage allocations at creation time
• List, search, and sort all sub-tenants under your parent account
• Update sub-tenant names and allocation targets after provisioning
• Retrieve per-sub-tenant usage snapshots by feature

Pooled usage and consolidated billing

• All tracked usage types (API requests, workflow sessions, collaborations, data connections, and related connection types) draw from a single parent pool
• Your parent org's own usage counts against the same pool as your sub-tenants
• You receive one aggregate invoice to the parent organization; sub-tenants are not billed individually

Cross-org access without impersonation

• Sub-tenants appear in the org switcher for parent users whose roles are inherited
• A parent Builder can switch into a sub-tenant and work as a Builder there
• A local user record is created for you the first time you switch into a sub-tenant

Per-sub-tenant usage reset schedules

• Sub-tenants reset usage on a monthly or annual cadence per feature, or on a lifetime basis for features without a reset cadence
• A sub-tenant provisioned mid-cycle gets a full usage period from its provisioning date before the first reset

Set Up API Access

Generate a personal access key

Sub-tenant APIs authenticate with a personal access key passed as a Bearer token in the Authorization header.

1. Sign in to your parent organization as an admin.
2. Navigate to your account settings and create a personal access key.
3. Store the key securely. You will use it in the Authorization header for all sub-tenant API calls:

Tip: Use a dedicated service account or integration user for API automation rather than a personal user account, so key rotation does not disrupt your provisioning workflows.

 

Provision a Sub-Tenant

Create a sub-tenant via API

Send a POST request to /v1/organization/subaccounts.

Required field: organization name.

Optional fields:

• Initial admin user (email, first name, last name)
• Per-feature usage allocations

Example request body:

{
  "name": "Acme Healthcare West",
  "adminUser": {
    "email": "admin@acmewest.example.com",
    "firstName": "Jane",
    "lastName": "Doe"
  },
  "allocations": [
    { "featureId": "workflow-sessions", "value": 200 },
    { "featureId": "api-requests", "value": 10000 }
  ]
}

Provisioning options:

• You can create a sub-tenant with no initial user. Parent users have access via role inheritance immediately after provisioning.
• Per-feature allocations accept either a positive value or unlimited: true (mutually exclusive). Features omitted from the request have no per-child cap.
• The number of sub-tenants you can create is capped per your contract (MAX_SUBACCOUNTS entitlement on your parent plan).

On success, the response includes the sub-tenant ID, name, creation timestamp, allocations, and the created admin user (if provided).

 

List and Update Sub-Tenants

List all sub-tenants

Send a GET request to /v1/organization/subaccounts.

The response includes each sub-tenant's name, ID, creation date, and current allocation settings. Supports:

• Pagination (pageSize 1–50, default 10)
• Sorting by name or createdAt (default createdAt, descending)
• Case-insensitive name search

Each allocation in the list response uses a state field:

• ALLOCATED — a specific cap is set (value present)
• NO_CAP — no per-child cap (value absent)

Note: Per-sub-tenant live usage is not returned in the list response. Use the usage endpoint (Part 5) to retrieve current usage for a specific sub-tenant.

Update a sub-tenant

Send a PUT request to /v1/organization/subaccounts/{subaccountId}.

This is a full replacement. The request body must include all allocations, not only the changed ones. You can update the sub-tenant name and allocation targets in the same request.

Per-feature allocations accept either a positive value or unlimited: true (mutually exclusive). Features omitted from the body reset to the default: uncapped if your parent plan includes the feature, zero otherwise.

Pool validation runs on every write. A 422 error is returned if the requested allocations would exceed your remaining pool capacity for a feature.

 

Full API Documentation

Full API Documentation can be found here.

Access a Sub-Tenant in the UI

Parent users can switch into sub-tenants using the existing org switcher. No impersonation is required.

1. Sign in to your parent organization.

2. Open the org switcher in your profile card

   

3. Select the sub-tenant you want to access

4. Work in the sub-tenant with the same role you hold on the parent org.

   Note: All parent users with a given role can access all sub-tenants with that same role. Granular per-sub-tenant access control is not available in this release.

The first time you switch into a sub-tenant, Intellistack creates a local user record for you in that organization.

 

Check Sub-Tenant Usage

Send a GET request to /v1/organization/subaccounts/{subaccountId}/usage.

The response includes:

• An asOf timestamp
• Per-feature allocation (state of ALLOCATED or NO_CAP)
• Current usage
• Reset cadence (MONTHLY, ANNUAL, or absent for lifetime meters)
• Current period start and next reset date (absent when no reset cadence applies)

Only features where the sub-tenant has an entitlement are included.

 

Supported Feature IDs

Use these featureId values in allocation requests:

 

Feature Considerations

API-only management in this release

• Sub-tenant provisioning, listing, and allocation updates are available through the API only
• There is no self-service admin portal for fleet management in this release

Allocations are planning targets, not enforced limits

• Allocation values set per sub-tenant are planning targets only
• A sub-tenant can exceed its allocation without being blocked

No sub-tenant suspension

• Sub-tenants can only be in an active state in this release

No usage dashboard

• Usage must be retrieved via the API (/usage endpoint per sub-tenant)
• There is no consolidated parent pool summary endpoint in this release

Bulk operations are not supported

• Provisioning and allocation updates operate on one sub-tenant at a time

No webhooks or alerts

• You are not notified when pool usage approaches a threshold

Allocation decreases are not validated against consumed usage

• Reducing a sub-tenant's allocation below its current usage is not prevented in this release

Regional constraint

• Parents and sub-tenants must be on the same cluster. Cross-region parent/child relationships are not supported.

Billing model

• Only the pooled ISV model is supported (single aggregate invoice to parent)
• Per-sub-tenant invoicing where each sub-tenant is billed independently is not supported

Template sharing

• Workflow and form template sharing across sub-tenants is not available in this release

Access control

• All parent users of a given role can access all sub-tenants. Restricting which parent users can access which sub-tenants is not available in this release.

Compliance

Sub-tenants are independent Streamline organizations. Password and session settings are inherited from the parent organization; sub-tenants cannot override them. Sub-tenant data is isolated per organization.

 

Troubleshooting

 

API error reference

 

Summary

Streamline Sub-Tenant Management lets partners provision and manage multiple customer organizations under a single parent account with pooled usage and consolidated billing. In this release, provisioning and allocation management are API-driven. Parent users access sub-tenants through the org switcher using role inheritance. Contact your Intellistack account team to enable the feature on your parent organization.