> ## Documentation Index
> Fetch the complete documentation index at: https://docs.portkey.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Introduction

> Manage your Prisma AIRS AI Gateway organisation and workspaces programmatically

# AI Gateway Admin API

The AI Gateway Admin API provides programmatic access to manage your organisation, workspaces, and resources. Whether you're automating routine administration tasks, integrating the AI Gateway with your existing systems, or customizing your deployment at scale, this API gives you the tools to control every aspect of your AI Gateway implementation.

## Understanding the Admin API Ecosystem

The Admin API is organized around key capabilities that let you manage different aspects of your AI Gateway environment. Let's explore what you can build and automate:

### Resource Management

At the foundation of the AI Gateway are the resources that define how your AI implementation works. These can all be managed programmatically:

<CardGroup cols={3}>
  <Card title="Configs" href="/docs/api-reference/admin-api/control-plane/configs/create-config">
    Create and manage configuration profiles that define routing rules, model settings, and more.
  </Card>

  <Card title="Providers & Integrations" href="/docs/api-reference/admin-api/control-plane/providers/create-provider">
    Manage AI providers and credentials across workspaces. Replaces Virtual Keys.
  </Card>

  <Card title="API Keys" href="/docs/api-reference/admin-api/control-plane/api-keys/create-api-key">
    Create and manage API keys for accessing AI Gateway services.
  </Card>
</CardGroup>

### Analytics and Monitoring

Once your resources are configured, you'll want to measure performance and usage. The Admin API gives you powerful tools to access analytics data:

<CardGroup cols={3}>
  <Card title="Summary Data" href="/docs/api-reference/admin-api/control-plane/analytics/summary/get-all-cache-data">
    Retrieve aggregated usage statistics and performance metrics.
  </Card>

  <Card title="Grouped Data" href="/docs/api-reference/admin-api/control-plane/analytics/groups-paginated-data/get-model-grouped-data">
    Access detailed analytics organized by metadata, model, or user.
  </Card>

  <Card title="Time Series Data" href="/docs/api-reference/admin-api/control-plane/analytics/graphs-time-series-data/get-cost-data">
    Monitor performance trends, costs, errors, feedback, and usage patterns over time.
  </Card>
</CardGroup>

## Authentication Strategy

Now that you understand what the Admin API can do, let's explore how to authenticate your requests. The AI Gateway uses a sophisticated access control system with two types of API keys, each designed for different use cases:

<CardGroup cols={2}>
  <Card title="Admin API Key" icon="key">
    **Organisation-wide access**

    These keys grant access to administrative operations across your entire organisation.

    <Note>Only Organisation Owners and Admins can create and manage Admin API keys.</Note>
  </Card>

  <Card title="Workspace API Key" icon="key">
    **Workspace-specific access**

    These keys provide targeted access to resources within a single workspace.

    <Note>Workspace Managers can create and manage Workspace API keys.</Note>
  </Card>
</CardGroup>

The key you use determines which operations you can perform. For organisation-wide administrative tasks, you'll need an Admin API key. For workspace-specific operations, you can use a Workspace API key.

## Access Control and Permissions Model

The AI Gateway's hierarchical access control system governs who can use which APIs. Let's examine how roles, API keys, and permissions interact:

```mermaid theme={"system"}
graph TD
    A[Organization] --> B[Owner]
    A --> C[Org Admin]
    A --> D[Workspaces]
    B --> E[Admin API Key]
    C --> E
    D --> F[Workspace Manager]
    D --> G[Workspace Member]
    F --> H[Workspace API Key]
    E --> I[Organization-wide Operations]
    H --> J[Workspace-specific Operations]

    classDef entity fill:#4a5568,stroke:#ffffff,color:#ffffff
    classDef roles fill:#805ad5,stroke:#ffffff,color:#ffffff
    classDef keys fill:#3182ce,stroke:#ffffff,color:#ffffff
    classDef operations fill:#38a169,stroke:#ffffff,color:#ffffff

    class A,D entity
    class B,C,F,G roles
    class E,H keys
    class I,J operations
```

This access model follows a clear hierarchy:

| Role               | Can Create Admin API Key | Can Create Workspace API Key | Access Scope               |
| :----------------- | :----------------------- | :--------------------------- | :------------------------- |
| Organisation Owner | ✅                        | ✅ (any workspace)            | All organisation resources |
| Organisation Admin | ✅                        | ✅ (any workspace)            | All organisation resources |
| Workspace Manager  | ❌                        | ✅ (managed workspace only)   | Single workspace resources |
| Workspace Member   | ❌                        | ❌                            | Limited workspace access   |

## Creating and Managing API Keys

Now that you understand the permission model, let's look at how to create the API keys you'll need:

### Through Strata Cloud Manager

The simplest way to create an API key is through Strata Cloud Manager:

### Through the API

You can also create keys programmatically:

<CodeGroup>
  ```sh Creating Admin API Key {1,2} theme={"system"}
  curl -X POST https://aigw.portkey.ai/v1/api-keys/organisation/service
    -H "Authorization: Bearer YOUR_EXISTING_ADMIN_KEY" \
    -H "Content-Type: application/json" \
    -d '{
      "name":"API_KEY_NAME_0809",
      "scopes":[
        "logs.export",
        "logs.list",
        "logs.view"
      ]
    }'
  ```

  ```sh Creating Workspace API Key {1,2} theme={"system"}
  curl -X POST https://aigw.portkey.ai/v1/api-keys/workspace/user \
    -H "Authorization: Bearer YOUR_EXISTING_WORKSPACE_KEY" \
    -H "Content-Type: application/json" \
    -d '{
      "name":"API_KEY_NAME_0909",
      "workspace_id":"WORKSPACE_ID",
      "scopes":[
        "virtual_keys.create",
        "virtual_keys.update",
      ]
    }'
  ```
</CodeGroup>

## Understanding API Key Capabilities

Both key types have different capabilities. This table clarifies which operations each key type can perform:

| Operation                    | Admin API Key      | Workspace API Key    |
| :--------------------------- | :----------------- | :------------------- |
| Manage organisation settings | ✅                  | ❌                    |
| Create/manage workspaces     | ✅                  | ❌                    |
| Manage users and permissions | ✅                  | ❌                    |
| Create/manage configs        | ✅ (All workspaces) | ✅ (Single workspace) |
| Create/manage providers      | ✅ (All workspaces) | ✅ (Single workspace) |
| Access Analytics             | ✅ (All workspaces) | ✅ (Single workspace) |
| Create/update feedback       | ❌                  | ✅                    |

## Security and Compliance: Audit Logs

For security-conscious organisations, the AI Gateway provides comprehensive audit logging of all Admin API operations. These logs give you complete visibility into administrative actions:

Every administrative action is recorded with:

* User identity
* Action type and target resource
* Timestamp
* IP address
* Request details

This audit trail helps maintain compliance and provides accountability for all administrative changes.

<Card title="Audit Logs Documentation" icon="shield-check" href="/docs/aigw/product/enterprise-offering/audit-logs">
  Learn more about the AI Gateway's audit logging capabilities
</Card>

## Getting Started with the Admin API

Now that you understand the Admin API ecosystem, authentication, and permissions model, you're ready to start making requests. Here's what you'll need:

1. **Appropriate role**: Ensure you have the right permissions (Org Owner/Admin for Admin API, Workspace Manager for Workspace API)
2. **API key**: Generate the appropriate key from Strata Cloud Manager
3. **Make your first request**: Use your key in the request header

For developers looking to integrate with the Admin API, we provide a complete OpenAPI specification that you can use with your API development tools:

<Card title="OpenAPI Specification" icon="file-code" href="/docs/aigw/api-reference/inference-api/open-api-specification">
  A single specification covers both the gateway and the Admin API
</Card>

## Need Support?

If you need help setting up or using the Admin API, our team is ready to assist:

<Card title="Book a Support Call" icon="calendar" href="https://www.paloaltonetworks.com/ai-security/ai-gateway#:~:text=See%20Prisma%20AIRS%20AI%20Gateway%20in%20Action">
  Schedule time with our team to get personalized help with the Admin API
</Card>


## Related topics

- [Introduction](/docs/aigw/api-reference/inference-api/introduction.md)
- [Agent Gateway](/docs/aigw/product/agent-gateway.md)
- [Advanced code snippets and examples](/docs/aigw/product/agent-gateway/advanced-code-snippets-and-examples.md)
- [Agent Servers](/docs/aigw/product/agent-gateway/servers.md)
- [CrewAI](/docs/aigw/integrations/agents/crewai.md)