cmind/tenants/v1/tenant_service.proto
Package: cmind.tenants.v1
Messages
Tenant
Tenant is the full tenant representation returned by admin-gated endpoints. Carries fields whose computation is acceptable on those paths (e.g. user_count requires a Keycloak round-trip per tenant).
| Field | Type | Number | Description |
|---|---|---|---|
id | string | 1 | |
name | string | 2 | |
userCount | uint32 | 3 | |
createdAt | google.protobuf.Timestamp | 4 | |
groupCount | uint32 | 5 | group_count is the number of custom groups in the tenant — like user_count, a Keycloak round-trip per tenant, so it's only on this admin-gated shape. |
TenantSummary
TenantSummary is the lightweight representation used by hot, user-facing endpoints where we don't want to pay for full enrichment. Beyond identity it carries the calling user's own role in the tenant.
| Field | Type | Number | Description |
|---|---|---|---|
id | string | 1 | |
name | string | 2 | |
role | TenantRole | 3 | role is the calling user's role level in this tenant. |
ListUserTenantsRequest
ListUserTenantsResponse
| Field | Type | Number | Description |
|---|---|---|---|
tenants | repeated TenantSummary | 1 |
ListTenantsRequest
ListTenantsResponse
| Field | Type | Number | Description |
|---|---|---|---|
tenants | repeated Tenant | 1 |
GetTenantRequest
| Field | Type | Number | Description |
|---|---|---|---|
tenantId | string | 1 |
GetTenantResponse
| Field | Type | Number | Description |
|---|---|---|---|
tenant | Tenant | 1 |
CreateTenantRequest
| Field | Type | Number | Description |
|---|---|---|---|
name | string | 1 |
CreateTenantResponse
| Field | Type | Number | Description |
|---|---|---|---|
tenant | Tenant | 1 |
DeleteTenantRequest
| Field | Type | Number | Description |
|---|---|---|---|
tenantId | string | 1 |
DeleteTenantResponse
TenantMember
| Field | Type | Number | Description |
|---|---|---|---|
userId | string | 1 | |
role | TenantRole | 2 | |
metadata | cmind.permissions.v1.UserMetadata | 3 | metadata is populated by List responses only. Absent when the user can no longer be resolved (deleted from the identity provider). |
ListTenantMembersRequest
| Field | Type | Number | Description |
|---|---|---|---|
tenantId | string | 1 |
ListTenantMembersResponse
| Field | Type | Number | Description |
|---|---|---|---|
members | repeated TenantMember | 1 |
SetTenantMemberRoleRequest
SetTenantMemberRole changes the role of a user who is already a member. Joining is the invite/accept flow (InviteService); this fails with NotFound if the user is not already in the tenant.
| Field | Type | Number | Description |
|---|---|---|---|
tenantId | string | 1 | |
userId | string | 2 | |
role | TenantRole | 3 |
SetTenantMemberRoleResponse
RemoveTenantMemberRequest
RemoveTenantMember removes the user from the tenant entirely (all levels).
| Field | Type | Number | Description |
|---|---|---|---|
tenantId | string | 1 | |
userId | string | 2 |
RemoveTenantMemberResponse
AddTenantMemberRequest
AddTenantMember adds a user to the tenant at the given role. A platform operation (can_manage_tenants): unlike the invite flow, it adds the user directly. The caller can pass their own user_id to join a tenant they manage; leaving is RemovePlatformTenantMember with one's own id, because the role joined at (member or editor) carries no can_admin for RemoveTenantMember.
| Field | Type | Number | Description |
|---|---|---|---|
tenantId | string | 1 | |
userId | string | 2 | |
role | TenantRole | 3 |
AddTenantMemberResponse
PlatformUser
PlatformUser is a user known to the identity provider, with their tenant memberships. Admin-gated — computing memberships is a Keycloak round-trip per user.
| Field | Type | Number | Description |
|---|---|---|---|
userId | string | 1 | |
username | string | 2 | |
email | string | 3 | |
tenants | repeated UserTenantMembership | 4 | Tenants the user belongs to, each with their role. Empty for a user who holds no tenant membership. |
UserTenantMembership
| Field | Type | Number | Description |
|---|---|---|---|
tenantId | string | 1 | |
tenantName | string | 2 | |
role | TenantRole | 3 |
ListPlatformUsersRequest
| Field | Type | Number | Description |
|---|---|---|---|
page | cmind.common.v1.PageRequest | 1 | |
search | string | 2 | Optional: return only users whose username or email contains this substring (case-insensitive, Keycloak's native search). |
ListPlatformUsersResponse
| Field | Type | Number | Description |
|---|---|---|---|
users | repeated PlatformUser | 1 | |
page | cmind.common.v1.PageInfo | 2 |
RemovePlatformTenantMemberRequest
| Field | Type | Number | Description |
|---|---|---|---|
tenantId | string | 1 | |
userId | string | 2 |
RemovePlatformTenantMemberResponse
SetContentCaptureRequest
Content-capture policy — a personal, per-admin opt-in governing whether the gateway records trace content for the caller's own requests: the prompt + answer (a gen_ai event) and the tool-call span content. The target is always the caller, derived server-side from the authenticated principal — never a field on these messages, so one admin can never flip capture on (or read it back) for someone else. Off by default; unset is treated as off.
| Field | Type | Number | Description |
|---|---|---|---|
tenantId | string | 1 | |
enabled | bool | 2 |
SetContentCaptureResponse
GetContentCaptureRequest
| Field | Type | Number | Description |
|---|---|---|---|
tenantId | string | 1 |
GetContentCaptureResponse
| Field | Type | Number | Description |
|---|---|---|---|
enabled | bool | 1 |
ListGenAiEventsRequest
gen_ai event read — lists the prompt/answer events the gateway captured for a tenant (opt-in via the content-capture policy) into the queryable gen_ai_events analytics table. Backs the inspection UI; each event joins to its trace by trace_id.
| Field | Type | Number | Description |
|---|---|---|---|
tenantId | string | 1 | |
limit | uint32 | 2 | limit defaults to 100 and is capped at 1000 server-side. |
pageOffset | uint32 | 3 | |
startTime | google.protobuf.Timestamp | 4 | Optional time window; an unset bound is unbounded. |
endTime | google.protobuf.Timestamp | 5 | |
conversationId | string | 6 | Optional filters: conversation_id groups a conversation's turns; trace_id fetches a single trace's event (the inspection UI's per-trace view). |
traceId | string | 7 |
GenAiEvent
GenAiEvent is one captured inference: the model, the prompt/answer message arrays (OTel GenAI message-array JSON), and the ids correlating it to a trace and conversation.
| Field | Type | Number | Description |
|---|---|---|---|
timestamp | google.protobuf.Timestamp | 1 | |
traceId | string | 2 | |
spanId | string | 3 | |
requestModel | string | 4 | |
inputMessages | string | 5 | |
outputMessages | string | 6 | |
conversationId | string | 7 | |
responseId | string | 8 |
ListGenAiEventsResponse
| Field | Type | Number | Description |
|---|---|---|---|
events | repeated GenAiEvent | 1 | |
hasMore | bool | 2 | has_more is true when rows exist past this page (via a limit+1 over-fetch). |
GetChatInstructionsRequest
Tenant chat instructions: the tenant-admin-editable general assistant prompt composed into direct-model Chat requests. Three states: unset (the platform baseline applies), empty string (the tenant component is omitted entirely), or custom text (used verbatim). Never applies to preset agents.
| Field | Type | Number | Description |
|---|---|---|---|
tenantId | string | 1 |
GetChatInstructionsResponse
| Field | Type | Number | Description |
|---|---|---|---|
instructions | string | 1 | The effective instructions: the platform baseline when the tenant is unset, otherwise the tenant's stored text. Empty means the tenant explicitly omitted the tenant component. |
usesDefault | bool | 2 | True when the tenant is on the platform baseline (nothing stored). The editor uses this to offer reset-to-baseline. |
SetChatInstructionsRequest
| Field | Type | Number | Description |
|---|---|---|---|
tenantId | string | 1 | |
instructions | optional string | 2 | Optional. Absent resets the tenant to the platform baseline. An explicit empty string omits the tenant component. Nonempty text is stored verbatim as the tenant's custom instructions. |
SetChatInstructionsResponse
Services
TenantService
ListUserTenants
Returns tenants the authenticated user belongs to.
Request: ListUserTenantsRequest
Response: ListUserTenantsResponse
ListTenants
Returns all tenants (admin operation).
Request: ListTenantsRequest
Response: ListTenantsResponse
GetTenant
Returns a single tenant. Gated on can_admin of the specific tenant so tenant admins (not just platform admins) can fetch their own tenant.
Request: GetTenantRequest
Response: GetTenantResponse
CreateTenant
Request: CreateTenantRequest
Response: CreateTenantResponse
DeleteTenant
Request: DeleteTenantRequest
Response: DeleteTenantResponse
ListTenantMembers
Lists members of the tenant with their roles. Any tenant member may read it: sharing a resource with a person needs the tenant's directory.
Request: ListTenantMembersRequest
Response: ListTenantMembersResponse
SetTenantMemberRole
Changes an existing member's role within the tenant.
Request: SetTenantMemberRoleRequest
Response: SetTenantMemberRoleResponse
RemoveTenantMember
Removes a member from the tenant entirely.
Request: RemoveTenantMemberRequest
Response: RemoveTenantMemberResponse
AddTenantMember
Adds a user to the tenant at a given role (also used to join a tenant you manage by passing your own id).
Request: AddTenantMemberRequest
Response: AddTenantMemberResponse
GetContentCapture
Returns whether content capture is enabled for the caller's own requests in this tenant — not the tenant as a whole. Gated can_read.
Request: GetContentCaptureRequest
Response: GetContentCaptureResponse
SetContentCapture
Sets whether content capture is enabled for the caller's own requests in this tenant (tenant-admin). Off by default; enabling opts in only your own traffic — other members' conversations are never captured.
Request: SetContentCaptureRequest
Response: SetContentCaptureResponse
ListGenAiEvents
Lists captured gen_ai events (prompt + answer) for a tenant, newest first, from the queryable gen_ai_events analytics table. Gated can_admin: this returns raw cross-user prompt/answer content (a higher sensitivity class than GetContentCapture's single on/off bit), so reading it is admin-only — symmetric with SetContentCapture, which gates the decision to capture.
Request: ListGenAiEventsRequest
Response: ListGenAiEventsResponse
GetChatInstructions
Returns the tenant's effective chat instructions for the admin editor. Gated can_admin: instructions shape every member's Chat traffic.
Request: GetChatInstructionsRequest
Response: GetChatInstructionsResponse
SetChatInstructions
Sets the tenant's chat instructions. Gated can_admin. Absent instructions resets to the platform baseline; an explicit empty string omits the tenant component; nonempty text is stored verbatim.
Request: SetChatInstructionsRequest
Response: SetChatInstructionsResponse
ListPlatformUsers
Lists every user in the identity provider realm, with their tenant memberships. Platform-admin operation.
Request: ListPlatformUsersRequest
Response: ListPlatformUsersResponse
RemovePlatformTenantMember
Removes a user from a tenant. Platform-admin operation: unlike RemoveTenantMember (tenant-admin gated), this does not require the caller to be an admin of the target tenant.
Request: RemovePlatformTenantMemberRequest
Response: RemovePlatformTenantMemberResponse