Overview
Manage tenants and their licenses from the sections on the left. This is the interim admin surface until the full cloud console lands.
Create tenant
Tenants
Create license
Runtime-facing read
Tenant license validity
Licenses
Commercial source of truth
Tenant entitlement limits
Define the entitlement facts Cloud signs for each tenant and usage profile. These are customer-specific commercial terms, not values inherited dynamically from a shared template.
Configured policies
Profiles for this tenant
Select a tenant to review its development and enterprise limits.
Tenant and usage profile
Configure entitlement policy
Signed bundle facts
These five values are included in the signed bundle and stored by Core after activation or refresh. They describe the purchased entitlement, but no runtime quota policy currently enforces them.
Effect: saving changes Cloud's tenant-specific source of truth. The facts do not push to an installation immediately; Core receives them on its next activation or license refresh. They are not runtime-enforced quotas today.
Cloud → private Core installation
Private installation activation
Select the customer tenant that owns the private Core installation. The same selection is used by the activation workflow and the operator inspection tool below.
Customer installation credential
Activation key
Give this long-lived credential to the customer installation. Core presents it to Cloud when it activates or refreshes its license terms; Cloud then returns the current signed entitlement bundle automatically.
Re-issuing a key does not revoke earlier keys. They remain valid until expiry unless the Cloud signing key is rotated.
Operator tools
Signed entitlement bundle inspection
Short-lived Cloud response
Generate a bundle for inspection
What it is
A signed JWT snapshot of the selected tenant's current licenses, entitlement states, modules, and usage-limit facts.
When to use it
Inspect or troubleshoot exactly what Cloud would return to Core. Normal customer activation obtains this bundle automatically using the activation key.
What it does not do
It does not contact Core, activate an installation, apply license terms, or change the tenant's licenses.
Before generating: the tenant must have licenses, and every licensed usage profile must have its constraint policy configured. Cloud refuses to sign a bundle with unknown limits.
Every request creates a new artifact with a fresh bundle_id. Its one-hour acceptance window limits replay of the response; it does not shorten the commercial license dates contained inside it.
This browser only
Recent issuance receipts
Cloud currently has no issuance registry or per-key revocation API. This list stores metadata and SHA-256 fingerprints in this browser; raw activation keys and signed bundles are never persisted.
Cloud-owned reference catalog
Access / RBAC
Synapse owns its employee and tenant role templates, capability catalogue, and compatibility projection. Core has an independent runtime vocabulary; only the signed license wire contract is shared between them.
Last API result
No calls yet.