The management API lets your automation do much of what the console does: issue keys, add members and teams, configure single sign-on, read usage and audit events. Each operation names the permission it needs: give the service account whose key calls it a role that holds it.
Available by API
| Area | What you can do | Reference |
|---|---|---|
| API keys and service accounts | Create service accounts; issue, list and revoke keys. | API keys, Service accounts |
| Members, teams and roles | Invite and manage members, create teams, custom roles and their permissions. | Members, Teams, Roles |
| Single sign-on | Connect your identity provider and verify your domains. | Single sign-on |
| Model access | Read the catalog, restrict models to teams, connect your own providers. | Models, Entitlements |
| Usage and request logs | Read usage summaries and every request. | Usage, Request logs |
| Audit | Read and export security events. | Security events |
| Memory | Store, read and erase memory entries; zero content retention. | Memory entries |
curl
# The management APIs answer on your console's host.
export CCSIO_CONSOLE_URL="https://console.us.ccsio.ai"
# 1. A service account for the application (permission members.manage).
curl "$CCSIO_CONSOLE_URL/identity/v1/service-accounts" \
-H "Authorization: Bearer $CCSIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"org_id": "acme", "display_name": "billing-app", "role": "user"}'
# → {"principal_ref": "svc/01K7YP2C9W4X5E8H3J6M0N1Q2R", "display_name": "billing-app", "kind": "service_account"}
# 2. A key for it (permission api-keys.manage). The answer carries the raw key once, in "raw": store it now.
curl "$CCSIO_CONSOLE_URL/identity/v1/api-keys" \
-H "Authorization: Bearer $CCSIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"org_id": "acme",
"name": "billing-app production",
"principal_ref": "svc/01K7YP2C9W4X5E8H3J6M0N1Q2R",
"expires_at": "2027-01-31T00:00:00Z"
}'
# 3. Revoke it when it is no longer needed, or if it leaked.
curl -X POST "$CCSIO_CONSOLE_URL/identity/v1/api-keys/01K7YQ4D8M2P6S9V3X5Z7B1C4F/revoke" \
-H "Authorization: Bearer $CCSIO_API_KEY"In the console only, for now
- Billing: the subscription and prepaid credits.
- MCP servers: installing them from the library and their credentials.
- Personal API keys: they are created by a signed-in person for themself.
- Registering a new organization.