Organization and billing

Team and roles

/dashboard/team lists the organization's members and pending invitations. Members are sorted owner → admin → member.

An owner or admin can invite a colleague by email as an admin or a member — ownership is transferred, never invited, so it is not offered in the invite dialog. A pending invitation can be revoked, and its accept link copied. Members and invitations are loaded in one window of up to 200 rows with no pagination.

Changing a member's role is constrained: you cannot change your own, an invitation's, or promote to owner without an explicit "Move ownership" confirmation, which only an owner can perform. Removing yourself reads Leave and returns you to Overview. A member whose role includes owner cannot be removed from this screen at all — the action is not rendered, so ownership has to be moved first; the API's own last-owner protection is surfaced as an inline error when the server refuses.

Custom roles

/dashboard/team/roles assigns roles and, for owners, defines them. It first lists the members with an Assign roles control, then the role catalog. The built-in roles are shown read-only with their permission sets (or "Every permission"). A custom role has a name that cannot be owner, admin or member (lowercase letters, digits, - and _), an optional description, a set of permissions grouped by domain and action — at least one is required — and an optional, comma-separated limit to specific collections: a role limited to collections can only write to those. Deleting a role moves its holders back to member.

Usage

/dashboard/usage reports the current period, headed by the plan name, the reset date and, when the API is suspended, a destructive API paused badge. It opens with the service status and threshold notices at 50%, 80% and 100% of the request quota, plus a forecast when the current rate will exhaust the quota before it resets. The window switches between 7, 30 and 90 days.

Meter cards cover API requests used and remaining, records (documents across all collections), the credit balance, and the projected period total with the estimated days to exhaustion. A stacked chart breaks usage down into search, indexing, AI and other, with CSV export (disabled while the series is empty; the file is named usage-<first-date>.csv); lists with progress bars break usage down further by operation type and by credit-burning feature. The footer links to the upgrade screen, a credit top-up and invoices. While loading, each card is a skeleton; a failed load shows a "Could not load usage" alert, and empty periods read "No request data yet." and "No credit spend in this window."

Plans, usage and billing

Three plans exist. Prices are held in the billing provider and shown at checkout; the console lists what each plan includes:

The request quota is checked on every /v1 request before it reaches the engine proxy, and the API answers 429 once the period's limit is used. Credits pay for AI operations — assistant turns, voice, image and semantic search, embeddings, synonym suggestions — and are granted when a subscription first activates (or when a free organization's wallet is opened).

/dashboard/billing/upgrade compares the plans feature by feature, with monthly and yearly tabs, and upgrades or downgrades through the billing provider. The current plan is marked with a ring on its card and a Current badge in the comparison; the Free card's button is disabled ("Current plan", or "Cancel the subscription to return here"). The button already knows whether the move is an upgrade or a downgrade, and requires an owner or admin. A note reads "Prices are shown at checkout. Unsure which plan fits? Write to support from the Support screen."

Wallet and credits

/dashboard/billing shows the credit balance and a paginated ledger. Each entry is a top-up, a usage charge or an adjustment, with the reference and the balance after it. Topping up offers two providers: Stripe (card, USD, $1–5,000) and Robokassa (RUB, ₽100–500,000), each with preset amounts and a custom amount, an estimated "≈ N credits", and a return to the console with a status that is shown inline (?topup=…, and ?plan=… for a plan checkout). The API fixes the exact credit amount at checkout.

The screen cross-links to Usage — a header button and a "Looking for request meters?" card — carries an inline Invoices section with the latest five and a View all link, and has a Service status card:

• Pause API / Resume API — an owner-only switch that suspends the organization; every request with its keys then answers 402, and nothing is deleted.
• A quota-exhausted state (429 until the period resets) with an upgrade link.
• An empty-wallet state: AI operations answer 402 while search keeps working.

Subscription state

Notices on the billing screen (and, more compactly, on every other dashboard screen) cover the three states that need attention:

• Trial — how many days are left, with an action to add a payment method.
• Past due — payment failed; the plan keeps working while the provider retries, and updating the card restores it.
• Canceled — the organization is back on the free tier (search, synonyms, stopwords) and can resubscribe.

/dashboard/billing/payment-failed is the dedicated dunning screen: it explains that the provider has stopped retrying, that every request answers 402, that nothing has been deleted, and links to update the card and to the unpaid invoices. Unpaid invoices are listed with their number, issue date and outstanding amount and link to the invoice detail; settling one resumes the API. When there is no payment problem the screen says "No payment issue right now", and its footer links to all invoices and to Support.

Invoices and payment methods

/dashboard/billing/invoices lists the most recent invoices (up to the API's cap of 100) with number, date, status and amount due — plus an "X outstanding" figure for open, partly paid invoices — and links to the hosted invoice and the PDF when the provider has published them. An invoice detail shows the status, issue date, billing period, View on Stripe and Download PDF actions (disabled when none exists), and the line items with their period and quantity, subtotal, tax (when non-zero), total and any outstanding amount. The detail is re-checked against the organization, so an invoice id from another organization is not found.

Payment methods (cards) live on the billing screen: brand, last four digits, default and expired badges, with add/manage opening the provider's billing portal. Only owners and admins can change them.

Settings

/dashboard/settings is the organization's own configuration, with tabs for General, API keys, Security, SSO, SCIM and Danger zone.

General

Name, slug and logo URL, with a preview of the logo (falling back to the organization's initials when the URL is broken or blank) beside the name and slug. The slug must match ^[a-z0-9]+(?:-[a-z0-9]+)*$ and its availability is checked when you save, not as you type; the console distinguishes "already taken" from "could not verify". Unsaved changes are guarded. Only owners and admins can save.

API keys

/dashboard/settings/api-keys mints and revokes the keys that authenticate the tenant API. The screen is for owners and admins only — a member sees a "Not authorized" state rather than the key list.

• Scope — search (safe to ship in a browser: search, recommendations, events and visitor-facing AI) or full (server-side only, every operation). See API keys, scopes and credits.
• Expiry — an optional date, applied at the end of the chosen day so "expires today" does not mean "already expired".
• Restrictions — per key: the collections it may touch, a forced filter (a document ACL, ANDed into every search), the fields it may name, allowed IP addresses or CIDR ranges, allowed origins, and a per-minute rate limit on top of the organization's quota.
• The table lists the label, key prefix, scope, a restrictions summary, creation and expiry dates and the last use (with its IP). Each row's menu edits Restrictions, Rotates the key (the new secret replaces the old one immediately and is shown once) or Revokes it after a confirmation. Rows can be selected for a Revoke selected bulk action.
• The full secret is shown once, at creation or rotation; afterwards only the prefix is kept. Revoked keys move to a separate audit table (label, key, scope, revoked date) with no actions.

Security

Three organization-wide settings, writable by owners:

• A console IP allowlist (one address or CIDR per line; blank means anywhere; your current address must be included).
• A maximum session age in hours (blank means no limit).
• Audit log retention in days (blank keeps entries forever; older entries are pruned nightly).

A session age or retention that is not a whole number of at least 1 is rejected. The tab opens with a Single sign-on & SCIM section that only links to the SSO and SCIM tabs — those controls live there, not here.

SSO

/dashboard/settings/sso reports which sign-in providers the deployment has as four badges — OIDC · <providerId> (or off), Google on/off, GitHub on/off and Password · on. OIDC, Google and GitHub are configured per deployment with API environment variables rather than per organization, and a SAML provider is bridged through OIDC. When OIDC is enabled the tab shows the callback URL to register with the identity provider (Okta, Entra ID, Auth0, Keycloak and similar); otherwise it says none is configured on this deployment. An owner can require SSO, which refuses password sign-in for every member — the switch is disabled while no provider is configured and the setting is off. Adding a provider means contacting support; the same goes for deployment-level email-domain membership mapping.

SCIM

/dashboard/settings/scim provisions members from an identity provider over SCIM 2.0, at {API_URL}/scim/v2 (shown in a copyable card with hints for Okta, Entra ID and OneLogin). Owners create named bearer tokens (the token is shown once) and can revoke them; revoking stops synchronization immediately. A table lists each token's prefix, creation, and last use — a revoked token stays listed with its revocation date. A recent-activity panel lists the last 20 provisioning operations from the audit log. There is no "last full sync" figure — last use is the closest real signal.

Danger zone

/dashboard/settings/danger has two organization-level actions:

• Export organization data — a JSON download containing members, API key metadata (not secrets), webhooks, connectors, hosting, billing and audit history. Available to owners and admins.
• Delete organization — requires typing the organization's name and is available to the owner only; afterwards the console clears the active organization and returns to Overview. There is no transfer action here; ownership is transferred from the Team screen's role picker.

Audit log

/dashboard/admin/audit-log lists the organization's recent activity — the most recent 200 entries, 25 per page. Each row shows when (with an exact timestamp on hover), the action, who did it, the target, and a details viewer for the metadata. Unknown actors show the raw id and a note that they are no longer a member; system changes show "system".

Entries can be filtered by text over the action, target and actor, and by a Destructive toggle that catches delete, remove, revoke, disable, pause, suspend, rollback, drop and purge actions (with a count). The header shows the entry count and an "N of M" figure, / focuses the filter with a keyboard hint and Esc clears it, and an unmatched filter offers Clear filters with a "Nothing matches" state. A header button opens Admin resources. Any member can read the log.

Profile

Your own account lives under the avatar menu.

• General (/dashboard/profile) — full name and profile image URL (there is no upload; clearing it returns to initials). Email is read-only here, and an unverified account gets a Resend verification email action.
• Security (/dashboard/profile/security) — change the password (minimum 15 characters, with inline mismatch and length validation) with an option to sign out of every other device, and a list of active sessions showing the operating system and browser, plus the IP address for sessions other than the current one. Terminating another session asks for confirmation; the current session's action is Sign out, which returns you to the sign-in page. A Two-factor authentication section lets you turn on an authenticator app yourself: enter your password, scan the QR code, confirm a code, then save the one-time backup codes; disabling asks for your password again. It is self-service, with no organization-wide enforcement.
• Danger (/dashboard/profile/danger) — delete your own account, confirmed with your password. An owner who is the sole owner of an organization cannot be deleted until ownership is transferred.

Legacy routes

/dashboard/wallet, /dashboard/quota, /dashboard/api-keys and /dashboard/assistant are kept as redirects to Billing, Usage, API keys and the Chat playground respectively, so older links keep working.

Next

• Platform operations
• API keys, scopes and credits