Organization Hierarchy
Organize resources and control access through tenants, divisions, environments, and deployments
An organization owns your deployments, members, roles, and billing. APIs and some Settings or audit labels call it a tenant. These names refer to the same resource. A TENANT CREATED audit event means that an organization was created.
For a first deployment, use the division already created for your organization. A division groups projects or teams. An environment groups deployments, such as development and production. The starter flow creates an environment named sandbox when you do not select an existing one. You do not need a larger hierarchy to run one Free deployment.
Default Tenant and Default Division select preferred resources for your account. A default that is not set does not mean that the corresponding resource is absent.
Organization Plan and Deployment Tier
New organizations start with the Pro organization plan. It controls member, role, division, and environment allowances. The Free deployment tier controls the resources and cost of that deployment. A Pro badge on the organization is therefore compatible with a Free deployment and no saved card.
Settings also shows account limits. Tenants Limit is the number of organizations that the user can own. Memberships Limit is the number of organizations that the user can belong to. Neither value is a node count or the number of Free deployments available. Read Tiers & Storage for Free eligibility.
Hierarchy
| Level | Represents | Example |
|---|---|---|
| Organization (tenant in the API) | Your organization | Acme Corp |
| Division | Business unit or team | Platform Engineering |
| Environment | Deployment stage | Production, Staging, Development |
| Deployment | A LaserData deployment (one or more nodes) | prod-us-west-1 |
Tenant
A tenant represents an organization. It owns billing, membership, roles, permissions, and isolated audit logs. A user can belong to multiple tenants.
Division
A division groups environments for a business unit, team, or project. For example, separate Platform and Data Engineering into divisions. Permissions can apply to one division without granting access to the others.
Environment
An environment groups deployments within a division. Common uses include Development, Staging, and Production. Each environment contains one or more deployments, and permissions can apply to it individually.
Deployment
A deployment runs Apache Iggy on one or more nodes. Warden manages those nodes.
Resource Protection
Protection adds a code requirement before a tenant, division, environment, or deployment can be deleted. Enable it with protected: true in an update request, or during deployment creation.
To delete a protected resource:
- Request a resource code.
- Retrieve the time-based one-time code from the tenant's registered email address.
- Supply it as the
codequery parameter in the delete request.
Any member with the relevant manage permission can enable protection. Only the tenant owner can change protected: true back to false.
Use protection for production resources. Deletion is irreversible. Deleting a deployment destroys its nodes, data, streams, topics, messages, configuration, and telemetry. Delete contained deployments before deleting a division, environment, or tenant. Deleting a division also removes its environments. Deleting a tenant removes its divisions, environments, members, roles, and API keys.
Member Management
Manage tenant membership through these actions:
- Invite users by email. They join when they accept the invitation.
- Assign or change roles.
- Remove members to revoke their access immediately.
Programmatic Access
Use API keys for CI/CD, automation, and integrations. Their roles and permissions follow the same RBAC model as interactive users. RBAC is role-based access control.
Plan Limits
| Resource | Basic | Pro | Enterprise |
|---|---|---|---|
| Divisions | 2 | 5 | 10 |
| Environments (total) | 3 | 20 | 100 |
| Environments per division | 2 | 3 | 5 |
| Members | 10 | 100 | 1000 |
| Invitations | 10 | 100 | 1000 |
| Custom roles | 2 | 20 | 100 |
| API keys | 3 | 10 | 100 |
API Reference
Get Tenant
Retrieve tenant details, including plan features, subscription, and limits:
curl https://api.laserdata.cloud/tenants/{tenant_id} \
-H "ld-api-key: YOUR_API_KEY"{
"id": 1,
"name": "Acme Corp",
"protected": false,
"created_at": "2025-01-10T08:00:00Z",
"updated_at": "2025-06-15T12:30:00Z",
"description": "Main production tenant",
"email": "[email protected]",
"features": {
"invitations_limit": 100,
"members_limit": 100,
"roles_limit": 20,
"divisions_limit": 5,
"environments_limit": 20,
"deployment_tiers": [
{ "tier": "free", "limit": 1 },
{ "tier": "small", "limit": 3 },
{ "tier": "medium", "limit": 3 },
{ "tier": "large", "limit": 2 },
{ "tier": "xlarge", "limit": 1 },
{ "tier": "2xlarge", "limit": 1 }
],
"deployment_access_rules_limit": 10,
"deployment_configs_limit": 5,
"deployment_backups_limit": 3,
"deployment_snapshots_limit": 5,
"private_connections_limit": 3,
"private_endpoints_limit": 1,
"byoc_enabled": true,
"cluster_enabled": true,
"on_premise_enabled": false,
"private_networking_enabled": true,
"multi_az_enabled": true,
"dedicated_enabled": false,
"backup_enabled": true,
"cross_region_dr_enabled": false,
"audit_retention_days": 30,
"api_keys_limit": 10,
"cloud_accounts_limit": 5,
"notification_channels_limit": 5,
"notification_subscriptions_limit": 10,
"custom_domains_limit": 1,
"backup_regions_limit": 3,
"nodes_per_deployment_limit": 5,
"backup_retention_days": 30,
"snapshot_retention_days": 14,
"pending_invitations_limit": 100,
"api_key_allowed_ips_limit": 20,
"divisions_per_role_limit": 3,
"environments_per_division_limit": 3,
"concurrent_deployments_limit": 2,
"audit_export_enabled": true,
"advanced_connectors_enabled": true,
"customer_managed_keys_enabled": false,
"advanced_notification_channels_enabled": true
},
"subscription": {
"id": 1,
"plan": "pro",
"active": true,
"created_at": "2025-01-10T08:00:00Z",
"valid_from": "2025-01-10T08:00:00Z",
"valid_to": "2026-01-10T08:00:00Z"
},
"starter_available": true,
"has_payment_method": true
}features reports current limits and enabled capabilities. deployment_tiers lists the allowed tiers and their maximum deployment counts. cloud_accounts_limit limits cloud accounts across the tenant.
notification_channels_limit and notification_subscriptions_limit limit notification channels and subscriptions per channel. starter_available reports whether another Free tier deployment can be created. Enterprise features can be customized for a tenant.
Update Tenant
curl -X PUT https://api.laserdata.cloud/tenants/{tenant_id} \
-H "ld-api-key: YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"name": "Acme Corp",
"description": "Updated description",
"email": "[email protected]",
"protected": true
}'Include only the fields that you want to change. Set protected to true to enable resource protection. Only the owner can set it back to false. A successful request returns 204 No Content.
Get Tenant Structure
Retrieve divisions, environments, and deployments in one request:
curl https://api.laserdata.cloud/tenants/{tenant_id}/structure \
-H "ld-api-key: YOUR_API_KEY"{
"id": 1,
"name": "Acme Corp",
"divisions": [
{
"id": 1,
"name": "Platform Engineering",
"environments": [
{
"id": 1,
"name": "production",
"deployments": [
{
"id": 1,
"name": "prod-cluster",
"cloud": "aws",
"region": "us-west-1",
"variant": "managed",
"tier": "large",
"supervisor_url": "https://supervisor-aws-us.laserdata.cloud"
}
]
}
]
}
]
}Get Tenant Summary
curl https://api.laserdata.cloud/tenants/{tenant_id}/summary \
-H "ld-api-key: YOUR_API_KEY"{
"total_divisions": 2,
"total_environments": 5,
"total_deployments": 8
}Create a Division
curl -X POST https://api.laserdata.cloud/tenants/{tenant_id}/divisions \
-H "ld-api-key: YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"name": "Platform Engineering",
"description": "Core platform team",
"email": "[email protected]"
}'List Divisions
curl https://api.laserdata.cloud/tenants/{tenant_id}/divisions \
-H "ld-api-key: YOUR_API_KEY"{
"items": [
{
"id": 1,
"name": "Platform Engineering",
"created_at": "2025-01-15T10:30:00Z",
"updated_at": "2025-01-15T10:30:00Z"
}
],
"page": 1,
"total_results": 1,
"total_pages": 1
}Create an Environment
curl -X POST https://api.laserdata.cloud/tenants/{tenant_id}/divisions/{division_id}/environments \
-H "ld-api-key: YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"name": "production",
"description": "Production environment"
}'List Environments
curl https://api.laserdata.cloud/tenants/{tenant_id}/divisions/{division_id}/environments \
-H "ld-api-key: YOUR_API_KEY"{
"items": [
{
"id": 1,
"name": "production",
"created_at": "2025-01-15T10:30:00Z",
"updated_at": "2025-01-15T10:30:00Z"
}
],
"page": 1,
"total_results": 1,
"total_pages": 1
}Update a Division
curl -X PUT https://api.laserdata.cloud/tenants/{tenant_id}/divisions/{division_id} \
-H "ld-api-key: YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"name": "Platform Engineering",
"description": "Updated description",
"email": "[email protected]",
"protected": true
}'All fields are optional. Only the tenant owner can set protected back to false. A successful request returns 204 No Content.
Delete a Division
Delete every deployment in the division first. If the division is protected, request a resource code and supply it in the delete request:
curl -X DELETE "https://api.laserdata.cloud/tenants/{tenant_id}/divisions/{division_id}?code={protection_code}" \
-H "ld-api-key: YOUR_API_KEY"An unprotected division does not need code. Deletion permanently removes the division and all its environments. It cannot be undone.
Update an Environment
curl -X PUT https://api.laserdata.cloud/tenants/{tenant_id}/divisions/{division_id}/environments/{environment_id} \
-H "ld-api-key: YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"name": "production",
"description": "Updated description",
"protected": true
}'All fields are optional. Only the tenant owner can set protected back to false. A successful request returns 204 No Content.
Delete an Environment
Delete every deployment in the environment first. If the environment is protected, request a resource code and supply it in the delete request:
curl -X DELETE "https://api.laserdata.cloud/tenants/{tenant_id}/divisions/{division_id}/environments/{environment_id}?code={protection_code}" \
-H "ld-api-key: YOUR_API_KEY"An unprotected environment does not need code. Deletion is irreversible.
Delete a Tenant
Only the owner can delete a tenant. First delete all deployments and settle all billing. If the tenant is protected, request a resource code:
curl -X DELETE "https://api.laserdata.cloud/tenants/{tenant_id}?code={protection_code}" \
-H "ld-api-key: YOUR_API_KEY"An unprotected tenant does not need code. Deletion permanently destroys the tenant, divisions, environments, members, roles, API keys, and other tenant data. It cannot be undone.
Request Resource Code
Request a one-time code before deleting a protected resource. The platform sends it to the tenant's registered email address.
curl -X PUT https://api.laserdata.cloud/tenants/{tenant_id}/request_code \
-H "ld-api-key: YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"action": {
"action_type": "delete_tenant",
"payload": {
"tenant_id": 1
}
}
}'A successful request returns 204 No Content. The following action types select the resource:
| Action Type | Payload Fields |
|---|---|
delete_tenant | tenant_id |
delete_division | tenant_id, division_id |
delete_environment | tenant_id, division_id, environment_id |
delete_deployment | tenant_id, division_id, environment_id, deployment_id |
Requests are rate limited. Wait before requesting another code for the same resource.
Get Tenant Summary
Use the deployment API, {supervisor_url}, for an aggregate summary of deployment resources across the tenant:
curl {supervisor_url}/tenants/{tenant_id}/summary \
-H "ld-api-key: YOUR_API_KEY"{
"healthy_deployments": 5,
"unhealthy_deployments": 0,
"healthy_nodes": 8,
"unhealthy_nodes": 0,
"total_connectors": 3,
"total_streams": 12,
"total_topics": 24,
"total_partitions": 48,
"total_segments": 192,
"total_messages": 15000000,
"total_consumer_groups": 6,
"total_clients": 10
}Get Division Summary
Retrieve the same summary for one division:
curl {supervisor_url}/tenants/{tenant_id}/divisions/{division_id}/summary \
-H "ld-api-key: YOUR_API_KEY"The response uses the tenant summary format.