> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bytespike.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Admin operations runbook · ByteSpike admin

> A one-page operations guide for admins: grant employees model permissions, monitor usage, configure models, billing, emergency-response SOPs — every action has its exit point marked.

<Note>
  **When this applies**: you're an admin (owner / admin role) on a ByteSpike org, and you need to grant employees model access, monitor usage and balance, or handle abuse or model-availability incidents. This is the companion piece to [Employee onboarding](./employee-onboarding) — that one tells employees "how to use it", this one tells admins "how to run it".
</Note>

## 1. Three surfaces at a glance

ByteSpike currently lives on 2 domains + 1 sub-path:

| Domain / path              | Primary audience | When you (admin) use it                                                                      |
| -------------------------- | ---------------- | -------------------------------------------------------------------------------------------- |
| **llm.bytespike.ai/admin** | Platform backend | **Main entry point right now** — user management, available models, model groups, audit logs |
| **console.bytespike.ai**   | User-tier view   | View your own keys / usage / billing, enterprise dashboard, hand out keys to employees       |

<Note>
  Eventually `admin.bytespike.ai` will be split out as its own subdomain (cleanly separate from the user-facing console). Right now the admin backend still lives under the `llm.bytespike.ai/admin` path, sharing the hostname with the inference gateway. This document uniformly refers to `llm.bytespike.ai/admin` — once migration is done we'll update.
</Note>

<Tip>
  90% of day-to-day operations happen at `llm.bytespike.ai/admin`. The console is for seeing your own user-side view (top-up, calling the API, looking at your own row in the audit log).
</Tip>

## 2. Grant employees model permissions (core operations action)

When a new employee joins, **0 models are usable by default**. You need to grant them.

<Tabs>
  <Tab title="Path 1 · Bulk config (recommended)">
    Grant the same permissions to multiple employees at once — most common.

    <Steps>
      <Step title="Open admin → User management">
        llm.bytespike.ai/admin → left nav **User management / Users**
      </Step>

      <Step title="Multi-select employees">
        Tick the target employees (select all is fine) → top button **Bulk assign model groups**
      </Step>

      <Step title="Tick the 11 public groups">
        The dialog defaults to all 11 public model groups ticked. To limit (e.g. only Claude + GPT, no image), untick as needed.
      </Step>

      <Step title="Save">
        Hit save — the backend writes in bulk. Takes effect the **next time the employee launches DOSIA** or refreshes console (enterprise-managed-runtime picks up new permissions automatically).
      </Step>
    </Steps>
  </Tab>

  <Tab title="Path 2 · Single-employee grant">
    Use this when one employee needs a special permission combination.

    <Steps>
      <Step title="Admin → User management → click employee">
        In the Users list, click the employee's row → enter detail page.
      </Step>

      <Step title="Allowed Models tab">
        Switch to the **Allowed Models** tab.
      </Step>

      <Step title="Tick + save">
        Multi-select by model / capability → save.
      </Step>
    </Steps>
  </Tab>
</Tabs>

<Note>
  Public groups don't need to be written into the `user_allowed_groups` table — the backend uses `User.CanBindGroup(_, is_exclusive=false)=true` and waves them through. So even if the admin UI shows an employee's permissions as "unassigned", every public group is still callable. Exclusive groups are the ones that need explicit grant rows in the table.
</Note>

## 3. Usage monitoring + balance alerts

<Steps>
  <Step title="Daily usage dashboard">
    **llm.bytespike.ai/admin → Usage** → group by day / model / api\_key / user across multiple dimensions. CSV export available.
  </Step>

  <Step title="Overview (dashboard)">
    **llm.bytespike.ai/admin → Overview** → today's total usage, tier breakdown, active users, balance trend.
  </Step>

  <Step title="Low-balance alerts">
    **llm.bytespike.ai/admin → Settings → balance\_notify** → set a threshold (e.g. \$50) + recipient email. When the org wallet drops below the threshold, cron sends an email + writes a `system.balance.notify.dispatched` notification into the console notification center.

    Mechanism details at [/me/notifications](./api-reference/account/me-notifications).
  </Step>
</Steps>

## 4. Model permissions (platform layer)

Different from per-employee permissions — this governs "which models the ByteSpike platform itself can call".

<CardGroup cols={2}>
  <Card title="Model Groups" icon="layer-group">
    **llm.bytespike.ai/admin → Model Groups** — add models to a group, set multiplier (e.g. put a model in a 0.8x discount group), set the exclusive flag (whitelist-only access).
  </Card>

  <Card title="Available models registry" icon="boxes">
    **llm.bytespike.ai/admin → Available Models** — when a new model is added to the catalog, register it here + associate the model group.
  </Card>

  <Card title="API Keys (your own)" icon="key">
    **console.bytespike.ai/keys** — your own admin test keys. For production keys, employees generate them inside DOSIA, or admin batch-issues them at [console.bytespike.ai/org/keys](https://console.bytespike.ai).
  </Card>

  <Card title="Audit log" icon="scroll">
    **llm.bytespike.ai/admin → Audit log** — 25+ action types covering every write operation across admin / org / user layers. Each entry carries actor + IP + UA.
  </Card>
</CardGroup>

## 5. Top-up and billing

<Steps>
  <Step title="Top up the org wallet">
    **console.bytespike.ai/billing** → pick Stripe (visa / mastercard / amex) or Alipay → enter amount → done. The webhook receives `system.payment.received` and balance lands instantly.
  </Step>

  <Step title="Auto-recharge policy (optional)">
    On the billing page, **Auto-recharge** section — set a trigger threshold (e.g. balance below $50) + an auto-charge amount per trigger (e.g. $200). Charges happen automatically via the Stripe saved payment method.
  </Step>

  <Step title="Billing history / export">
    **console.bytespike.ai/billing → Transactions** → complete ledger (topup / refund / admin\_credit / admin\_debit / subscription\_renew). Each row has CSV export, meets finance-team requirements.

    API endpoint at [/me/billing/transactions](./api-reference/account/me-billing-transactions).
  </Step>
</Steps>

## 6. Emergency response SOP

The full operations troubleshooting (balance crash / model-availability incidents / employee abuse / mistaken revocation + handling employee feedback) lives in [troubleshooting](./troubleshooting) · Admin view tab. That page also collects every employee blocker from [Employee onboarding](./employee-onboarding), organized by role + scenario in AccordionGroups.

## What's next

* Want to distribute a new dmg to employees? See [Employee onboarding](./employee-onboarding).
* Want to know how to call user-tier APIs? See [API Reference · Account](./api-reference/account/me-account).
* Want the full model catalog + pricing? See [bytespike.ai/pricing](https://bytespike.ai/pricing).

For operations questions or corner cases that need OP intervention: ping the ops team / W1.