Lifecycle

Tenants.

Tenant records, Keycloak organizations, signup policy, and the standard authorization pack.

Active tenants:

Soft-deleted tenants

Read-only · restore is not available

Idempotent wizard

Create tenant.

Name

Slug

Domain auto-join

Exact verified email domains, comma-separated. Leave blank to disable domain auto-join.

Tenant admin email

Recommended. Existing users are reused; new users sign in through Google.

Open self-signupAllow anyone landing on this subdomain to join.

1
Validate input
Ready.
2
Keycloak organization
Alias, name, and verified domains.
3
Tenant record
Global createTenant mutation.
4
Standard permission pack
ADMIN + VIEWER roles and grants.
5
Admin designation
Optional KC-first user provisioning and ADMIN assignment.
6
Verify
Organization · tenant · role · member · subdomain.

Tenant detail

Tenant.