Platform Admin

Platform Administration

How the three-tier hierarchy works — SuperAdmin, Platform, and Tenant — and who does what.

The AI Interview System is organized into three layers. Understanding this hierarchy is essential before provisioning any platform or tenant.

Layer	Who	Manages	Login
SuperAdmin	Teamcast internal staff	Platforms, system-wide metrics, LLM monitoring, SuperAdmin accounts	/super-admin/login
Platform Admin	Integration partner ops team (e.g. LinkedIn)	Their own tenants, platform users, platform API keys	/login → Platform Admin tab
Tenant Admin	Customer recruiter or HR admin (e.g. Acme Corp)	Interviews, users, workflow approvals, API keys for their workspace	/login → Tenant Admin tab

Hierarchy

Every data record in the system is scoped to a Tenant. A Platform groups one or more Tenants under a single partner. A SuperAdmin owns all Platforms.

SuperAdmin (Teamcast)
  └── Platform  (LinkedIn, SAP SuccessFactors, Workday, …)
        ├── PlatformUser          (platform admin accounts)
        ├── ApiKey                (platform-scoped keys — include X-Tenant-ID per request)
        ├── PlatformWebhookConfig (one endpoint for ALL tenants under this platform)
        └── Tenant                (Acme Corp, Globex, Initech, …)
              ├── User            (recruiters, admins)
              ├── ApiKey          (tenant-scoped keys — no X-Tenant-ID needed)
              └── TenantWebhookConfig (optional tenant-specific override)

API Key Scope

There are two kinds of API keys and they work differently:

Key Type	Issued By	X-Tenant-ID Required	Typical Use
Platform key	SuperAdmin or Platform Admin	Yes — must send X-Tenant-ID on every request	Partner backend calling the Integration API on behalf of many tenants
Tenant key	Tenant Admin (via /admin/api-keys)	No — tenant is inferred from the key	Tenant's own ATS or automation scripts calling the Integration API

Both key types support the same Integration API endpoints. The difference is only in how the tenant context is resolved. Platform keys are more flexible but require the caller to pass X-Tenant-ID correctly on every request.

Guides

Platform Setup

Create a platform, issue API keys, and configure the first tenant — step by step for SuperAdmins.

Tenant Provisioning

Provision tenants under a platform, manage tenant admin users, and configure webhooks.

Tenant API Integration

Connect your ATS or HR system to the Integration API using platform or tenant API keys.

REST Endpoints

Full endpoint reference for interview creation, approval, assessment, and data purge.

What Each Role Can Access

Zone	Login as	Can do
Platform Admin zone	PlatformUser	Manage tenants, platform users, platform API keys, view platform stats
Tenant Admin zone	Tenant User (ADMIN)	Manage interviews, users, approvals, workflow, API keys, webhooks
Tenant Recruiter zone	Tenant User (RECRUITER)	Create and manage interviews, approvals, view rankings
Tenant User zone	Tenant User (USER)	View interviews only

Platform Admins do not have access to interview features by default — those belong to the Tenant zone. If a platform wants to use interview features for their own internal hiring (e.g. LinkedIn using it for their own HR team), they should create a Tenant for themselves under their own Platform and log in as a Tenant User for that workspace.

Platform Using Interviews for Internal Hiring

A common pattern is a platform that is both an integration partner and a customer. For example, LinkedIn operates the LinkedIn Platform but their internal HR team also runs interviews through the system. The correct setup is:

Platform:  LinkedIn (linkedin.com)
  ├── PlatformUser: ops@linkedin.com       ← manages tenants, API keys
  └── Tenant:      LinkedIn Internal HR
        └── User:  recruiter@linkedin.com  ← runs interviews, approvals

Need	Login as	Lands in
Manage tenants / API keys / platform stats	Platform Admin	/platform-admin dashboard
Create and manage interviews	Tenant User under own tenant	/admin dashboard

If the same email exists in both a PlatformUser account and a Tenant User account, the login page will show an account picker so the user can choose which role to sign in with for that session.

Provisioning Sequence

Step	Who	Action
1	SuperAdmin	Bootstrap first SuperAdmin account (one-time)
2	SuperAdmin	Create a Platform (name + domain)
3	SuperAdmin	Issue Platform API key with required permissions
4	SuperAdmin or Platform Admin	Configure platform webhook endpoint and subscribed events (covers all tenants)
5	SuperAdmin or Platform Admin	Create Tenant under the Platform
6	SuperAdmin or Platform Admin	Create Tenant admin user
7	Tenant Admin (optional)	Configure tenant-specific webhook override (only if different from platform endpoint)
8	Tenant Admin or platform backend	Issue Tenant API key (optional, if not using platform key)
9	Partner backend	Send first interview request via Integration API

Was this page helpful?

Previous← Data Validation

NextPlatform Setup →