Core concepts: orgs, workspaces, domains, and scopes
P6M is organized around a few objects that appear in almost every API request.
Org
An Org is the main ownership boundary. Users, service accounts, API keys, billing accounts, usage, audit events, support tickets, and exports belong to an Org.
Use one Org for a company, customer account, or top-level product owner.
Workspace
A Workspace is an operating area inside an Org. Common patterns are:
- production
- staging
- one workspace per customer tenant
- one workspace per internal app
- one workspace per environment or region
Most customer app data should be scoped to a workspace.
Domain
A Domain is a reusable backend capability. Examples include:
- identity
- metadata
- notifications
- support
- knowledge
Enabling a domain creates a domain installation. Customer API calls include the domain installation ID so P6M can route, meter, authorize, and isolate the request.
User, service account, and API key
Human users sign in through the portal or through customer app flows. Service accounts are non-human users used by automation. API keys represent a user or service account and inherit scopes from role grants.
Scopes
Scopes are strings such as knowledge_documents:* or metadata:read. A request succeeds only when the actor has the required scope for the target Org or Workspace.