# Org administration > For the complete documentation index, see [llms.txt](https://developers.thoughtspot.com/docs/llms.txt) Source: https://developers.thoughtspot.com/docs/orgs-api-op # Org administration To administer and manage Orgs, you can use the [UI workflows](https://docs.thoughtspot.com/cloud/latest/orgs-overview) or REST API endpoints. This article describes the REST API operations available for Org provisioning and management. > **IMPORTANT:** The REST API v1 endpoints are deprecated and replaced with the REST API v2 endpoints. Your existing integrations with REST API v1 endpoints will continue to function without disruption until further notice. ThoughtSpot strongly recommends migrating your integrations to the REST API v2 endpoints. ## Get started with Orgs 1. Configure your ThoughtSpot instance as a multi-tenant cluster. If the Orgs feature is enabled on your cluster, a Primary Org is created by default, and you will be logged in to the Primary Org context. If you do not see the Orgs feature enabled on your instance, contact ThoughtSpot Support. 2. Log in to your application instance as an administrator. 3. Create Orgs in the **Admin** page of the UI or via [REST API]({{navprefix}}/{{org-api}}#createOrg). To create and manage Orgs, you must set the Org context to `All`. To do this, you can switch to the **All Orgs** tab in the Admin page of UI or pass the Org scope `ALL` in your API requests to Orgs API endpoints. For more information, see [Org API]({{navprefix}}/{{org-api}}). 4. Create users and map the users to Orgs. You can create an administrator profile for each Org and let these Org administrators manage users, groups, and role privileges in their respective Orgs. Note that ThoughtSpot allows provisioning groups only within the context of an Org. You must ensure that ThoughtSpot users are mapped to appropriate Orgs and the groups within these Orgs for user access control and data security. ## Org management operations To create an Org on a multi-tenant ThoughtSpot instance, you need cluster administrator privileges. By default, ThoughtSpot sets the administrator of the `Primary Org` as a cluster administrator. Only cluster administrators are allowed to perform CRUD operations on Org objects. ### REST API v2.0 endpoints For Orgs CRUD operations, you can also use the following REST API v2.0 Org endpoints: - [`/api/rest/2.0/orgs/create`]({{previewPrefix}}/api/rest/playgroundV2_0?apiResourceId=http/api-endpoints/orgs/create-org) - [`/api/rest/2.0/orgs/search`]({{previewPrefix}}/api/rest/playgroundV2_0?apiResourceId=http/api-endpoints/orgs/search-orgs) - [`/api/rest/2.0/orgs/{org_identifier}/update`]({{previewPrefix}}/api/rest/playgroundV2_0?apiResourceId=http/api-endpoints/orgs/update-org) - [`/api/rest/2.0/orgs/{org_identifier}/delete`]({{previewPrefix}}/api/rest/playgroundV2_0?apiResourceId=http/api-endpoints/tags/delete-tag) ## Manage users and groups On a multi-tenant instance, the cluster and Org administrators can create users and associate these users to Orgs and groups within these Orgs. The cluster administrator can perform CRUD operations on Org objects at the All Orgs level and assign users, whereas the Org administrator can create users and groups within the context of their Org workspace. > **NOTE:** The /tspublic/v1/session/orgs REST API v1 endpoint allows administrators to switch between Org contexts. For REST API v2 operations, the Org context is determined based on the authentication token used by the user in their API requests. Users must log in to the appropriate Org context from which they want to send API requests. | Operation type | REST API v1 endpoints | REST API v2 endpoints | | --- | --- | --- | | Authentication | **Basic authentication** To log in to a specific Org context with basic authentication, specify the Org ID in the [`/tspublic/v1/session/login`]({{navprefix}}/{{session-api}}#session-login) API request. **Token-based authentication** For [trusted authentication]({{navprefix}}/{{trusted-authentication}}), use the [`/tspublic/v1/session/auth/token`]({{navprefix}}/{{session-api}}#session-authToken) API endpoint. If a user is mapped to a specific org, you can pass the `orgid` in the API request to obtain an authentication token to log in the user to the relevant Org context. You can also create a user just-in-time and assign Orgs, groups, and privileges in this API call. For more information, see [REST API v1 authentication]({{navprefix}}/{{api-auth-session}}). | **Basic authentication** To log in to a specific Org context with basic authentication, specify the Org ID in the [`/api/rest/2.0/auth/session/login`]({{previewPrefix}}/api/rest/playgroundV2_0?apiResourceId=http/api-endpoints/authentication/login) API request. **Token-based authentication** Use the following API endpoints: - [`/api/rest/2.0/auth/token/object`]({{previewPrefix}}/api/rest/playgroundV2_0?apiResourceId=http/api-endpoints/authentication/get-object-access-token) - [`/api/rest/2.0/auth/token/full`]({{previewPrefix}}/api/rest/playgroundV2_0?apiResourceId=http/api-endpoints/authentication/get-full-access-token) These above endpoints also support just-in-time provisioning of users to Orgs and groups. For more information, see [REST API v2 authentication]({{navprefix}}/{{authentication}}). | | User provisioning | To create users, use the [`POST /tspublic/v1/user/`]({{navprefix}}/{{user-api}}#create-user) API endpoint. This endpoint also allows assigning a user to Orgs. To add multiple users to an Org in bulk, use the [`/tspublic/v1/user/addtoorg`]({{navprefix}}/{{user-api}}#addOrg) API endpoint. To remove a user from an Org, use the [`DELETE /tspublic/v1/user/{userid}`]({{navprefix}}/{{user-api}}#delete-user) endpoint. If a user belongs only to the Org specified in the `DELETE` request, the user will be deleted from the Org and ThoughtSpot system. If the user belongs to more than one Org, the `DELETE` operation removes the user from only the Org specified in the API request. To remove the user from the ThoughtSpot system and all Orgs, you must set the `orgid` to `-1` in your API request. | To create users and assign users to one or several Orgs, use the [`/api/rest/2.0/users/create`]({{previewPrefix}}/api/rest/playgroundV2_0?apiResourceId=http/api-endpoints/users/create-user) API endpoint. To assign an existing user to new Orgs or remove a user from an Org, use the [`/api/rest/2.0/users/{user_identifier}/update`]({{previewPrefix}}/api/rest/playgroundV2_0?apiResourceId=http/api-endpoints/users/update-user) API endpoint. | | Group provisioning | To create a group in an Org, log in to the Org context or [switch to the Org context]({{navprefix}}/{{session-api}}#orgSwitch) and send an API request to the [`/tspublic/v1/group/`]({{navprefix}}/{{group-api}}#create-group) endpoint. | To create a group in an Org, use the [`/api/rest/2.0/groups/create`]({{previewPrefix}}/api/rest/playgroundV2_0?apiResourceId=http/api-endpoints/groups/create-user-group) API endpoint. | | Fetching Orgs | - To get a list of Orgs for the currently logged-in user, use the [/tspublic/v1/session/orgs]({{navprefix}}/{{session-api}}#getOrgs) API endpoint. - To get Orgs for a specific user, use the [/tspublic/v1/session/orgs/users/{userid}]({{navprefix}}/{{session-api}}#getOrgsForUser) endpoint. Set the Org scope to `ALL` to get all Orgs for a given user. | The REST API v2 endpoints allow you to perform query operations to get Org details: - To get a list of all Orgs on the cluster, use [`/api/rest/2.0/orgs/search`]({{previewPrefix}}/api/rest/playgroundV2_0?apiResourceId=http/api-endpoints/orgs/search-orgs) (Requires cluster administrator privileges) - To get Org details for a user, use [`/api/rest/2.0/users/search`](<{{previewPrefix}}/api/rest/playgroundV2_0?apiResourceId=http/api-endpoints/users/search-users target=>) - To get Org details for a group, use [`/api/rest/2.0/groups/search`](<{{previewPrefix}}/api/rest/playgroundV2_0?apiResourceId=http/api-endpoints/users/search-users target=>) |