Teams

Teams group organization members for ownership, attribution, and shared governance. Budgets, rate limit policies, and MCP access can use the team identity to control traffic from team-bound caller API keys. See How AISIX Enterprise Composes for how teams fit alongside organization roles and caller API keys.

Team membership and caller API key binding serve different purposes. The roster identifies who belongs to the team. Traffic counts toward team controls only when the caller API key used for the request is explicitly bound to that team.

Create a Team

1. Open Teams and select New team.
2. Enter a Display name and an optional Description.
3. Select Create team.

The team appears with its member count and Team ID. Select the team name or Manage to open its detail page.

Copy the Team ID when another guide requires TEAM_ID. The same UUID appears at the end of the team detail page URL.

export TEAM_ID="YOUR_TEAM_ID"

Add and Manage Members

Team members come from the organization member pool. Create or invite the member before adding them to a team.

1. Open the team detail page.
2. Under Members, select Add member.
3. Select the Org member and assign the team role Member or Lead.
4. Select Add member.

The Member and Lead labels belong to the team roster. They do not replace the member's organization role. When a team has one lead, promote another member before demoting or removing the only lead.

Use the role selector on a member row to change their team role. Select the remove action to remove the member from the team without removing their organization membership.

Bind Caller API Keys to the Team

Team membership alone does not attribute traffic to the team. Bind each caller API key that should use team budgets, rate limits, or MCP access:

1. Open the environment and select API keys.
2. Create a key with New API key, or edit an existing key.
3. Select the team in Team.
4. Optionally select an Owner. After choosing a team, the owner list contains only members of that team.
5. Create the key or save the changes.

The API key row shows its team binding. A member's personal key does not count toward a team merely because that member appears on the roster.

Configure Team Controls

The team detail page provides Team budget (shared), Per-member budget, and MCP entitlement controls. Related guides cover the complete behavior:

• Budgets explains shared team budgets and separate allowances for each member in a team.
• Rate Limit Policies shows how to match a team and divide its quota into per-member buckets.
• MCP Access Policies configures the MCP tools reachable by team-bound keys.

This page walks through the dashboard, but the AISIX Enterprise Admin API Reference also documents full team lifecycle and membership management — GET/POST /teams, GET/PATCH/DELETE /teams/{team_id}, GET/POST /teams/{team_id}/members, and entitlements — for automating team administration outside the dashboard.

Sync Teams from an Identity Provider

SCIM directory sync represents an identity provider group as a team with the same name. Group membership changes update the team roster automatically. Manage the roster of a directory-synced team in the identity provider so later synchronization does not overwrite dashboard changes.

Directory-synced teams can use the same caller API key bindings, budgets, rate limit policies, and MCP entitlements as teams created in the dashboard.

Edit or Delete a Team

Open the team detail page and select Edit to change its display name or description. Select Delete to remove the team and its roster. The people on that roster remain organization members.

Walkthrough: Issue a Team-Scoped, Budget-Capped Key

Use this sequence when a team needs a caller API key that is scoped to specific model aliases and capped by a shared budget.

1. Confirm the team and its roster. Make sure the team exists and carries the right members. See Create a Team and Add and Manage Members above.
2. Confirm or create the model alias(es) the team should use. A caller API key's allowlist can only grant aliases that already exist. See Create a Direct Model if the team needs a new one.
3. Create a caller API key bound to the team, with those aliases as its allowlist. Follow Create a Caller API Key to issue the key and Control Model Access to set its allowlist to the alias(es) from step 2. Set the key's Team field as described in Bind Caller API Keys to the Team above.
4. Cap spend with a budget. Create a budget scoped to the team, or to this caller API key specifically, by following Create a Budget.
5. Optional: set alert thresholds. Configure an early warning before a blocking budget starts rejecting traffic. See Configure Alert Thresholds.
6. Verify. Send one request per allowed alias with the new key — each should succeed — and one request naming a model alias outside the allowlist, which should be rejected. See Verify Access. Then confirm spend appears against the expected team or key scope in Verify Budget Enforcement.

Next Steps

Continue with Caller API Keys to create team-bound credentials. Then configure Budgets, Rate Limit Policies, or MCP Access Policies for the team.