Three-Tier Account Hierarchy
Applies to: Organization (top-level user), Subuser Updated: 2026-07-02
The new console organizes accounts into three tiers: "Platform - Organization - User". Once you understand this article, you'll know which tier you're on, who you can manage, who manages you, and how money and permissions flow between the tiers.
1. What the Three Tiers Are
| Tier | Name | One-line positioning | Can log into console | Can call models |
|---|---|---|---|---|
| Tier 1 | Platform (CloudRouter official operations) | Handles overall operations and configuration; organizations don't need to worry about it | — | — |
| Tier 2 | Organization (top-level user) | Enterprise account, holds the balance pool, creates and manages the organization's users | Yes | Yes |
| Tier 3 | User / Subuser | The caller under the organization; holds a Key to call models | Yes (narrowed menu) | Yes |
The relationship in one sentence: The platform handles overall operations, the organization manages its own subusers, and subusers use Keys to call models.
From top to bottom:
- The Platform (CloudRouter official operations) handles overall operations and configuration, including topping up organizations and setting concurrency limits and available model scope.
- The Organization (top-level user) holds the balance pool, creates subusers, sets their quota limits, and assigns Keys.
- Subusers (callers) hold Keys to call models, and spending is deducted from the balance of their organization.
2. What Each Tier Can Do
2.1 Platform (CloudRouter Official Operations)
The platform handles overall operations and configuration; organizations don't need to worry about it. If you need the platform's help, contact CloudRouter.
2.2 Organization (Top-Level User)
The enterprise account, which logs into the front-end console and is the primary user of this handbook:
- Holds the organization balance pool, from which all subusers' spending is deducted
- Creates / edits / deactivates the organization's subusers and sets their business identity (account name, email, notes)
- Sets quota limits for subusers (capping their spending)
- Creates API Keys and configures access permissions as needed
- Views the models and calling methods available to the organization in the "Call Guide"
- Views organization-level and subuser-level usage and bills, and requests invoices
2.3 User / Subuser
The caller under the organization. After login, the menu narrows to 5 items (Dashboard, API Keys, Call Guide, Usage Records, Profile):
- Holds a Key to call models; spending counts against the organization's balance
- Views their own usage and bills
- Views the Call Guide and copies call information
- Subusers can self-serve create Keys (within the organization's authorized scope), and the organization can also create and distribute them on their behalf. See Subuser Management
3. Key Concepts
3.1 This Is a "Semantic Upgrade," Not a Rebuild
The new three-tier hierarchy is a semantic redefinition on top of the existing account structure:
- Legacy "tenant/user" accounts are promoted to "Organizations," with account and balance kept intact
- API Keys created by legacy accounts are defined as "Users"
- There is almost no data migration — you don't need to re-register or migrate your balance
So what you see is "the terminology and capabilities changed," not "the account is gone and must be rebuilt." For the full transition notes, see Migration & Transition Notes.
3.2 A User's Business Identity
The new version adds business identity information for each user (subuser), making it easier to identify "who is using it and what for":
| Field | Required | Description |
|---|---|---|
| Account name | Yes | Used to distinguish different subusers |
| Yes | For contact/identification | |
| Notes | No | Free text |
There is currently no uniqueness check on account names/emails within the same organization, so establish your own naming conventions to avoid confusion.
3.3 The Relationship Between Balance and Quota
- Organization balance pool: Money is topped up at the organization tier, the sole source of funds
- Subuser quota limit: A "spending cap" the organization sets for each subuser — it's an allocation, not money
- When a subuser makes a call, what's actually deducted is the organization balance; the quota limit only determines the most they can spend
- If a subuser has multiple Keys, those Keys share the same quota limit
For the full explanation of funds and quotas, see Balance Management & Quota Allocation.
4. Who Can See Which Menus
| Entry | Organization | Subuser |
|---|---|---|
| Dashboard | Yes | Yes |
| API Keys | Yes | Yes (only their own) |
| Call Guide | Yes | Yes |
| Subuser Management | Yes | No |
| Purchase / Redemption Code / My Orders | Yes | No |
| Usage Records | Yes | Yes (only their own) |
If a subuser manually types a URL to access an unauthorized page, they're automatically redirected back to the Dashboard. Menu visibility is as shown in the actual interface after login.
5. FAQ
Q: Am I an "Organization" or a "Subuser"? How do I tell? A: If you can see the "Subuser Management" and "Purchase" menus, you're an Organization (top-level user); if you only have 5 menus after login, you're a Subuser.
Q: Is an organization the same thing as the legacy "tenant"? A: Yes. The new version uniformly calls "tenant" an "Organization," and capabilities and balance are inherited smoothly. See Migration & Transition Notes.
Q: Can subusers log into the console? A: Yes, but the menu narrows to 5 items. They can only manage their own Keys and view their own usage — they cannot manage other users or use organization funds.
Q: Whose money is deducted for a subuser's spending? A: The organization's balance pool. A subuser's "quota limit" is only a spending cap, not a separate wallet.
Q: Can I change the organization-level concurrency and available model scope myself? A: No, both are configured centrally by the platform. To adjust them, contact CloudRouter. See Concurrency Settings and Region & Model Scope.
Contact Us
- Email: support_cloudrouter@clouditera.com
- QQ community: 712273971
- Platform URL: cloudrouter.online