Platform Administration

Platform Admin is a per-user flag (User.isPlatformAdmin), not an organization role — it exists specifically because operating the platform itself requires visibility across every organization, which no organization-scoped role should have.

What Platform Admins can do

• List every organization and its member count
• List every user across the platform
• View a cross-organization audit log (last 200 entries)
• Change any organization's subscription plan
• Activate, renew, and revoke licenses
• Read organization usage records
• Manage feature flags and their per-organization overrides
• Read/write global and per-tenant configuration

Feature flags

Feature rollout is real, not a config-file toggle: flags support global enable/disable, per-organization overrides, and a deterministic percentage rollout (a SHA-256 hash of organization ID + flag ID, mod 100 — so a given organization always evaluates the same way, not randomly per request).

curl https://api.monsphere.com/api/v1/organizations/:orgId/feature-flags-evaluate?key=kubernetes-monitoring \
  -H "X-Api-Key: msph_live_..."

Audit logs

Every configuration change and sign-in writes an audit log entry — who did it, what it touched, when, and from where. Entries are append-only: no API changes or deletes one, and an entry that can't reach the history store right away is first written to a database table that rejects any UPDATE/DELETE, then copied over, so a short outage never loses one.

Audit log retention

How long audit logs are kept is one platform-wide setting on Platform Admin → Audit Logs → Retention — the same for every organization, not tied to its plan. The default is 180 days; anything from 30 days to 10 years can be set. A shorter period hides older entries immediately; a longer one keeps every entry that hasn't expired yet for the new period. The change itself is recorded in the audit log.