> ## Documentation Index
> Fetch the complete documentation index at: https://docs.domesystems.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Platform

> Platform status, API keys, configuration, and tenant management

Check platform status, create and revoke API keys, discover grantable permissions, read configuration, and list, inspect, and create tenants in your organization. These tools require an active context. `dome_status_get`, `dome_config_get`, and `dome_platform_keys_available_permissions` are visible to any role; the API key tools require `apikey.manage` at the active scope; and the tenant tools (`dome_tenants_list`, `dome_tenants_get`, `dome_tenants_create`) require the org-level `tenant.manage` permission.

## Status Get

`dome_status_get`

Get platform status and statistics for the current workspace.

| Parameter | Type | Required | Description   |
| --------- | ---- | -------- | ------------- |
| —         | —    | —        | No parameters |

**Permission:** Authenticated only — visible to any caller with an active context, regardless of role.

Returns workspace statistics including agent counts by status, active rule bundle info, and gateway backend count.

```json title="Example tool call" theme={"system"}
{
  "name": "dome_status_get"
}
```

## Platform API Keys

Platform API keys authenticate service-to-service integrations with the Dome Platform API.

### Platform Keys List

`dome_platform_keys_list`

List platform API keys.

| Parameter | Type | Required | Description   |
| --------- | ---- | -------- | ------------- |
| —         | —    | —        | No parameters |

**Permission:** `apikey.manage`

Returns key metadata (name, created date, last used, status) but not the key secret.

### Platform Keys Available Permissions

`dome_platform_keys_available_permissions`

List the permissions you can grant to a new platform API key at the current context's scope. Read-only. Call this before `dome_platform_keys_create` to discover the valid `permissions` values for your role.

| Parameter | Type | Required | Description   |
| --------- | ---- | -------- | ------------- |
| —         | —    | —        | No parameters |

**Permission:** Authenticated only — the server filters the returned set against the caller's effective role.

Returns an array of `{ id, label }` entries. The `id` is the value to pass to `dome_platform_keys_create`; the `label` is a human-readable name for display. The set is scope-aware: a workspace context returns workspace permissions only, a tenant context adds tenant permissions, and an org context adds org permissions.

```json title="Example tool call" theme={"system"}
{
  "name": "dome_platform_keys_available_permissions"
}
```

### Platform Keys Create

`dome_platform_keys_create`

Create a new platform API key for programmatic access. The key is scoped to the current context level (workspace, tenant, or org). The secret is returned once. Call `dome_platform_keys_available_permissions` first to discover valid permission strings for your role.

| Parameter     | Type   | Required | Description                                                                                                                            |
| ------------- | ------ | -------- | -------------------------------------------------------------------------------------------------------------------------------------- |
| `name`        | string | Yes      | Key name                                                                                                                               |
| `permissions` | array  | No       | Permissions to grant (e.g., `agent.register`, `audit.view`). Use `dome_platform_keys_available_permissions` to enumerate valid values. |
| `expires_at`  | string | No       | Expiration time (RFC3339)                                                                                                              |

**Permission:** `apikey.manage`

<Tip>
  Call `dome_platform_keys_available_permissions` first to discover valid permission strings for your role at the current scope.
</Tip>

```json title="Example tool call" theme={"system"}
{
  "name": "dome_platform_keys_create",
  "arguments": {
    "name": "ci-pipeline",
    "permissions": ["agent.view", "audit.view"]
  }
}
```

<Info>
  Store the returned key secret securely. It cannot be retrieved after creation — only revoked.
</Info>

### Platform Keys Revoke

`dome_platform_keys_revoke`

Revoke a platform API key permanently.

| Parameter | Type   | Required | Description      |
| --------- | ------ | -------- | ---------------- |
| `key_id`  | string | Yes      | Key ID to revoke |

**Permission:** `apikey.manage`

<Warning>
  Revocation is immediate. Any integrations using this key lose access immediately.
</Warning>

## Config Get

`dome_config_get`

Get a configuration value from the platform.

| Parameter | Type   | Required | Description       |
| --------- | ------ | -------- | ----------------- |
| `key`     | string | Yes      | Configuration key |

**Permission:** Authenticated only — visible to any caller with an active context, regardless of role.

## Tenants

Tools for listing, inspecting, and creating tenants in your active organization. The org is sourced from the active context — switch contexts first if you need to target a different org. All three tools return "No active org context" if the caller has not selected an org context; run `dome_context_use` to switch.

### Tenants List

`dome_tenants_list`

List tenants under your active organization.

| Parameter | Type | Required | Description   |
| --------- | ---- | -------- | ------------- |
| —         | —    | —        | No parameters |

**Permission:** Org-level `tenant.manage` (held by org `owner` or `admin`).

Returns the array of tenants visible to the caller, including id, name, plan, org id, default gateway, and creation timestamp.

```json title="Example tool call" theme={"system"}
{
  "name": "dome_tenants_list"
}
```

### Tenants Get

`dome_tenants_get`

Get a single tenant by id from your active organization. The caller is admitted if either the active context is scoped to the requested tenant, or the caller holds org `admin` or `owner` on the active org.

| Parameter   | Type   | Required | Description |
| ----------- | ------ | -------- | ----------- |
| `tenant_id` | string | Yes      | Tenant UUID |

**Permission:** Tenant-scoped session for the requested tenant **or** org-level `tenant.manage` on the active org. The MCP tool listing surfaces this tool when org `tenant.manage` is held; tenant-scoped callers can still invoke the underlying RPC directly via the API.

```json title="Example tool call" theme={"system"}
{
  "name": "dome_tenants_get",
  "arguments": {
    "tenant_id": "5b1e…"
  }
}
```

### Tenants Create

`dome_tenants_create`

Create a new tenant under your active organization. The caller becomes the initial tenant admin.

| Parameter | Type   | Required | Description                                                             |
| --------- | ------ | -------- | ----------------------------------------------------------------------- |
| `name`    | string | Yes      | Tenant display name                                                     |
| `plan`    | string | No       | Tenant plan: `essential` (default), `managed`, `enterprise`, `complete` |

**Permission:** Org-level `tenant.manage` (held by org `owner` or `admin`).

<Note>
  Creating a new organization is operator-only. Contact Dome to provision a new org.
</Note>

```json title="Example tool call" theme={"system"}
{
  "name": "dome_tenants_create",
  "arguments": {
    "name": "acme-prod",
    "plan": "managed"
  }
}
```

If no active org context is set, the tool returns `No active org context. Use dome_context_use first.`

## Next steps

Members, keys, and workspace defaults have how-tos under Manage:

* [Manage Access](/manage/access)
* [Configure Platform](/manage/settings)
* [Permissions](/concepts/platform/permissions) concept