How partner and operator roles work

Availability

These role-gated surfaces depend on the active backend deployment and account provisioning. The frontend exposes the workflows described here, but production backend reachability was not independently verified in this documentation pass. Treat the signed-in Partner page and its role responses as the live source of truth.

Partner onboarding

The Partner page adapts to the signed-in user's role. Affiliate enrollment is self-service. Reseller access uses an application and operator approval workflow. These account workflows are separate from data-plane API authentication.

Affiliate workspace

Affiliates can create and share referral codes and see uses, referred accounts, lifetime earned credit, spendable earned credit, and expiring credit lots. Rewards are account credit in the current product; there is no cash-withdrawal interface.

Reseller workspace

Approved reseller administrators receive a tenant-scoped console for:

• Customer provisioning and release.
• Versioned price books and markup controls.
• Accrued retail, cost, margin, and low-wholesale-balance analytics.
• Display-only branding and verified custom domains.
• Signed HTTPS webhooks for selected customer, usage, wallet, and payment events.
• Wholesale wallet top-up and balance monitoring.
• Visibility into platform abuse limits without permission to weaken enforcement.

Accrued retail or margin is not the same as collected cash. Reconciliation and settlement views must preserve that distinction.

White-label hosts

A verified custom Host can resolve a reseller's public name, logo, colors, support identity, and copy. Branding is display-only: it must not change authentication, protocol headers, routing semantics, metering, or security policy.

Operator workspace

Platform operators have role-gated control-plane views for organizations, users, teams, keys, traces and replay, usage, latency, provider health and pricing, local OpenAI-compatible providers, policies, guardrails, alerts, billing profiles, audit logs, reconciliation, reseller oversight, and applications.

Some operator actions are live and consequential. Trace replay can be billable; alert tests send real notifications; provider pricing and routing controls affect future requests. Use the UI confirmation and audit trail rather than calling internal browser routes directly.

Private API boundary

Reseller and operator browser endpoints are internal, role-scoped BFF routes. They are intentionally excluded from the public API reference and from llms.txt. A future partner API should publish its own versioned schemas and authorization contract.