MSP guide¶

On the MSP plan, your company becomes the home organization of a tenant, and each client company is a separate managed organization under it. Managed organizations are real organizations: their own logins, their own API keys, their own automations and runs, fully isolated from each other.

The mental model in one line: workspaces segment your own work; managed organizations segment your clients.

Managing clients in the app¶

Clients in the sidebar lists your managed organizations and lets you create more.
Open a client (click its name) for its management page: value summary, API keys, members, and report links, all without switching in. You can mint a new API key for the client right there.
Switch into a client to work inside their organization (the banner shows whose data you are looking at); exit to return to your own.
Branding sets your white-label: brand name, brand color, and logo. Client-facing surfaces, including their login page and shared value reports, carry your brand instead of LumaTrack's.

Offboarding a client¶

Every client management page has two offboarding tools:

Export data downloads a complete JSON bundle of that client's ledger: the organization, every automation, and every run (with status, timestamps, and duration). It is the clean handoff when a client leaves or wants their data, and a point-in-time backup before you make a big change.
Suspend freezes a client without deleting anything: its API keys stop ingesting (they go dark, not revoked) and its own members are locked out of the app. Your access as the provider is unaffected, so you can still export. Reactivate restores everything, including the original keys, with no re-minting. Suspend is the lever for a non-paying or departing client while you settle the account; delete only after you have exported.

Managing clients over the API¶

With an API key from your MSP home organization:

curl -s "$LUMATRACK_URL/api/v1/msp/clients" \
  -H "Authorization: Bearer $LUMATRACK_KEY"

curl -s -X POST "$LUMATRACK_URL/api/v1/msp/clients" \
  -H "Authorization: Bearer $LUMATRACK_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name": "Acme Dental"}'

Both return 403 if the key's organization is not an MSP home.

Read one client's value summary, optionally windowed to a period for a quarterly rollup:

# this quarter's delivered value for one client
curl -s "$LUMATRACK_URL/api/v1/msp/clients/42/summary?since=2026-04-01&until=2026-06-30" \
  -H "Authorization: Bearer $LUMATRACK_KEY"

since and until (ISO dates) window the run-derived figures; omit them for all-time. Loop over GET /api/v1/msp/clients to roll up your whole book.

One key per client¶

API keys are organization-scoped, and that is the isolation guarantee: a key minted in client A's organization cannot touch client B. So the onboarding recipe for each new client is:

POST /api/v1/msp/clients to create the managed organization.
POST /api/v1/msp/clients/{id}/api-keys to mint that client's key (returned once, ingest-only by default), or switch into the client in the app and create one there.
Use that key in the client's automation stack (their n8n, their Ansible, their scripts).

The whole recipe is scriptable, so onboarding a book of 30 clients is a loop, not an afternoon of clicking.

Resist the temptation to funnel every client's runs through one key; you would be pooling their data into one organization and breaking the boundary your contracts promise.

Client-facing value reports¶

Inside each client organization, create report links (POST /api/v1/report-links): unguessable, no-login, print-ready value report URLs, white-labeled with your branding. They are built for the QBR: send the link or print it to PDF, and revoke it the moment it should stop working. The same numbers back the in-app dashboard the client sees when they log in themselves.

Custom domains¶

White-label branding applies today on your LumaTrack host. Serving clients from your own domain (app.yourmsp.com) is architected and on the roadmap; it requires DNS and TLS provisioning at deploy time. Ask us about timing if this is a blocker for you.