Administer LlamaCloud programmatically

What this covers

The admin SDK exposes 30 methods across 21 endpoints, in two tiers.

Organization administration

Organization and project CRUD, membership, role assignment, per-user project access, invites, and organization usage. Intended for customer admins automating tenant provisioning.

Operator surface

The admin.* methods — license, file stores, LLM and OCR status, aggregate usage metrics, and user claims. LlamaIndex staff and BYOC operators only. Not customer-supported API.

Install

Nothing here is published to a package registry. Every target installs from its public GitHub repository.

TypeScript

npm install git+https://github.com/run-llama/llamacloud-admin-typescript.git

Python

pip install git+https://github.com/run-llama/llamacloud-admin-python.git

Go

go get github.com/run-llama/llamacloud-admin-go

Java

git clone https://github.com/run-llama/llamacloud-admin-java.git
cd llamacloud-admin-java && ./gradlew build

Authenticate

Every client reads a bearer API key from LLAMA_CLOUD_API_KEY and defaults to https://api.cloud.llamaindex.ai.

An API key inherits its owner's privileges

There is no separate “admin key” scope. A key issued to an organization admin is an organization-administration credential, and a key belonging to a LlamaIndex staff account will also satisfy the global-admin checks on the admin.* methods. Scope the account, not the key.

Before you call organizations.delete

Organization deletion is disabled in production by default

The method exists in all four clients, but the API refuses it with 403 — “Organization deletion is disabled. Contact support@runllama.ai” whenever the deployment is production, EU production, or BYOC, or when organization deletion is not explicitly enabled. BYOC is an active deny, not a skip.

The only bypass is the per-user allow_org_deletion claim, which defaults to false and is granted through admin.users.update_claims — an operator method.

Deletion cascades to the organization’s projects. Its plan-configuration and permission cleanup steps log and continue on failure, so a partial cleanup still removes the organization.

Not in this SDK

API keys

Excluded deliberately. The surface is mid-flight from v1 to v2, and an admin cannot mint another user’s personal key, so publishing it would not satisfy the underlying request.

Quota management

Deferred. Reaching it requires a BYOC-mode spec build, which the payment settings correctly refuse to combine with a production deployment mode.

Coupons, refunds, investigation

Never publishable. These share the /admin/* prefix but are commercial and cross-tenant staff tooling — the investigation surface enumerates every organization, project, and membership.

User query, disable, delete

Hidden at the route level by their authors, alongside the configuration dump and splitter-skill invalidation. Out of scope.