> ## Documentation Index > Fetch the complete documentation index at: https://cadenya.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Get a tenant by ID > One tenant, by canonical ID or by the external_id you asserted it under. Fetch a single tenant. The `id` accepts the canonical `tenant_…` form or `external_id:`, the key your own system knows the customer by. Since assertions create tenants keyed on `external_id`, the second form is usually the one you have. ```typescript TypeScript theme={null} const tenant = await client.tenants.retrieve('external_id:acme-corp', { workspaceId, includeInfo: true, }); console.log(tenant.metadata.name, tenant.state, tenant.info?.subjectCount); // Acme Corp STATE_ACTIVE 12 ``` ```go Go theme={null} tenant, err := client.Tenants.Get(ctx, "external_id:acme-corp", cadenya.TenantGetParams{ WorkspaceID: cadenya.String(workspaceID), IncludeInfo: cadenya.Bool(true), }) if err != nil { panic(err.Error()) } fmt.Println(tenant.Metadata.Name, tenant.State, tenant.Info.SubjectCount) ``` ```ruby Ruby theme={null} tenant = cadenya.tenants.retrieve( "external_id:acme-corp", workspace_id: workspace_id, include_info: true ) puts "#{tenant.metadata.name} #{tenant.state} #{tenant.info&.subject_count}" ``` ```bash cURL theme={null} curl "https://api.cadenya.com/v1/workspaces/${WORKSPACE_ID}/tenants/external_id:acme-corp?includeInfo=true" \ -H "Authorization: Bearer ${CADENYA_API_KEY}" ``` ## Two states `state` is `STATE_ACTIVE` for a living tenant and `STATE_ERASING` for one mid-[erasure](/docs/api-reference/tenantservice/erase-a-tenant). An erasing tenant is on its way out: once the background work finishes, this endpoint returns `NotFound`. Polling here is how you follow an erasure to completion. ## The record reads back your assertions A tenant has no `spec`. `metadata.name` is the most recent name you asserted, `metadata.external_id` is the key you asserted it under, and `metadata.updated_at` tells you when the tenant was last asserted. `includeInfo=true` adds the `subjectCount`, `objectiveCount`, and `widgetSessionCount` counts, at the cost of a query each. ## Related The workspace-wide census, with filters. Who has acted under this tenant. The destructor, and what STATE\_ERASING means. How the `external_id:` form works across the API. ## OpenAPI ````yaml get /v1/workspaces/{workspaceId}/tenants/{id} openapi: 3.1.0 info: title: Cadenya API description: API for the Cadenya Agent Runtime platform. version: '1.0' servers: - url: https://api.cadenya.com description: Production server security: - bearerAuth: [] tags: - name: AIProviderKeyService - name: APIKeyService description: |- Issue, rotate, disable, and revoke a workspace's API keys. Every key belongs to exactly one workspace; the system-managed global account key is managed via GlobalAPIKeyService instead. - name: AccountService description: >- Manage the authenticated account. Accounts are the top-level organizational unit and contain one or more workspaces. - name: AgentScheduleService description: >- Manage recurring schedules attached to agents. Schedules trigger objectives on a cadence defined by AgentScheduleSpec.Schedule. - name: AgentService description: >- Manage AI agents within a workspace. Agents define AI behavior and tool access. - name: AgentVariationService description: >- Manage variations of an agent and their tool, sub-agent, and memory layer assignments. - name: GlobalAPIKeyService description: |- Manage the account's system-provisioned global API key. The global key is the only key that spans every workspace; it is created by the system and cannot be deleted, so the surface is retrieve, rotate, and the disable/enable kill switch. - name: MemoryService description: >- Manage memory layers and their entries. Layers are named containers that can be composed into an objective's memory cascade; entries are the keyed values within a layer. System-managed layers (e.g., episodic layers created by the runtime) cannot be mutated through this API. - name: ModelService description: |- Manage LLM models available to a workspace. Models represent provider and family pairs (e.g., "anthropic/claude-sonnet-4.6"). Workspaces are seeded with the supported models and you can enable or disable each one. - name: ObjectiveEventStreamsService - name: ObjectiveService - name: ProfilesService description: |- Operations on profiles, the account-level principals (users, API keys, system) that authenticate against the API. - name: SearchService - name: TenantService description: >- Read and erase tenants and the subjects under them. Tenants and subjects are created by assertion — on objective creation or widget session mint — never directly, so this service has no create or update: it exists to enumerate what assertions have produced, and to destroy it on request. - name: ToolService description: >- Manage tool sets and the tools they contain. Tool sets group related tools, and tools define specific capabilities available to agents. When a tool set is managed, only API key actors can modify its tools; human (profile) actors cannot. - name: UploadService description: |- Issue short-lived presigned URLs for direct client-to-object-storage uploads. Created uploads can be referenced by id when creating or updating resources that accept binary content (e.g., MemoryEntry). - name: WidgetService description: |- Manage embeddable chat widgets. A widget binds an agent to a globally unique hostname with a per-widget origin allowlist; browsers reach it with session tokens minted via WidgetSessionService. - name: WidgetSessionService description: >- Mint and manage widget sessions. Session creation is server-to-server only: the customer's backend authenticates its visitor, asserts tenant/subject context, attaches any per-visitor secrets, and receives a short-lived bearer token the browser uses against the widget host. - name: WorkspaceAdminService description: >- Administer workspaces across the account: create and archive workspaces and manage their membership. These operations are account-scoped and require the admin role (a token whose profile holds the WorkOS admin role); they live under /v1/account/workspaces rather than the workspace-scoped /v1/workspaces tree so an admin can manage any workspace in the account, including ones they are not themselves a member of. - name: WorkspaceSecretService - name: WorkspaceService description: |- Manage workspaces within an account. Workspaces provide organizational grouping and isolation for resources such as agents, tools, and API keys. This is the workspace-scoped, end-user surface. Administrative operations (create / archive workspaces, manage members) live in WorkspaceAdminService under /v1/account/workspaces and require the admin role. paths: /v1/workspaces/{workspaceId}/tenants/{id}: get: tags: - TenantService - Tenants summary: Get a tenant by ID description: >- Retrieves a tenant by its canonical id or by the `external_id:` form the customer asserted it under. operationId: TenantService_GetTenant parameters: - name: workspaceId in: path description: Workspace ID. required: true schema: type: string example: workspace_01HXKD2E5NQM3T9AYWCF133E3Q - name: id in: path description: |- Tenant ID. Accepts the canonical `tenant_…` form or the `external_id:` form. required: true schema: type: string - name: includeInfo in: query description: When true, the `info` field is populated. schema: type: boolean responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/Tenant' default: description: Default error response content: application/json: schema: $ref: '#/components/schemas/Status' x-codeSamples: - lang: JavaScript source: |- import Cadenya from '@cadenya/cadenya'; const client = new Cadenya({ apiKey: process.env['CADENYA_API_KEY'], // This is the default and can be omitted }); const tenant = await client.tenants.retrieve('id', { workspaceId: 'workspace_01HXKD2E5NQM3T9AYWCF133E3Q', }); console.log(tenant.metadata); - lang: Python source: |- import os from cadenya import Cadenya client = Cadenya( api_key=os.environ.get("CADENYA_API_KEY"), # This is the default and can be omitted ) tenant = client.tenants.retrieve( id="id", workspace_id="workspace_01HXKD2E5NQM3T9AYWCF133E3Q", ) print(tenant.metadata) - lang: Go source: "package main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\t\"go.cadenya.com/cadenya-go\"\n\t\"go.cadenya.com/cadenya-go/option\"\n)\n\nfunc main() {\n\tclient := cadenya.NewClient(\n\t\toption.WithAPIKey(\"My API Key\"),\n\t)\n\ttenant, err := client.Tenants.Get(\n\t\tcontext.TODO(),\n\t\t\"id\",\n\t\tcadenya.TenantGetParams{\n\t\t\tWorkspaceID: cadenya.String(\"workspace_01HXKD2E5NQM3T9AYWCF133E3Q\"),\n\t\t},\n\t)\n\tif err != nil {\n\t\tpanic(err.Error())\n\t}\n\tfmt.Printf(\"%+v\\n\", tenant.Metadata)\n}\n" - lang: Ruby source: >- require "cadenya" cadenya = Cadenya::Client.new(api_key: "My API Key") tenant = cadenya.tenants.retrieve("id", workspace_id: "workspace_01HXKD2E5NQM3T9AYWCF133E3Q") puts(tenant) - lang: CLI source: |- cadenya tenants retrieve \ --api-key 'My API Key' \ --workspace-id workspace_01HXKD2E5NQM3T9AYWCF133E3Q \ --id id components: schemas: Tenant: required: - metadata - state type: object properties: metadata: $ref: '#/components/schemas/ResourceMetadata' info: $ref: '#/components/schemas/TenantInfo' state: readOnly: true enum: - STATE_UNSPECIFIED - STATE_ACTIVE - STATE_ERASING type: string description: The current lifecycle state of the tenant. Output only. format: enum description: >- Tenant is the customer's organization as a readable record rather than an echo. It carries no spec: a tenant is never configured, only asserted, so everything about it lives in the metadata envelope — `external_id` is the key the customer asserted it under, `name` is the most recent name they asserted, and `updated_at` is therefore when the tenant was last asserted. Status: type: object properties: code: type: integer description: >- The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code]. format: int32 message: type: string description: >- A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client. details: type: array items: $ref: '#/components/schemas/GoogleProtobufAny' description: >- A list of messages that carry the error details. There is a common set of message types for APIs to use. description: >- The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). ResourceMetadata: required: - id - accountId - workspaceId - name - profileId - createdAt type: object properties: id: readOnly: true type: string description: >- Unique identifier for the resource (prefixed ULID, e.g., "agent_01HXK...") accountId: readOnly: true example: account_01HXKD2E5NQM3T9AYWCFTJHJVF type: string description: >- Account this resource belongs to for multi-tenant isolation (prefixed ULID) workspaceId: readOnly: true example: workspace_01HXKD2E5NQM3T9AYWCF133E3Q type: string description: >- Workspace this resource belongs to for organizational grouping (prefixed ULID) name: type: string description: >- Human-readable name for the resource (e.g., "Customer Support Agent", "Email Tool") Required for resources that users interact with directly externalId: type: string description: >- External ID for the resource (e.g., a workflow ID from an external system) labels: type: object additionalProperties: type: string description: |- Key-value pairs for categorization and filtering. Values are 0-63 alphanumeric characters with "-", "_", or "." allowed between; keys follow the same shape and additionally accept an optional DNS-subdomain prefix (e.g. "cadenya.com/") of at most 253 characters. Examples: {"environment": "production", "team": "platform", "version": "v2"} profileId: readOnly: true example: profile_01HXKD2E5NQM3T9AYWCFS0AP08 type: string description: ID of the actor (user or service account) that created this resource createdAt: readOnly: true type: string description: Timestamp when this resource was created format: date-time updatedAt: readOnly: true type: string description: Timestamp when this resource was last updated format: date-time description: >- Standard metadata for persistent, named resources (e.g., agents, tools, prompts) TenantInfo: type: object properties: subjectCount: readOnly: true type: integer description: Number of subjects asserted under this tenant. format: int32 objectiveCount: readOnly: true type: integer description: >- Number of objectives associated with this tenant, across every surface — widget conversations and objectives created directly against the API alike. This is the footprint a delete would destroy, which is why it is worth the count query that populating `info` costs. format: int32 widgetSessionCount: readOnly: true type: integer description: Number of widget sessions minted for this tenant that still exist. format: int32 description: TenantInfo provides read-only server-derived data about a tenant. GoogleProtobufAny: type: object properties: '@type': type: string description: The type of the serialized message. additionalProperties: true description: >- Contains an arbitrary serialized message along with a @type that describes the type of the serialized message. securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT ````