Manages Arize users, organizations, spaces, projects, roles, role bindings, resource restrictions, and API keys via the ax CLI. Use for enterprise admin workflows: inviting and offboarding users, onboarding new teams, creating custom roles for SAML/SSO mappings, assigning roles to users, restricting project-level access, and managing service keys for multi-tenant architectures. Covers ax users, ax organizations, ax spaces, ax projects, ax roles, ax role-bindings, and ax api-keys.
Arize Admin is an operations skill for managing enterprise access control in the Arize AI observability platform through the `ax` command-line tool. It covers the full lifecycle of identity and permission resources — users, organizations, spaces, projects, roles, role bindings, resource restrictions, and API keys — so an agent can carry out common administrative tasks such as inviting or offboarding users, onboarding new teams, and provisioning scoped service keys. The problem it solves is turning multi-step, error-prone console clicking into repeatable, confirmable command sequences that fit multi-tenant and SSO-driven environments.
The skill emphasizes structured workflows: it instructs the agent to collect all required inputs up front (via AskUserQuestion), fetch live data like the org list before asking the user to pick, and only then run commands. It documents concrete recipes for onboarding a team (create space, custom role, assign members, generate a service key), offboarding a user, restricting a project to explicitly bound users, creating custom roles for SAML/SSO attribute mapping, and rotating or revoking API keys. Safety is built in: destructive commands (delete, revoke, remove-user, unrestrict) require an explicit summary and user confirmation before running with `--force`, and credentials are always referenced via the `ARIZE_API_KEY` environment variable rather than pasted or echoed, with a recommendation to use scoped service keys.
Target users are Arize org-admins and account-admins, platform teams, and anyone managing access for multiple Arize spaces or business units. It is best suited to enterprise access-control tasks that require org-admin privileges and a configured `ax` profile.
The `ax` CLI at version 0.27.0 or newer and a configured Arize profile with org-admin or account-admin privileges. Most operations require admin-level permissions; commands that return 403 Forbidden indicate the profile lacks them.
Any delete, revoke, remove-user, or unrestrict command must first be summarized (stating exactly what will happen and what cascades), then explicitly confirmed by the user. Only after confirmation is the command run with --force to skip the interactive prompt.
The skill never asks the user to paste a raw key into chat and never logs or echoes key values. Keys are always referenced through the ARIZE_API_KEY environment variable, and it recommends scoped service keys over personal user keys for programmatic use.
There is no delete subcommand for API keys. To remove one you use `ax api-keys revoke` (immediate invalidation) or `refresh` for zero-downtime rotation with the same scope.
Region is set per-profile (e.g. us-east-1b, eu-west-1a, ca-central-1a) and controls API/Flight routing. There is no profile field for space; every command that needs one takes it per-invocation via -s/--space, accepting a space name or base64 space ID.
Quick Setup:
.claude/skills/Repository
arize-ai/arize-skills