Workspaces, projects, single sign-on and SCIM

What a workspace is

Plans

Inviting people

Link lifetime

14 days. Resend makes a new link, which restarts the 14 days and stops the old one working.

Email did not arrive

Ask them to check spam, or use Copy link on the People tab and send the link yourself.

Seats

An invitation for an editor holds a seat until it is accepted or withdrawn.

Leaving and removing

A member can leave from the People tab. The owner can remove anyone except themselves. Either way, the person leaves every project and their project keys are revoked.

One workspace per account

Someone who owns a workspace, or is in one, has to leave it before accepting an invitation to another.

Roles

Owner

One per workspace: the person whose plan it is. Invites and removes people, shares provider keys with every project, sets team alerts, manages webhooks and security, reads the audit trail, and manages every project without being added to it. Uses a seat.

Editor

Uses a seat and gets the workspace’s plan on their own account. Can change the team watchlist and create projects (and manages the ones they create).

Viewer

Free: no seat, and no plan from the workspace. Reads the team watchlist and the projects they are added to, and gets their alerts — the role for clients and stakeholders. Sees the owner and the people they share a project with, not everyone in the workspace.

Manager

Runs the project: its people, routing rules, provider keys, budget and caps, alert settings and webhooks; can rename or delete it. Needs an editor seat.

Member (editor)

Holds their own project keys and edits the project watchlist. Reads the rules, budget, report and activity.

Member (viewer)

Reads everything above and gets the project’s alerts. Holds no keys.

Team watchlist

Projects

One per client or product. Created by the owner or an editor from the workspace page; whoever creates it manages it.

People

Who works on it, as managers or members. Only the people in a project (and the owner) can open it.

Watchlist

The models this project depends on, with its own alert threshold and recipients.

Smart Router

Project keys, the routing rules every key follows, and which provider keys pay. See below.

Budget

A monthly budget for the project and a monthly cap per person. See below.

Overview

What the project spent, who spent it, on which models, how reliably and how efficiently.

Activity

Who changed what, and every request its keys made.

Settings

Name and description, who sees per-person spend, the project’s own webhooks, deletion.

Project keys and routing rules

A project key is a Smart Router key that follows the project’s rules and counts against its budget.

curl https://aistupidlevel.info/v1/chat/completions \
  -H "Authorization: Bearer aism_…" \
  -H "Content-Type: application/json" \
  -d '{"model": "auto", "messages": [{"role": "user", "content": "Hello"}]}'

Strategy

What “auto” means: best overall, best for coding, reasoning or tool use, best value, most consistent, fastest good model, cheapest, fastest, matched to each request, or your own weighted traffic split.

Use it for every routed request

Requests asking for auto-coding, auto-cheapest and so on get the project’s strategy too.

Naming a model

Allowed or not. When not, requests that name a model — and /v1/messages, which always does — are refused, and everything is routed.

Allowed models

Only these models, routed or named. Empty means any model we benchmark.

Providers not used

Never route to, or accept requests for, these providers.

Price and speed limits

Leave out models above a price per 1,000 tokens or slower than a measured latency.

Tool calling

Only models that support it.

Fallback

Try other models when one fails, optionally in an order you choose.

Drifting models

Pass over models with an open drift alert (they are tried after the others).

Output per request

A cap on output tokens for every request. Reasoning models count their thinking in it, so a low cap can leave them no room to answer.

Rate limit

Requests per minute, per key.

Prompt logging

Each key’s own setting, off for every key, or on for every key (encrypted, with secrets scrubbed first).

Budgets and caps

Monthly budget

For the whole project, in dollars, from the 1st of each month (UTC).

Alert only

Requests continue past the budget.

Switch to the cheapest models

Past the budget, routed requests go to the cheapest models and requests that name a model are refused, so work continues at the lowest cost.

Stop at the budget

A request that could take the month past the budget is refused with HTTP 429 and the reason, until the 1st or until the budget is raised.

Thresholds

The owner and the project’s managers are emailed when spend reaches each threshold you choose (25–90%) and 100%, once per month for each — raising the budget re-arms them.

Caps per person

A monthly cap for everyone in the project, with a different one per person if needed. A person at their cap is refused, whatever the budget mode, and is emailed along with the managers.

Reports and activity

Alerts

One email per finding

A model on your own watchlist, the team watchlist and a project gets you one email, naming every list it is on.

Who is emailed

Team list: everyone in the workspace, the owner and editors, or nobody. Project list: everyone in the project, its managers and the owner, or nobody. Your own alert settings still apply: if you turned alert emails off, team lists do not override that.

Muting

Anyone can mute the team list or a project’s list for themselves, on its page.

Weekly summary

The Monday summary covers your own watchlist, the team’s and your projects’, grouped by list.

Activity

Each alert is recorded in the project’s activity log (or the workspace trail, for the team list).

Webhooks

Teams and Enterprise. Alerts and budget notices as signed JSON, so they reach your own tooling without anyone reading an email.

model.regression

A watched model alerted. data: modelId, model, currentScore, deltaOver7d, openTaskRegressions, measuredAt, reason, and lists — every list carrying the model ({"type":"team"}, {"type":"project"} with its id and name, or {"type":"member"} for a member's own watchlist, never naming them). Sent once per finding per endpoint.

budget.threshold

A project crossed one of its budget thresholds this month.

budget.exceeded

A project reached its budget, or a request was refused at it.

member.cap_warning

Someone used 80% of their monthly cap in a project.

member.cap_reached

Someone reached their cap; their requests in the project are refused.

Budget payload

{ "project": {id, name}, "workspace": {id, name}, "month", "spendUsd", "limitUsd", "threshold", "budgetMode", "refused", "member"? }

Headers

X-ASL-Event, X-ASL-Timestamp (Unix seconds), X-ASL-Signature

Signature

sha256= plus the hex HMAC-SHA256 of the timestamp, a full stop and the raw body, keyed with the endpoint's secret.

Delivery

One attempt with a five-second timeout and no retries; the last result is shown next to each endpoint. Up to 20 endpoints per workspace and 5 per project, HTTPS only, never to private or loopback addresses.

const crypto = require('crypto');

// rawBody: the request body exactly as received, before JSON parsing.
function isFromAiStupidLevel(headers, rawBody, secret) {
  const ts = String(headers['x-asl-timestamp'] || '');      // Unix seconds
  const sig = String(headers['x-asl-signature'] || '');
  const expected = 'sha256=' +
    crypto.createHmac('sha256', secret).update(ts + '.' + rawBody).digest('hex');
  const fresh = Math.abs(Date.now() / 1000 - Number(ts)) < 300;   // reject replays
  return fresh && sig.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected));
}

Single sign-on

Teams and Enterprise, set up by the workspace owner. Works with any OIDC or SAML 2.0 identity provider.

Okta

An OIDC web app. The issuer is your authorization server, for example https://acme.okta.com/oauth2/default.

Microsoft Entra ID

Register an app with a Web redirect URI and add a client secret. The issuer is https://login.microsoftonline.com/<tenant-id>/v2.0. Add the optional email claim to the ID token (Token configuration).

Google Workspace

An OAuth client of type Web application in Google Cloud. The issuer is https://accounts.google.com.

Signing in

People whose email is in your domain sign in through your identity provider; password and Google/GitHub sign-ins are refused for them. The owner keeps password sign-in, so a broken provider cannot lock out the one person who can fix it.

New people

With “Create accounts on first sign-in” on, someone without an account gets one at first sign-in and joins with the role you chose. With it off, only existing accounts can sign in.

Existing accounts

An account with the same email is used as it is, and joins the workspace at its first SSO sign-in.

Domain already claimed

If another workspace saved your domain without verifying it, publish your record and save again: the domain moves to you. A verified domain stays with its workspace.

Directory sync (SCIM)

Teams and Enterprise. Lets your directory add people and, more importantly, remove them the moment they leave.

Supported

Users: create, read, list (filtered by userName eq "…"), update and deactivate — PUT, PATCH of active, and DELETE.

New people

Join as viewers. Change their role on the Team page.

Deactivating

Switches the membership off: the person loses access to the workspace and its plan, and cannot sign in through single sign-on. Nothing is deleted, so reactivating restores them.

Groups

Not supported, and the service-provider configuration says so.

Tokens

Revoke one at any time on the Security page.

Audit trail

Current limits