Permissions, Users, and SSO FAQs

Can a different user be specified than expected during Cast AI onboarding?

It was a conscious design decision not to reuse the same role/serviceAccount/servicePrinciple as best practice to avoid operational and security risks. The role gets narrow permissions for this specific VPC and EKS with a specific tag-based IAM policy, which is the bare minimum needed for Cast AI to do autoscaling.

Having one role spanning multiple clusters would mean giving Cast AI permissions not limited to scope. It also brings operational risk: the same role could be accidentally deleted when removing a single cluster, effectively killing Cast AI in other clusters.

Is it possible to transfer clusters between organizations?

Currently, there is no built-in method to transfer clusters between organizations. To achieve this, you would need to disconnect the cluster from organization A and connect it to organization B.

Why does Cast AI require adding, deleting, or assigning a keypair? Does it require any ability to SSH?

Cast AI doesn't depend on or need SSH access.

However, as Cast AI takes over creating VMs, some customers still want to retain SSH access to their nodes. In this scenario, customers can specify in "NodeConfiguration" which keypair to inject into the new VM so that SSH access will work.

Cast AI doesn't check KeyPair permission during credential validation.

Can Cast AI SSO use claims in the JWT to get user data without checking the directory?

The Cast AI system follows the current API permissions in our documentation. Cast AI doesn't process user data; it's verified by our identity provider, Auth0, to confirm the user's identity. We don't store these details, and Auth0 manages them securely during integration setup.

Can I transfer clusters between child organizations in an Enterprise?

No. Clusters cannot be transferred directly between child organizations. To move a cluster, disconnect it from one child organization and connect it to another. See Enterprise organizations for more details.

Can existing organizations become child organizations in an Enterprise?

Yes. Cast AI can attach existing organizations as children of an Enterprise. Users from those organizations are moved to the Enterprise. Clusters stay in the child organization and are not transferred automatically. Contact your Cast AI account representative to attach existing organizations. See Set up an Enterprise.

What happens to SSO when existing organizations join an Enterprise?

By default an Enterprise supports one SSO connection, which child organizations inherit.

If only one of the existing organizations has SSO, that connection can be moved to the Enterprise.
If several have SSO, choose which connection to move to the Enterprise. The others inherit it unless multi-tenant SSO is enabled so a child can keep or configure its own.
If none have SSO, confirm whether all users share one identity provider. Different IdPs require multi-tenant SSO.

Contact your Cast AI account representative to move SSO connections or enable multi-tenant SSO. See SSO in Enterprise organizations.

How do I use a parent org API key to access child organization resources?

When using a parent organization API key to call an API endpoint for a resource in a child organization, include the X-CastAi-Organization-Id header with the child organization's ID:

curl --request GET \
  --url https://api.cast.ai/v1/<endpoint> \
  --header 'X-API-Key: <parent-org-api-key>' \
  --header 'X-CastAi-Organization-Id: <child-org-id>' \
  --header 'accept: application/json'

Without this header, the API resolves the request against the parent organization and returns 404. API keys scoped to a specific child organization work without the header. See API keys in Enterprise organizations.

Which role are SSO users assigned when they initially sign in?

In a standard organization, Cast AI SSO assigns the Viewer role by default. In an Enterprise, the first SSO login creates a user with no access until an Enterprise Owner assigns a role. See SSO in Enterprise organizations.