Dual ID System
- Organization / API Key – Authentication boundary; API responses surface
organization_id. - Namespace (
namespace_id) – Authorization boundary; passed through theX-Namespaceheader. - Internally, MongoDB documents also reference
internal_id(organization key) for indexing.
Create a Namespace
namespace_idandnamespace_namefeature_extractorsregistered for this namespacepayload_indexesapplied to Qdrant collectionsdocument_count(if collections already exist)
POST /v1/namespaces/list.
Isolation Guarantees
- All MongoDB collections include a
namespace_idindex (e.g.,collections,retrievers,taxonomies). - Qdrant creates a single HNSW-backed collection per namespace (
ns_<namespace_id>); payload filters keep collection boundaries intact. - Redis cache keys are prefixed with
namespace_id. - Ray jobs, tasks, and webhook events embed the namespace so pollers never cross boundaries.
- API requests missing
X-Namespaceare rejected once multitenancy is enabled.
Namespace Templates
Bootstrapping a namespace can be automated with templates:api/namespaces/templates/.
Migrations
Namespaces carry aschema_version. The API upgrades namespaces automatically on startup or via explicit migration requests:
- Migration scripts live in
api/namespaces/migrations/. - Rollback scripts are optional but recommended for major changes.
Best Practices
- One namespace per environment (dev, staging, prod). Use templates to keep them aligned.
- Pass
X-Namespaceeverywhere including webhooks and retriever requests. - Grant least-privilege access by issuing API keys scoped to specific namespaces when possible.
- Segment analytics by namespace using the Analytics endpoints (
/v1/analytics/...) to understand tenant-specific performance. - Monitor document counts with
GET /v1/namespaces/{id}to track growth and adjust Qdrant shard planning.
X-Namespace and Mixpeek handles the isolation across storage, cache, and compute.
