> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mibyanai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Platform architecture and request lifecycle

> How organizations, projects, keys, policies, requests, usage, and logs fit together

Mibyan Platform is the control plane for applications using the Mibyan API. It separates team administration and spend controls from the model request itself.

## Resource hierarchy

```text theme={null}
Organization
└── Project
    ├── Members and roles
    ├── Test and live API keys
    ├── Model and endpoint access
    ├── Budgets and rate limits
    └── Usage and request logs
```

An organization is the team boundary. A project is the application or environment boundary. A key belongs to a project, so separate projects or keys make it easier to rotate credentials, attribute usage, and limit blast radius.

## Request lifecycle

1. Your server sends an HTTPS request to `api.mibyanai.com/v1`.
2. The gateway authenticates the bearer key and resolves its project.
3. Policy checks evaluate project status, key status, endpoint and model access, budget, and rate limits.
4. The active Mibyan model configuration processes the request.
5. The API returns JSON or SSE and attaches a `req_...` correlation identifier.
6. The project receives usage and operational log data for review.

## Environment separation

Use test keys and a non-production project during development. Use live keys only on a server-side production service. Never put a live key in browser code, mobile bundles, URLs, screenshots, or client-side analytics.

## Operational controls

Before production, decide who can create keys, which models and endpoints each project may use, how budgets are alerted, how long keys live, and who reviews logs. Rotate a key immediately if it may have been exposed; do not wait for the next deployment.

<Note>Platform controls can limit access and record activity, but they do not validate the truth of generated content. Add application-level validation, retrieval, and human approval where the use case requires it.</Note>