# Billing for multiple organizations in Confluent Cloud A parent model groups the Confluent Cloud organizations that belong to your company so that you can share a single commitment. The capabilities on this page are self-service for customers with a parent commitment for multi-organization billing. #### NOTE The Confluent Cloud parent model is available as a Limited Availability feature. If you would like to participate in the Limited Availability Program, contact your Confluent account team to enable the parent model. ## View linked organizations Users with the [ParentAdmin](../security/access-control/rbac/predefined-rbac-roles.md#parentadmin-role) role can view the organizations linked to the parent. ### Cloud Console To view linked organizations in the Confluent Cloud Console: 1. Sign in to the Confluent Cloud Console. 2. In your organization menu, click **Parent portal**. 3. On the **Overview** tab, review the list of organizations linked to your parent. #### NOTE If you have the `ParentAdmin` role but **Parent portal** doesn’t appear in the navigation menu, open a support ticket to request that the parent APIs be enabled for your parent. ### Confluent Cloud APIs To list linked organizations by using the Confluent Cloud REST API, send the following request: ```bash curl -s -u ":" \ https://api.confluent.cloud/iam/v2/parent-organization-links ``` The response includes one entry for each linked organization, with its `organization_id`, `organization_name`, and `parent_id`. ## View consolidated consumption Users with the `ParentAdmin` role can view billing and consumption across all organizations linked to the parent. To view consolidated consumption in the Confluent Cloud Console: 1. Sign in to the Confluent Cloud Console. 2. In the navigation menu, click **Parent portal**. 3. Click the **Billing** tab. From the **Billing** tab, you can: - View the total drawdown of your parent commitment across all linked organizations. #### NOTE The commitment summary appears only when your parent has an active commitment. - Download the invoice for each linked organization. ## Manage the ParentAdmin role The [ParentAdmin](../security/access-control/rbac/predefined-rbac-roles.md#parentadmin-role) role grants view access to the parent. #### NOTE To view and manage the `ParentAdmin` role, use the Confluent Cloud APIs. The Confluent Cloud Console and Confluent CLI don’t show `ParentAdmin` role bindings. The `ParentAdmin` doesn’t grant permissions within linked organizations, such as access to read data. You can grant `ParentAdmin` to users, service accounts, SSO group mappings, and identity pools. Only a principal with the `ParentAdmin` role can grant `ParentAdmin` to another principal. An `OrganizationAdmin` doesn’t grant or have any access to the parent without the additional `ParentAdmin` role. If you have an active parent commitment and no one in your organization has the `ParentAdmin` role, contact Confluent Support. ### Prerequisite * A [Cloud API key](../security/authenticate/workload-identities/service-accounts/api-keys/overview.md#cloud-api-keys) or [Global API Key](../security/authenticate/workload-identities/service-accounts/api-keys/overview.md#cloud-global-api-keys) owned by a user or service account that has a direct `ParentAdmin` role binding. * Your parent ID. To find your parent ID, list the parent organization links: ```bash curl -s -u ":" \ https://api.confluent.cloud/iam/v2/parent-organization-links ``` The response lists each linked organization and its `parent_id`: ```json { "kind": "ParentOrganizationLinkList", "data": [ { "id": "pol-xxxxx", "parent_id": "p-xxxxx", "organization_id": "", "organization_name": "Acme Production" } ] } ``` Role bindings for the parent use the scope `crn://confluent.cloud/parent=`. #### List role bindings To list all principals that have a role on the parent, send the following request: ```bash curl -s -G -u ":" \ https://api.confluent.cloud/iam/v2/role-bindings \ --data-urlencode "crn_pattern=crn://confluent.cloud/parent=/*" ``` Example response: ```json { "kind": "RoleBindingList", "data": [ { "id": "rb-xxxxx", "principal": "User:u-xxxxx", "role_name": "ParentAdmin", "crn_pattern": "crn://confluent.cloud/parent=p-xxxxx" } ] } ``` `principal` identifies a user with `User:u-xxxxx`, service account with `User:sa-xxxxx`, identity pool with `User:pool-xxxxx`, or SSO group mapping with `User:group-xxxxx`. To filter by principal, add `--data-urlencode "principal=User:"`. To get a user’s email address, send a request to `GET /iam/v2/users/`. #### Grant role binding To grant the `ParentAdmin` role to a principal, send the following request: ```bash curl -s -X POST -u ":" \ https://api.confluent.cloud/iam/v2/role-bindings \ -H "Content-Type: application/json" \ -d '{ "principal": "User:", "role_name": "ParentAdmin", "crn_pattern": "crn://confluent.cloud/parent=" }' ``` A successful request returns `201 Created` and the ID of the new role binding of `rb-xxxxx`. To find a user’s ID with `u-xxxxx`, send a request to `GET /iam/v2/users` and match on `email`. #### Remove a role binding To remove the `ParentAdmin` role from a principal, delete its role binding. Before you remove a role binding, verify that at least one other principal has the `ParentAdmin` role. To find the role binding ID, see [List role bindings](#parentadmin-list-role-bindings). To grant the `ParentAdmin` role to a principal, send the following request: ```bash curl -s -X DELETE -u ":" \ https://api.confluent.cloud/iam/v2/role-bindings/ ``` ## Limitations - A parent supports a maximum of ten linked organizations. - All organizations linked to a parent must use the same billing method, directly by Confluent or through a cloud marketplace. ## Related content - [Predefined RBAC roles](../security/access-control/rbac/predefined-rbac-roles.md#predefined-rbac-roles) - [Manage RBAC role bindings](../security/access-control/rbac/manage-role-bindings.md#manage-rbac-role-bindings) - [Role bindings API reference (iam/v2)](https://docs.confluent.io/cloud/current/api.html#tag/Role-Bindings-(iamv2))