End user
One person inside a tenant. Created automatically, never provisioned by hand.
An end user — a host identity in the API — is one individual person of one of your customers. You never create these. The first time somebody exchanges a token, FlozentAi records them against the subject claim in that assertion and reuses the record from then on.
Cutting off one person
Suspending an end user is the narrowest possible revocation: token exchange for that subject is refused while every other person in the tenant keeps working. Use it when one person leaves or one account is compromised, instead of suspending the tenant and stopping everybody.
Find them under Configuration → Tenants & identity → End users, choosing the bound tenant first. The list is capped at 200 per tenant in the console; use the management API if you need the full set.
What the subject should be
The subject is whatever your identity provider puts in the token’s sub claim. It must be stable for the lifetime of the person — an immutable user id, not an email address that can change.