Admin panel
The platform admin's view of every user, organization, API key, security event and job worker on the platform.
The admin panel is where the people who run the platform look after it. It shows every account and every organization, not only the ones you belong to: you create accounts and organizations for people, ban or remove accounts, restore a deleted organization, revoke any API key, and check that emails and background jobs are getting through.
It is for platform admins only. Platform admin is a property of your account, not a role inside an organization, and it gives you no access to an organization's projects, models or issues.
To open it, open your user menu in the top right and choose Admin. The entry is only there for platform admins. While you are in the panel the app uses a different colour scheme, so you can tell at a glance that you are acting on the whole platform.
The panel has six pages, listed in the side menu. Each has a keyboard shortcut: press G and then the letter.
| Page | Shortcut | What it is for |
|---|---|---|
| Dashboard | G D | How the platform is running: workers, jobs, people, organizations, storage and security, as widgets you can change |
| Users | G U | Search, create, edit, promote, ban and delete accounts |
| Organizations | G O | Create organizations for someone else, and restore deleted ones |
| API keys | G K | Every personal API key on the platform, and revoking one |
| Events | G E | Security events, and notification emails that failed |
| Workers | G W | The job workers, whether they are online, and what they run |
Who can do what
| Action | Platform admin | Anyone else |
|---|---|---|
| Open the admin panel | Yes | No. The Admin entry is hidden, and the address redirects to the start page |
| See every user and organization | Yes | No |
| Create, ban, unban or delete a user | Yes | No |
| Make another account a platform admin | Yes | No |
| Create an organization and nominate its owner | Yes | No |
| Restore a deleted organization | Yes | No. Once deleted, nobody inside it can reach it to undo that |
| Revoke someone else's API key | Yes | No. You can revoke your own under your account |
| Replay failed events | Yes | No |
| Work inside an organization's projects | Only if you are a member there, like anyone else | As their organization and project role allows |
Check the dashboard
Dashboard is the first page. It is a dashboard of widgets shared by every platform admin: any of you can add, change, resize, move or remove them. It starts with:
- The platform: workers online, jobs waiting, jobs failed in the period, and notifications that failed.
- People: users, members (each person once), pending invitations, active users, sign-ups and deleted accounts.
- Storage: what is stored in the platform's storage, the split between the platform's storage and organizations' own buckets, its growth, and the largest organizations.
- Security: security events by severity.
Pending invitations counts only invitations that have been sent, are still valid and have not been accepted. Deleted accounts records when an account went and whether its owner or an admin removed it, never who it was. Active users and storage growth count from the day they were first recorded.
Two controls at the top apply to every widget: the Organization filter narrows each one that can be narrowed to a single organization, and the Day · Month · Year switch shows them all over the last 30 days, 12 months or 5 years. Widgets about the platform as a whole, such as workers, are not affected by the organization filter.
Find a user
Newest accounts come first. A Banned or Unverified badge marks accounts that cannot sign in.
Look at a user's details
The details panel has three tabs.
- Information: the email address, badges, the join date and the fields you can edit. If the account is banned, a notice at the top gives the reason and when the ban ends.
- Accounts: how the person signs in. Email & password means they have a password. A single sign-on login shows the organization it belongs to.
- Sessions: where they are signed in, with the IP address and when each session expires.
Edit a user's name, tag or language
The language also sets the language of their emails and exports. A typical case: someone landed in a language they cannot read and cannot find the picker. They can still change it themselves later.
You cannot change the email address here. A change of address has to be confirmed by the account owner, so they do it from their own account. The time zone is shown but not editable: it is the person's own notification setting. When it is not set, their digests follow each project's time zone.
Create a user
No email is sent at this point, and the password is not mailed anywhere. Give it to the person yourself, through another channel. The address starts out unverified: the first time they try to sign in, they are sent a confirmation link and must click it before they can get in.
Act on an account
Open the actions menu (the … button) on a user's row, or at the bottom of their details panel.
- Make admin / Make user changes the platform role. It does not change anything inside organizations.
- Revoke sessions signs the person out everywhere.
- Send password reset emails them a reset link, the same one the sign-in page sends. It only appears in the details panel, and only for someone who has a password. Someone who only signs in through single sign-on has none to reset. You never set a password for someone else.
- Ban user… asks for a Reason and a Duration (Permanent, 1 day, 7 days or 30 days), then Ban user. The person is signed out at once and cannot sign in until the ban ends or you lift it. The reason is not shown to them. It is stored on the account for other admins. Their API keys stop working too.
- Unban user lifts a ban straight away.
- Delete user asks you to confirm, then deletes the account permanently and ends all its sessions. This cannot be undone.
Create an organization for someone
The person you pick becomes the owner and can invite the members from there. You are not added. Being a platform admin is not a membership, so if you need to work inside the organization, ask the owner to invite you.
The Organizations list can be searched by name or slug. Each row shows the owner and the number of members. No owner means nobody holds the owner role at the moment, for example because the owner left. The organization keeps running, but nobody is in charge of it.
Restore a deleted organization
When an owner deletes an organization it is not gone straight away. It stays in the list with a badge such as Deleted · gone followed by the date it will be removed for good, 30 days after the delete.
Everything it held comes back untouched. Invitations that were canceled when it was deleted come back as pending if they have not expired yet, and the message after restoring says how many. Expired ones stay canceled, so the owner has to send those again. After the date on the badge, the organization and its files are removed and can no longer be restored.
Review and revoke API keys
API keys lists every personal API key on the platform, with its owner. Use the Status filter to narrow it down.
| Status | Meaning |
|---|---|
| Active | Used in the last 30 days |
| Idle | Not used for 30 days or more |
| Never used | Created, but no request has come in with it yet |
| Expired | Past its expiry date |
Rate limited (7 days) counts how often the key hit its request limit in the last week, usually a script calling too often.
To revoke a key, click Revoke on its row and confirm. Anything still using the key stops working immediately. The owner sees in the key's history that it was revoked, and by whom.
A key unused for 180 days is revoked automatically, and its owner gets an email about it.
Watch security events
Events helps you spot abuse, such as a run of password resets against one address.
- Last 24 hours shows, per event type, how many there were and how many failed, and the five IP addresses and email addresses that came up most often. Click one to filter the list below by it.
- The list below shows recent security events, newest first: the emails the sign-in system sends (verification, password reset, one-time codes, invitations, account deletion) and what happened to API keys (API key created, API key updated, API key revoked, API key rate limited, API key revoked for inactivity). Filter by exact email, exact IP, type or status. Hover over an IP address to see the browser it came from.
Notifications inside organizations, like issue assignments, are not listed here.
Replay failed emails
Notification emails, such as assignments and digests, are sent in the background and retried a few times. If they still fail, they show up as Failed and, at the bottom of Events, under Failed deliveries with the recipient and the Last error.
Security emails cannot be replayed. Their row records a message that was already handed to the mail system, so there is nothing to send again, and no Replay button is shown for them.
Check the job workers
Workers lists the machines that run background jobs, such as model conversions. For each one you see:
- Status: Busy (running a job right now), Idle (online and asking for work) or Offline (not heard from for a couple of minutes).
- Running: the job type, organization and project of each job it is working on, and since when.
- Job types: what it said it can run.
- Last seen and First seen.
A worker appears once it first asks for a job, and drops off after 7 days unseen.
Good to know
- Being a platform admin does not let you delete or change an organization from the inside. That stays with its owner.
- The events list shows the 50 newest events that match your filters. Choose Show older under the table for the next 50, as far back as the log goes.
- The panel is not part of the public API. Integrations work with the API reference and personal API keys, which never reach the admin panel.
Related pages
Progress
Track the status of model elements and see how far a project has come on the progress dashboard.
Authentication
Sign in and out, sign up, passwords, email verification, two-factor, passkeys and single sign-on. Served under `/api/auth`; a successful sign-in sets the session cookie every other route reads.