Admin console
For self-hosted installations. How to make someone staff, what the /admin console shows and changes, the Unlimited plan, and the audit log.
The admin console at /admin is for whoever runs an Unhandled installation. It lists every organization and user, and it changes plans, trials and access for any of them. Organization admins do not need it; their own settings live under Settings. This page covers how to give someone access, what they can do there, and how each change is recorded.
Staff access
Only staff can open the console. To everyone else, signed in or not, every /admin address answers with the same 404 page as an address that does not exist.
Staff is a flag on a user account. Nothing in the web app can set it, including the console itself. Grant and revoke it from a shell on the server:
node ace staff:grant [email protected]
node ace staff:revoke [email protected]The user must already have an account. Both commands write an entry to the audit log with no staff member as the actor, since they run from the console. The change applies on the user's next request.
In a development database, node ace db:seed makes the demo user [email protected] staff. On a database seeded before this feature, run node ace staff:grant [email protected].
What the console shows
| Page | Contents |
|---|---|
| Overview | Organization and user counts, running trials, data ingested today by signal, bodies waiting for the ingest drain, finished and failed background jobs per queue over the last 24 hours, and the Ingest error rate across the installation |
| Organizations | Search by name or slug. Filter by plan, trial state, data sent in the last 30 days compared with the plan, and suspension. Sort by age, name, data or members |
| Organization | Members, projects and services with their last telemetry, plan, trial, usage per signal against the plan for the current billing period, ingest per day for 14 days, custom domains, integrations, the organization's Ingest error rate and recent staff actions |
| Users | Search by email or name. Filter to unverified or staff accounts |
| User | Organizations and roles, active sessions with device and IP, email verification, staff flag and recent staff actions |
| Audit log | Every staff change, newest first |
Actions
Every action asks for your password unless you signed in during the last 15 minutes. If your account has no password, sign out and sign in again first.
| Action | Effect |
|---|---|
| Change plan | Moves the organization to any plan, including Unlimited. New telemetry gets the new plan's retention; stored data keeps the retention it arrived with |
| Extend trial | Adds 1 to 90 days to the trial end, or to today if the trial has ended |
| End trial | Sets the trial end to now |
| Suspend | Needs a reason, which only staff see. The ingest receiver answers the organization's telemetry with 403 and the message below, from the next request. Members can still read everything, see a banner, and cannot change anything in the organization. Deploy keys and MCP write tools are refused too. Uptime monitors stop sending checks, open outages close without an alert, and status pages show the monitors as paused. Stored data is kept |
| Unsuspend | Lifts all of the above. Monitors start again from a fresh state at the next check, so the suspension does not count as downtime or open an outage |
| Delete organization | Type the slug to confirm. Same result as an admin deleting it from Settings, including the email to members |
| View as user | Opens the app as that user, read-only. See below |
| Sign out everywhere | Ends every session of the user on every device |
| Resend verification | Emails a new verification link. Earlier links stop working |
| Delete user | Type the email to confirm. Same rules as deleting your own account: it fails while the user is the only admin of an organization with other members, and organizations where they are the only member go with them |
You cannot sign yourself out, delete yourself or view the app as yourself from the console. Use your account settings instead.
A suspended organization's telemetry gets this response:
{
"code": 403,
"message": "This organization is suspended, so its telemetry is not accepted. Contact support to restore it."
}Postgres notifies the ingest receiver whenever an organization, plan, service or key changes, so suspending, unsuspending and plan changes reach ingest at once. If the receiver has lost its Postgres connection, it keeps its cached answer until it reconnects.
What a suspended organization sees
- Members see a banner that says the organization is suspended, its telemetry is not accepted and nothing in it can be changed.
- Every change under
/o/:organswers403withThis organization is suspended, so nothing in it can be changed. Contact support to restore it.That includes connecting GitHub or Linear, from the first redirect to the provider's callback. POST /api/v1/deploymentsandPOST /api/v1/sourcemapsanswer403with the same message.- MCP write tools return that message as a tool error. MCP read tools keep working, the same as reading in the app.
Ingest error rate
The Ingest error rate panel on the overview and on each organization shows the share of items the ingest receiver refused over the last 24 hours. Its table lists the top five rejection reasons, with the stage that refused them, the receiver or the drain, and the item count. Items dropped by the sender's own filters do not count as errors.
Viewing as a user
View as user signs your browser session in as the user, so every page shows what they see. A banner at the top names the user and has a Stop viewing button that returns you to their page in the console.
While you view as someone, the server rejects every change with a 403, whatever the page offers. Links that change something even though the browser only opens them count as changes too: connecting GitHub to the account, connecting an integration and their provider callbacks, and email verification and email change links. Opening a notification does not mark it read. The visit does not appear in the user's own session list. The console itself is closed until you stop. Staff accounts cannot be viewed as. If your staff flag is revoked while you view as someone, the next request signs you out.
The Unlimited plan
Unlimited is a plan that only staff can assign. It never appears on the pricing page or in an organization's plan list.
| Unlimited | |
|---|---|
| Data included each month | No cap |
| Overage | None |
| Retention | 3,650 days |
| Uptime monitors | No limit |
| Usage emails | None |
| Trial | Not shown and no trial emails |
Usage is still metered, so the console and the organization's Plan & usage page show how much it sends. Plan & usage shows an Unlimited badge where other plans show the trial.
Plans live in the plans table. A plan with no ingest_gb_included has no data cap, one with no monitor_limit has no monitor limit, and is_purchasable = false keeps it off the pricing page and the plan list.
Audit log
Each entry records the staff member, the action, the organization or user it changed, the values before and after, the IP address and the time. The database refuses to update or delete entries, so the log only grows. Entries keep the email of the staff member and the name of the target, so they still read correctly after either account or organization is deleted.