User Management

The Users page lists all gateway users. Admins can add, edit, lock, and delete users, and open any user’s detail page.

Note

Every role can see the team directory: names, emails, roles, and whether an account is locked. Lock reasons and MFA preferences are only shown to admins. Everyone can open their own detail page; only admins can open other people’s.

Viewing Users

Navigate to Users in the sidebar to see the list:

Column	Description
User	Name and email
Roles	Current role badges
Status	Active or locked
Added By	Administrator who added the user
Created	When the user was added
Actions	View details, and (admins) edit, lock or unlock, and delete

Adding Users (Admin)

1. Click Add User
2. Enter the user’s name and email
3. Check one or more roles (Viewer, Ops, Deployer, Admin)
4. Click Add User

New users receive a welcome email with login instructions, and the other admins are told a user was added. Adding a user needs MFA on the request. The email must be in the gateway’s Google Workspace domain (the only one that can sign in), and one that already belongs to a user is refused: adding a user never changes an existing one.

Editing Users (Admin)

Admins can update a user’s name, email and roles:

1. Choose Edit User from the user’s actions menu, or Edit on their detail page
2. Update details
3. Click Save Changes

Changing roles needs MFA on the request. A role change applies to the user’s next request, and to their API tokens, which can never do more than their owner’s role allows. You can’t change your own roles.

A new email can mean the account now belongs to someone else, so changing it signs the user out everywhere and deletes their API tokens: nothing issued to the old address keeps working. Replace any CI tokens the user owned. Every field is checked before anything changes, and the changes are saved together.

Locking or Unlocking Users (Admin)

Locking blocks access at once: it revokes the user’s sessions and their API tokens stop working until they’re unlocked. A lock needs a reason: the user’s email includes it, and in the web UI only admins see it.

1. Choose Lock Account from the user’s actions menu, or on their detail page
2. Enter the reason and confirm

Unlock Account reverses it. The user is emailed when locked and when unlocked. You can’t lock or delete your own account.

Resetting MFA (Admin)

For a user who has lost every MFA method and their backup codes, choose Reset MFA on their detail page (shown for users who have MFA set up) and confirm. Confirm who’s asking before you do: the reset lets the user sign in with only their Google account until they set up a new method. It needs MFA from you on the request.

The reset removes their MFA methods, backup codes and trusted devices and signs them out everywhere. Their API tokens are kept, so CI keeps working. They’re emailed, and they set up a new method when they next sign in. The audit log records it as user.mfa_reset.

You can’t reset your own MFA: manage your methods under Account Security. A reset doesn’t unlock an account; if failed MFA attempts locked it, unlock it as well.

Deleting Users (Admin)

1. Choose Delete User from the user’s actions menu, or on their detail page
2. Type DELETE to confirm

Danger

Deletion is permanent. Audit history remains, but access is removed.

User Detail Pages

Click a user to view their details. The page includes:

• Role badges and account status
• Active Sessions: when each was created and last seen, when it expires, the client (browser or CLI) and user agent, with Sign Out for one session and Sign Out Everywhere for all
• The user’s audit logs

Every user can open their own page (click your name at the bottom of the sidebar) to review their sessions, sign out a session they don’t recognize (or all of them), and see their own activity. Signing out sessions needs a fresh MFA check. My Activity in the sidebar opens your own audit log; admins see Audit Logs with everyone’s activity instead.

Related

• RBAC Roles - Role definitions
• API Tokens - Token management
• Audit Logs - Activity history