Portal Admin Pages¶

The admin area is for platform administrators only: a user whose grants include the wildcard action on portal:system (PLATFORM_ADMIN). For them the sidebar shows an Admin entry (shield icon) that opens /admin/devices; for anyone else the entry is absent and /admin/* redirects to the home page. Nexus checks every admin RPC on its own, so hiding the entry is a convenience, not the boundary.

SUPPORT_ADMIN is not a platform admin and does not see these pages. See Authz for the roles.

The admin area has five tabs: Devices, Enrollment, Organizations, Relays and Profiles.

Devices¶

Every device on the platform, across all organizations, filtered with Filter by ID, hostname, or MAC... and the status facets All, Holding, Prepared, Assigned, Retired, Revoked.

Action	What it does
Assign	Gives a holding-zone device to an organization (Pick an organization…).
Move	Moves an assigned device to another organization.
Return to holding	Takes a device away from its organization; it must be reassigned.
Create device	Stages a device before its hardware exists, so its config can be built in advance.
Connect	Folds a holding-zone unit into an existing (prepared) device: the unit hands over its hardware and pulls that device's config, without a reflash.
Replace	Swaps the box behind a device for a unit from the holding zone. The device keeps its id, config and organization; the old box is locked out immediately.
Clone	Creates a new prepared device with a copy of another device's config.
Console	Opens a root shell on the device.
Delete	Removes the device and all its configuration. Cannot be undone.

Rows can be selected for bulk Assign, Return to holding and Delete.

A unit that has enrolled but has not been assigned appears here and nowhere else. A customer reporting that a new box is missing from the portal is usually looking at an unassigned device.

See Device lifecycle for how these actions relate.

Enrollment¶

Credentials that let a device join the platform, filtered by All, Device codes and Bootstrap tokens.

Device code: single-device, bound to one MAC address, redeemed once. Delete removes it.
Bootstrap token: named, multi-use (Max uses, 0 = unlimited), optional expiry, baked into a gateway USB image as ENROLL_TOKEN. Every device flashed with it enrolls into the holding zone. Revoke stops images built with it from enrolling; devices already enrolled are not affected.

Both are shown once, on creation. See Enrollment and Provisioning.

Organizations¶

Every organization, with its name, slug, owner (ORG_OWNER holder, or No owner yet), plan and creation date. Filter with Filter by name, slug, or owner....

New organization creates an empty organization with no owner. Only platform administrators can create organizations; there is no self-service path.
Rename changes the display name.
Delete removes the organization record. Its devices are not deleted and not returned to the holding zone: they keep pointing at the deleted organization. Use Return to holding on its devices first.

Relays¶

The relay fleet: state, last heartbeat, attached gateways, forwarding load, version and tunnel. Drain and Put back in service control allocation. See Relay Fleet.

Profiles¶

Service profiles: per-organization overrides of the starting values a service profile offers in the wizard. Pick an organization, then Edit a profile's defaults or Reset them to the catalogue value. The interfaces, rules and NAT a profile creates come from the catalogue and are not editable here.

Onboarding a customer from the portal¶

Creating an organization and giving people access to it is done entirely from the portal. Accounts are invite-only: nobody can register on the login page, and signing in creates nothing. A user with no grant sees No organization yet until someone grants them a role.

Create the organization. Admin > Organizations > New organization, enter a name, Create. It starts with No owner yet. You are not made its owner; platform admin already reaches it.
Select it. Open the user menu in the sidebar and pick the new organization in the organization switcher. With All organizations selected, an organization-scoped invite is refused with No organization selected.
Invite the first owner. User menu > Team (/account/team) > Members tab > Invite Member. Enter the email address. If an account already exists for that exact address it is offered as a match; otherwise fill in First name / Last name and the invite creates the account. Choose Role = Organization owner, Scope = Organization (all access), then Send Invite. The person receives an email from Zitadel to set a password. A second factor is optional.

Add the rest of the team. Either you or the new owner repeats step 3 with the right role:

Role in the dialog	For
Organization owner	Everything in the organization, including the console and managing people.
Organization member	Views and configures the organization's gateways. No console, no activity history, cannot invite or remove anyone.
Device owner	One gateway only (Scope = Device, pick or paste the device id).

Platform administrators are also offered Support, Support admin and Platform admin. Those are internal staff roles and never appear in a customer's member list.

Assign devices. Admin > Devices, select the holding-zone units, Assign to the organization.

To grant a role to someone who already has an account, use the My access tab

Add Permission.

Changing or revoking access¶

On Team, with the organization selected:

Members tab: Change role switches a member between owner and member; Remove revokes their membership grant.
My access tab: Who has access to org lists every grant on the organization (including support grants, for platform admins) with Revoke on each row. Platform admins also see Platform access, the platform-wide admin and support-admin grants, each revocable.

Revoking removes the grant only; the Zitadel account remains. Only an organization owner or a platform admin can invite, grant, change or revoke; an organization member sees the lists with no controls (Only an organization owner can invite people or change access.).