Organization Settings

Overview

Every Veltrix workspace is an organization (a tenant). Everything inside it — users, roles, API keys, canvases, apps, deployments — is isolated to that organization. The organization settings are where you describe the organization itself, and where you reach the people-management screens that live next to it.

This page covers the Organization settings page and day-to-day user administration. Roles, permissions and single sign-on are documented in Access Control & Single Sign-On; API keys are in API Keys & Tokens; plan limits are in Plans, Limits & Trial.

Where to Find It

The old /settings/users and /settings/roles addresses redirect to /access-control, so stale bookmarks keep working.

Organization Profile

The Organization page shows the profile read-only. Choose Edit Information to change it, then Save Changes (or Cancel to discard).

1. Open Settings → Organization.
2. Select Edit Information.
3. Change the fields you need (table below).
4. Select Save Changes. If the save fails you get an inline error and the form stays open.

Only the fields above are editable by an organization. Tenant identifiers, plan, and platform-level settings cannot be changed from this page.

Shortname

The shortname is a unique, human-readable identifier for your organization. Veltrix uses it to tag cloud resources it provisions for you, so you can recognise them in your own cloud console. If you leave it blank, your account ID is used instead.

• 2–31 characters: lowercase letters, numbers and hyphens, starting and ending with a letter or number (for example acme-prod).
• Input is trimmed and lowercased. Saving an empty value clears it.
• Must be unique across all organizations. If it is taken you see “That shortname is already taken. Please choose another.”

Permissions and Plan

The tenant Administrator role holds every permission. API calls made with an API key need the key's role to carry the same permissions.

Managing Users

User management is the first tab of Settings → Access Control. The list shows each user's name, email, phone and role, plus an Auth Provider column when your organization has non-local users.

Add a user

1. Open Access Control → User Management and choose to add a user (visible with user:write).
2. Enter First name, Last name, optional Phone number, and Email.
3. Pick the Role.
4. Pick the Authentication provider: Local account, or one of the identity providers your organization has configured. A local account needs a password. An SSO user has no password in Veltrix and signs in through the identity provider.
5. Select Create user.

Edit a user

Use the edit icon in the row. You can change name, phone, role and, for local accounts, set a new password (leave it blank to keep the current one). Email cannot be changed after creation. The eye icon opens the user's detail view.

Delete a user

Use the delete icon and confirm in the dialog. For Cognito-backed users, Veltrix also removes the user from your Cognito pool.

Rules enforced by the server

• User limit: creating a user fails with “User limit reached” once you are at your plan's limit (free 3, starter 10, professional 50, enterprise 500; see Plans, Limits & Trial). SSO just-in-time provisioning is held to the same limit.
• Password policy (local accounts): at least 12 characters, at most 128 characters and 72 bytes, not a commonly used password, and not based on the user's name or email.
• Unique email: an email address can belong to only one account on the platform.
• No self-escalation: you can only assign a role whose permissions you hold yourself.
• Platform-managed accounts (Veltrix operators) cannot be edited or deleted from organization administration.
• Sessions end on change: setting a new password for a user, or deleting them, revokes that user's existing sessions.

Default Roles

Every new organization is created with two roles:

• Administrator — full access. The person who signs up becomes the first Administrator.
• User — a standard role with basic access.

Custom roles, the permission matrix, per-app permissions and identity-provider setup are on paid plans and are documented in Access Control & Single Sign-On. On the free plan the Role Management and Identity Provider tabs show an upgrade prompt, and the server returns a 403 if those APIs are called directly. Local email and password sign-in works on every plan.

Sign-Up and Tenant Creation

A person who registers at /signup (name, email, password) creates a new organization on the free plan, with themselves as its first Administrator — they do not join an existing organization. Anyone who needs to join an existing organization must be added by that organization's administrator or provisioned through its identity provider. See Profile & Account Security for the sign-in flow.

MSSP Membership

Below the profile, the Organization page shows MSSP cards that depend on your state. Acting on them needs organization:write.

MSSP providers do not join other MSSPs, so the membership card is hidden for them. Portfolios (tenant groups), join-request approval and the console itself are covered in MSSP Console.

Gotchas

• The Organization page needs organization:read to load; without it you see a load error rather than an empty form.
• The logo is stored with the profile; use a reasonably small image.
• Organization contact details are informational. They do not change who can sign in or how billing is addressed.