Admin guide

The admin menu: Vendors, Analysts, Views, API keys, SQL, Activity, Push API guide, Audit log, System status.

Vendors and their logins

1. Vendors > New vendor. Enter the vendor name, a short code (suggested from the name; immutable, it becomes the table-name prefix), and the first login’s person: full name and e-mail.
2. The API creates the Keycloak user with role vendor, a temporary password (shown once, never stored by us) and “must change at first sign-in”. Pass it on securely. If any step fails, everything is rolled back.
3. Open the vendor: tabs Projects, Logins, Push API. Add more logins, reset a password (a new temporary one, shown once), or make push keys.

Vendors can create their own projects and folders (self-service). An admin can see and act on any vendor.

Analysts and access

1. Analysts > New analyst. Creates the Keycloak user with role analyst and a temporary password.
2. Open the analyst and choose what they may read:
   • tick single projects, and/or
   • switch on Vendor + future projects to give a whole vendor, including projects created later (no extra step).
3. Saving replaces the full list. Access is per project (not per folder).

Until you assign something, an analyst sees no data. A login created by hand in Keycloak without registering here shows as “not registered”.

Activity

Activity answers “what is happening to files?”. It is a paged table, one thin line per event, newest first, with filters for vendor, project and folder, Only problems, optional processing steps, and rows per page (25/50/100). The address holds your filters (/activity?folder=9&only=problems), so you can share the exact view. Click a file name for its journey and the time between steps.

Audit log

Four logs, all newest-first, with a required time range (default 24 hours, at most 31 days):

Tab	Holds
Activity	Who changed what: vendors, logins, access, views, APIs, keys, purges
SQL & exports	Every query and CSV export, including refused ones
API calls	Every call to a published API, including refused ones
Files	Uploads and processing steps

Filter by who, action/type/result, view or status; free text searches the newest 5,000 matching rows and tells you how many it looked at, with a Keep searching button. Click a row for the full entry.

Retention: activity and SQL logs are kept 365 days, API-call logs 90 days. File events are never purged. Passwords and keys never appear in any log.

System status

System status checks each service and links to the ones with their own web page (Trino, Nessie, Spark master, SeaweedFS master and filer). “Other web consoles” lists Keycloak admin, NiFi and the Spark worker. The same health, plus machine load and data counts, is available on the server with lakestatus (lakestatus).

Other admin powers

• Files: archive, restore, process again, delete for good (type the file name; also erases the original).
• Push keys: make or revoke keys for a vendor.
• Global API keys: a key that opens every published API.
• Everything analysts do: SQL over all data, views, notebooks.