> ## Documentation Index
> Fetch the complete documentation index at: https://synthetiq.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# User management

> Managing users, roles, scopes, and access control in deployed apps

Every deployed app includes a built-in admin interface for managing users, roles, and access control. Scopes define individual permissions, roles group scopes together, and roles are assigned to users — controlling who has access to what functionality and data in the app.

## Access

The access page at `/admin/access` controls who can access the app and how users are invited.

### Access levels

| Level             | Description                                            |
| ----------------- | ------------------------------------------------------ |
| **Private**       | Only invited users and organization members can access |
| **My Workspace**  | Share with everyone in your Synthetiq workspace        |
| **Link (Public)** | Anyone with a Synthetiq account can access             |

### Inviting users

Add users by email address. They gain access when they log in with that email. Organization members automatically have access — manage organizations in the [Organizations tab](/docs/platform-docs/deployments/administration/organization-management).

<Frame caption="Access control with visibility settings and user invitations">
  <img src="https://mintcdn.com/synthetiq/-jIlH6VGRYQP1yAa/images/platform-docs/deployments/administration/access-overview.png?fit=max&auto=format&n=-jIlH6VGRYQP1yAa&q=85&s=a641913df528ac625591fb45474786dc" alt="Access control page" width="4104" height="2284" data-path="images/platform-docs/deployments/administration/access-overview.png" />
</Frame>

<Note>
  Access to all admin pages requires admin-level scopes. The specific scope requirements are noted per section below.
</Note>

## Users

The users page at `/admin/users` lists all users who have accessed the app, or been invited to the app, with their roles, email, and last activity.

<Frame caption="Users list with role assignments and activity tracking">
  <img src="https://mintcdn.com/synthetiq/-jIlH6VGRYQP1yAa/images/platform-docs/deployments/administration/users-list.png?fit=max&auto=format&n=-jIlH6VGRYQP1yAa&q=85&s=d8faada9fa827ea80835293a368607bd" alt="Users list page" width="4104" height="2278" data-path="images/platform-docs/deployments/administration/users-list.png" />
</Frame>

### User detail

Click a user to view and manage their profile at `/admin/users/:id`:

* View user profile (name, email, last seen)
* Map an external ID for data integration with external systems
* View linked identity providers
* View organization memberships
* Assign or remove roles
* Delete the user

<Frame caption="User detail with profile, identity providers, organizations, and role assignments">
  <img src="https://mintcdn.com/synthetiq/-jIlH6VGRYQP1yAa/images/platform-docs/deployments/administration/user-detail.png?fit=max&auto=format&n=-jIlH6VGRYQP1yAa&q=85&s=88e9ef49f712d5dd9c8c6869b0b7c5fa" alt="User detail page" width="4104" height="2286" data-path="images/platform-docs/deployments/administration/user-detail.png" />
</Frame>

| Action          | Required scope  |
| --------------- | --------------- |
| View users      | `users:viewAll` |
| Edit user roles | `users:editAll` |

## Roles

The roles page at `/admin/roles` lists all roles with their assigned scopes.

<Frame caption="Roles list with scope counts and user assignments">
  <img src="https://mintcdn.com/synthetiq/-jIlH6VGRYQP1yAa/images/platform-docs/deployments/administration/roles-list.png?fit=max&auto=format&n=-jIlH6VGRYQP1yAa&q=85&s=4850336c2b5fb684fc64dd48edff5e08" alt="Roles list page" width="4102" height="2276" data-path="images/platform-docs/deployments/administration/roles-list.png" />
</Frame>

### Creating and editing roles

Admins can create new roles at `/admin/roles/new` or edit existing roles at `/admin/roles/:id`. Each role is a named collection of scopes.

<Frame caption="Role editor with scope selection">
  <img src="https://mintcdn.com/synthetiq/-jIlH6VGRYQP1yAa/images/platform-docs/deployments/administration/role-detail.png?fit=max&auto=format&n=-jIlH6VGRYQP1yAa&q=85&s=d82da6d7222e4ec9136c3d2deae5e305" alt="Role detail page" width="4098" height="2278" data-path="images/platform-docs/deployments/administration/role-detail.png" />
</Frame>

| Action            | Required scope |
| ----------------- | -------------- |
| View roles        | `roles:view`   |
| Create/edit roles | `roles:edit`   |

<Note>
  Scopes are defined in `scopes.json` and synced at build time. To add or remove scopes, update `scopes.json` and rebuild the app. Roles are managed at runtime.
</Note>

## Scopes

The scopes page at `/admin/scopes` lists all scopes defined in the app, showing each scope's name, description, and which roles include it.

<Frame caption="Scopes list showing all defined permissions and their role assignments">
  <img src="https://mintcdn.com/synthetiq/-jIlH6VGRYQP1yAa/images/platform-docs/deployments/administration/scopes-list.png?fit=max&auto=format&n=-jIlH6VGRYQP1yAa&q=85&s=728022c535d91cc7be2c84eb622cfe56" alt="Scopes list page" width="4102" height="2274" data-path="images/platform-docs/deployments/administration/scopes-list.png" />
</Frame>

The scopes page shows two categories:

| Category      | Source                                                          | Examples                                                                                     |
| ------------- | --------------------------------------------------------------- | -------------------------------------------------------------------------------------------- |
| App scopes    | Defined in the app's `scopes.json`                              | `tasks:viewAll`, `reports:edit`, `github:repos:read`                                         |
| System scopes | Provided by the framework automatically for admin functionality | `users:viewAll`, `users:editAll`, `roles:view`, `roles:edit`, `logs:view`, `workflows:admin` |

App scopes control access to the app's own procedures, data, and service integrations. System scopes control access to the built-in admin pages and framework features (user management, role management, monitoring, workflow administration).

Both categories are assigned to roles in the same way. The **Admin** role automatically includes all scopes — both app and system.

Scopes are read-only in the admin UI — they are defined in `scopes.json` (app scopes) or by the framework (system scopes) and synced at build time. See the App Framework scopes and roles documentation for configuration details.