Skip to content

Settings, users, API tokens & audit log

Settings

Open Settings. For all roles, the menu links to the sections Settings general and Locale; admins additionally see Mail/SMS/Push/Webhook and API.

All roles can open the page. Non-admins only see the cards General Settings, Local Settings and Display Options, read-only and without the language. Only admins see the notification and API sections.

For admins, the page has these cards, in this order: General Settings, Local Settings, Display Options, Email-Setup, SMS-Setup, Web-Push-Setup, API Access, Webhooks, SMS Recipients and Push Subscriptions. The form cards from General Settings to Web-Push-Setup are saved with one shared Save button. API Access, Webhooks, SMS Recipients and Push Subscriptions have their own buttons.

General Settings

Company information shown on the legal pages and the header:

  • Company Name, Application Title, Address, Website
  • Contact Email and Impressum Email
  • Impressum Info (legal notice text, plain text)
  • Data Protection Policy (HTML, only h1, h2, h3, b and i are kept)
  • Link zu weiteren Infos (link to more information)

Local Settings

  • Timezone (IANA name, for example Europe/Berlin), used for all times and for entering maintenance times
  • Display Timezone: full name (for example Europe/Vienna), short offset (for example UTC+2) or no display
  • Public Site Language: English or Deutsch for the public UI and the SLA exports. Default: English.
  • Date/Time format short and Date/Time format long
  • Decimal Separator and Decimal places (1 to 4) for availability and SLA values

Display Options

  • Status refresh interval (minutes): the public start page reloads itself at this interval. 0 to 1440; 0 turns it off (default).
  • Show resolved incidents (minutes): how long a resolved incident stays visible on the start page. 0 to 1440; 0 turns it off (default).

Mail/SMS/Push/Webhook

  • Email-Setup: provider None (disabled), SMTP server or Resend.com. Enter host, port (1 to 65535), user, password or API key, and From address. Passwords and keys are stored encrypted and never shown again. An empty field keeps the stored value; Show reveals the input. Send test email sends a test mail to your own address. Save first.
  • SMS-Setup: provider none or Twilio, Twilio Account SID, Twilio Auth Token and Twilio From Number.
  • Web-Push-Setup: Generate VAPID Keys creates the key pair; Regenerate VAPID Keys replaces it after a confirmation that shows the number of affected subscriptions. Regenerating invalidates existing browser subscriptions. The keys cannot be edited by hand. The Contact Address (mailto:) is required and must start with mailto: or https:. Without keys, the push button stays hidden for visitors.
  • Webhooks: with New Webhook Name, Endpoint URL, Target Type (Generic, Slack, Teams or Discord) and Event Types ("Leave empty to receive all events."), Create Webhook creates an endpoint. The secret is generated and shown only once. Each endpoint offers Disable/Enable, Send Test, Regenerate Secret (the old secret stops working immediately) and Delete.
  • SMS Recipients: create recipients with label, phone number and event types with Create Recipient. Each recipient offers Enable/Disable, Send Test SMS and Delete.
  • Push Subscriptions: the list of visitors' browser subscriptions. Single subscriptions can be removed with Delete.

Webhooks, SMS recipients and push subscriptions each show the time and status of their last delivery.

API

In the API Access card, create and revoke API tokens for integrations:

  • New Token Name: 2 to 100 characters, unique among active tokens ("A token with this name already exists.")
  • Expires (optional): expiry date
  • Restrict to services (optional): restrict the token to selected services, or leave empty for all services
  • Create Token creates the token. It is shown only once and can be copied with Copy.
  • Revoke keeps the record and disables the token. Delete removes it permanently. Both ask for confirmation.

Store tokens in your secret manager. See Public API.

Warning

Revoke tokens that are no longer needed. Repeatedly failing requests are throttled per IP address.

Users

Open Settings → Users (admin only). See Roles & login for the procedure.

Audit log

Open Settings → Audit log (admin only, address /admin/audit-log). The audit log records all changes made through the admin UI, among them:

  • settings, users and API tokens
  • components, groups and manual status changes
  • outages, incidents and maintenance
  • SLA plans, holiday lists, SLA configuration and the SLA report steps
  • webhooks, SMS recipients, subscribers, templates, resends and regenerating the VAPID keys

Not recorded are login and logout, the public forms, test actions and internal incident notes.

The Audit Log page shows the columns Timestamp, Actor, Action, Entity and Details, with the values before and after the change. Narrow the list with the search and an action filter (Filter, Clear); 100 entries per page with Previous and Next. Secrets and password hashes are never recorded. Entries cannot be edited or deleted.