Administration overview

Chat Administration is the section of the Chat app where you decide what people can do in Chat, moderate conversations and read the audit log. This page is for the owner or admin of a workspace (your tenant).

Who can administer

Chat does not define administrators of its own. It follows the roles you manage in the Identity Server and asks one question: does this person’s role hold a Chat administration permission?

• The <code dir="auto">tenant_owner</code> always holds every Chat permission, including both administration permissions. This cannot be changed.
• Every other role, tenant_admin included, starts with no Chat permissions. The owner grants them under Roles & permissions.
• administration.read lets a person open Chat Administration and look at everything in it.
• administration.manage lets a person change things: save role permissions, change settings, delete conversations and refresh from the Identity Server.

Grant both in the Tenant-wide (administration) context of Roles & permissions. See Roles and permissions.

Note

A backend client never gets administration. administration.read and administration.manage are for signed-in people only. Your backend can still create conversations and add members through the Chat API, and those actions appear in the audit log.

Where it is in the app

Sign in at chat.centralcodestation.com and open a workspace. If your role holds administration.read, an Administration link appears in the top bar next to Chat. The page is titled Chat Administration.

If you open the address without the permission, Chat sends you back to the workspace picker with the message “Chat administration needs an administrator role in the Identity Server.” The same permission is checked again on the server for every request, so hiding the link is a convenience, not the protection.

Under the title, a summary line shows your workspace name, the number of members, how many applications have Chat enabled (for example 2/3) and the number of conversations. People with administration.manage also see a Refresh from Identity Server button.

The tabs

Tab	What it is for
Members	The people Chat knows in your workspace, with their roles and permissions. Members
Roles & permissions	What each role may do in Chat, tenant-wide and inside each application. Roles and permissions
Applications	Your applications and whether Chat is enabled for each. Applications
Conversations	Every conversation of the workspace, with delete. Conversations and moderation
Settings	Message retention. Settings
Audit log	A record of management actions. Audit log

Read and manage

With only administration.read, every tab opens and nothing can be changed: the role checkboxes are disabled, and the Save, Delete and Refresh controls are not shown. A role-permission change sent without administration.manage is refused with missing_capability.

Before it carries out any change, Chat also re-checks at the Identity Server that you still belong to the workspace and still hold the permission. It does not rely on its stored copy for this.

Chat Administration and the Identity Server admin UI

Two places, two jobs.

In the Identity Server admin UI	In Chat Administration
Create roles, including custom roles	Choose what each role may do in Chat
Assign roles to people	See the roles people hold (read-only)
Define the list of Chat permissions	Pick from that list
Switch Chat on or off for an application	See whether Chat is enabled for each application

Chat reads the list of roles and the list of permissions from the Identity Server each time you open Roles & permissions. Add a custom role there and it shows up here.

Related Identity Server task

Create roles and assign them to people: see the Identity Server documentation. To map those roles to Chat permissions, see Grant permissions to roles.

For developers

The same action is available through the API: Tenant overview. These operations need a user token; a machine client never gets administration permissions.