Administration & Operations
The admin surface#
Almost all of Abrq DIP's administration happens in one place: the Settings
area of the web UI, at /settings. The entire area is admin-only — the
route is guarded once at the parent level, so a user without the admin
global role cannot open any tab (see Roles and permissions).
Settings is organised into ten tabs:
| Tab | What it manages |
|---|---|
| Users | Local accounts, global roles, password resets, deactivation — see User management |
| API Tokens | Your own bearer tokens for programmatic access — see API tokens |
| Audit Log | The append-only, hash-chained audit trail — see Audit |
| Authentication | SSO (OIDC) and LDAP / Active Directory providers — see Authentication providers |
| AI Models | Customer-managed AI providers for the DW Generator — see AI model providers |
| Notifications | Deployment-wide SMTP transport and the license-alert channel — see Notifications |
| Audit Forwarder | SIEM forwarding of audit events (syslog / webhook) |
| Data Masking | Column-level masking policies — see Data masking |
| Retention | Dataset retention policies with dry-run and confirm-gated execute — see Retention |
| License & Backup | Read-only license view, log-retention windows, manual and scheduled metadata backup — see Backup and restore |
A handful of operational tasks live outside the UI, as scripts run inside the backend container — see Admin scripts.
Operational duties map#
| Duty | Where to do it | Documentation |
|---|---|---|
| Create, disable, or reset a user | Settings → Users | User management |
| Issue or revoke an API token | Settings → API Tokens | API tokens |
| Connect SSO or LDAP | Settings → Authentication | Authentication providers |
| Configure an AI provider | Settings → AI Models | AI model providers |
| Mask a sensitive column | Settings → Data Masking | Data masking |
| Back up or restore metadata | Settings → License & Backup, or the CLI | Backup and restore |
| Check platform health, scrape metrics, collect logs | GET /health, GET /metrics, container stdout |
Monitoring |
| Rotate the master encryption key | CLI script | Admin scripts, Secrets and encryption |
| Verify audit-log integrity | Settings → Audit Log, admin API, or CLI | Admin scripts, Audit |
| Review who did what | Settings → Audit Log | Audit |
| Check or renew the license | Settings → License & Backup | Licensing |
| Change log retention windows | Environment variables (read-only in the UI) | Environment variables |
| Upgrade or roll back the platform | Deployment tooling | Upgrade and rollback |
Note. Every mutation on the admin surface is written to the audit log — user changes, provider changes, masking policies, backups, and restores all leave an attributable trail. See Audit.