User Management & RBAC

The MDM platform implements role-based access control (RBAC) to manage what each user can see and do.

Role Hierarchy

Roles form a hierarchy where higher roles inherit all permissions of lower roles:

Super Admin (Platform Operator)
    └── Owner (Organization Owner)
        └── Admin (Organization Admin)
            └── User (Standard User)
                └── Viewer (Read-Only)

Role Permissions

Viewer

• View device list and status
• View telemetry and GPS data
• View fleet map
• View alert history
• View configuration (read-only)

User

Everything Viewer can do, plus:

• Acknowledge alerts
• Resolve alerts
• Trigger device commands (reboot, sync)
• View configuration profiles

Admin

Everything User can do, plus:

• Create, edit, delete devices
• Create and deploy configuration profiles
• Deploy firmware updates
• Manage alert rules
• Create and manage geofences
• Invite users (up to their own role level)

Owner

Everything Admin can do, plus:

• Manage all users in the organization
• Delete users
• Change user roles
• Modify organization settings
• View billing and usage

Super Admin

Everything Owner can do, plus:

• Access all organizations
• Create/delete organizations
• Assign devices across tenants
• Access operations console
• View platform-wide metrics
• Manage firmware uploads

User Management

Inviting Users

Admins and Owners can invite new users:

1. Navigate to Users → Invite
2. Enter the user’s email address
3. Select a role (cannot exceed your own role)
4. Click Send Invitation
5. User receives an email with a signup link
6. After signup, they’re added to your organization with the assigned role

Editing Users

1. Navigate to Users
2. Click on a user
3. Modify:
   • Display name
   • Role (Owners can change roles)
   • Active/inactive status
4. Click Save

Removing Users

1. Navigate to Users
2. Click the user to remove
3. Click Remove User (requires Owner role)
4. Confirm removal

Note

Removing a user revokes their access immediately. Their historical actions remain in audit logs.

Authentication

Login Methods

Method	Description
Email + Password	Standard login with bcrypt-hashed passwords
API Token	For programmatic access (no browser required)

Password Requirements

• Minimum 8 characters
• Must include uppercase, lowercase, and a number
• Passwords are hashed with bcrypt (10+ rounds)

Session Management

• Sessions use HttpOnly JWT cookies
• Token expiry: 24 hours (configurable)
• Refresh tokens extend sessions without re-login
• Single active session per user (new login invalidates old)

API Tokens

For programmatic access (scripts, integrations):

1. Navigate to Settings → API Tokens
2. Click Generate Token
3. Name the token and select scopes:
   • devices:read — Read device data
   • devices:write — Create/modify devices
   • telemetry:read — Query telemetry
   • config:write — Push configuration
   • firmware:deploy — Deploy updates
4. Set expiration (optional)
5. Copy the token (shown only once)

Token Usage

curl -H "Authorization: Bearer YOUR_TOKEN" \
  https://mdm-api.telisky.com/api/devices

Audit Trail

All user actions are logged:

Event	Logged Data
Login	User, IP, timestamp, success/failure
Device action	User, device, action, result
Config change	User, profile, devices affected
User management	Who changed what for whom
Firmware deploy	User, version, target devices

Access the audit log at Settings → Audit Log (Owner/Admin).