---
title: "Admin Console"
description: "The platform admin console — system health, activity, analytics, Cortex usage, knowledge-base ingestion, and audit export. Reserved for platform super-admins."
version: "en"
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.kliper.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Admin Console

The **Admin Console** gives platform operators a single place to monitor system health, review activity, analyze usage and Cortex behavior, manage the knowledge base, and export the audit trail.

> **Caution**
>
> The full Admin Console is reserved for **platform super-admins** (the `is_super_admin` account flag). Organization Admins get their own **Organization** section of the console — scoped strictly to their org — described [below](#organization-console-for-org-admins). The platform-wide pages stay super-admin only. (The audit-trail **export endpoint** is the one exception that org Admins can use; see below.)

## Layout

The console is a **multi-page sidebar app**, not a single tabbed screen. Opening **`/admin`** redirects to **Overview**, and the left rail navigates between full pages grouped into Organization, General, Access & Security, Platform, and Product. Groups collapse — only **Organization** is open by default — and your arrangement is remembered. A **Back to workspace** link returns you to the main app.

## Overview

The landing page summarizes platform state:

- **KPI strip** — System Status, Security Score (0–100, from email-verification and password coverage), Active Users (last 30 days), and Daily Activity (actions today)
- **System Health** — live status for Database, API Services, File Storage, and Email
- **Recent Alerts** — the latest system notices (or "All clear")
- **Quick Actions:**

| Action | What it does |
|---|---|
| **Database Backup** | Runs an on-demand, gzip-compressed SQL backup (with a progress + completion dialog) |
| **Security Scan** | Runs a platform vulnerability scan and returns a score plus findings by severity |
| **User Management** | Opens the workspace **`/users`** page |
| **System Config** | Opens the configuration page |

## Console pages

| Page | What it shows |
|---|---|
| **Overview** | KPIs, system health, recent alerts, quick actions |
| **Activity** | Platform-wide activity log with human-readable verbs, filters (user, action, resource, date), and per-type stats |
| **Analytics** | Usage trends over 7/30/90 days — daily activity, top features, assessment-status distribution |
| **Security** | Failed logins, suspicious IPs (repeat failures), most-active users, brute-force signals |
| **Logs** | Filterable system logs by severity, date range, and full-text search, with auto-refresh |
| **2FA Management** | 2FA adoption rate and per-user enrollment status |
| **Server Monitor** | Real-time CPU, memory, disk, uptime, and slow-query metrics |
| **Database** | PostgreSQL health — connection status, size, active connections, table stats, slow queries |
| **Advanced** | Deep analytics across User Behavior, Feature Usage, Assessments, Revenue, and Conversion funnels |
| **Cortex AI** | Cortex usage analytics (see below) |
| **Knowledge Base** | Cortex knowledge-base ingestion (see below) |
| **System Config** | Platform feature flags and integration toggles |

## Organization console (for org admins)

Organization Admins see the **Organization** group of the console — the same monitoring surfaces, scoped strictly to their own workspace:

| Page | What it shows |
|---|---|
| **Integrations** | The org's connected integrations |
| **Activity** | The org's activity log — full visibility for admins and managers, own-activity for other roles |
| **Org Analytics** | Usage trends for the org — daily activity, top features, assessment-status distribution |
| **Security** | Failed logins, flagged activity, most-active members, and an audit summary of impersonation sessions, membership changes, and credential & 2FA changes (7-day windows) |
| **2FA Management** | Per-member 2FA enrollment and admin reset actions, scoped to the org's members |

> **Note**
>
> Every metric on the org Security page comes from events Kliper genuinely records — including read-only support (impersonation) sessions, so an org can always see when platform staff accessed their workspace.

## Cortex AI analytics

The **Cortex AI** page reports how the AI assistant is being used over a selectable period (7/30/90 days):

- **Chat** — message volume (user + assistant), conversation count, average session length
- **Safety & moderation** — pass/fail rates and moderation flags by category
- **Autofill** — template-based vs. Cortex-powered completions, plus acceptance and cancellation rates
- **Tokens** — total token usage and an estimated cost
- **Context breakdown** — which surfaces Cortex is used from (Assessment, Calendar, Inbox, General)
- **Recent negative events** — failed requests, timeouts, and safety flags
- **Usage ledger** — every AI call recorded per organization, user, feature, and tool, with token counts (including cached and reasoning tokens), per-tool latency, time-to-first-token, and an estimated cost reconciled against the real provider bill

## Knowledge Base ingestion

The **Knowledge Base** page is where you seed Cortex's retrieval corpus from your firm's past work.

1. **Pick the document type and framework**

   Choose a **document type** (ROC, AOC, Meeting Transcript, or Other) and a **framework version** (PCI DSS 4.0.1, 4.0, or 3.2.1).
2. **Upload**

   Drag in a **PDF or DOCX** (up to 50 MB). Multiple files at once are supported. A **PII Redaction On** indicator confirms that personal data is stripped during ingestion.
3. **Watch it index**

   Each job appears in the indexed-documents table with a status badge — **Pending → Processing → Done** (or **Error**) — and the table auto-refreshes every few seconds while jobs are running.

The stat cards at the top track **documents indexed**, **knowledge chunks**, and **PII items redacted**. Each row shows the source type, framework version, chunk count, PII-redacted count, and uploader, with a delete action per document.

## Audit trail export

Export the full, field-level audit trail as CSV or JSON via the **`/api/admin/audit/export`** endpoint — the canonical answer to "show me every change to assessment X between dates Y and Z."

| Query parameter | Required? | Notes |
|---|---|---|
| `format` | optional | `csv` (default) or `json` |
| `from` | optional | ISO 8601 timestamp. Default: 90 days ago. |
| `to` | optional | ISO 8601 timestamp. Default: now. |
| `action` | optional | Filter to a specific action (e.g., `update`, `delete`) |
| `entity_type` | optional | Filter to a specific entity type (e.g., `assessment_response`) |
| `user_id` | optional | Filter to a specific actor |
| `org_id` | super-admin only | Pin the export to one organization (logged as a cross-tenant override) |

**Behavior and limits:**

- **Access** — usable by a platform super-admin **or** an organization Admin. Org Admins are automatically scoped to their own org's logs; only super-admins can set `org_id` to reach another tenant.
- **Date range** — capped at **365 days**; a longer range is rejected with `400 "Date range exceeds 365 days. Split the request."` (not silently trimmed).
- **Row cap** — 100,000 rows per response. Beyond that, CSV appends a `# WARNING: result truncated` comment and JSON sets `truncated: true` — narrow the range and call again.
- **CSV columns** — `id`, `created_at`, `org_id`, `project_id`, `assessment_id`, `subsection_id`, `pci_requirement`, `user_id`, `user_email`, `user_name`, `action`, `entity_type`, `entity_id`, `field_name`, `old_value`, `new_value`, `ip_address`, `user_agent` (RFC 4180 escaped). The **JSON** format adds a `metadata` field per row plus an export `meta` block.
- Every export is itself written to the activity log.

**Example — a full year of activity as CSV:**

```
https://app.kliper.dev/api/admin/audit/export?format=csv&from=2026-01-01T00:00:00Z&to=2026-12-31T23:59:59Z
```

Open it while signed in with admin access — the file downloads as `audit-YYYY-MM-DD.csv`.

## Version history & rollback

Field-level **version history** for assessment data lives in the **Audit Trail** tab of the **assessment workbench** (not the admin console). For any requirement subsection you can review each version's author, timestamp, action, snapshot, and diff, and **roll back** to an earlier snapshot.

> **Caution**
>
> Rollback replaces the current field values with the selected snapshot. The rollback is itself logged as a new audit entry, but it overwrites any changes made after that version — use it deliberately.

## System configuration

The **System Config** page exposes platform feature flags and integration toggles (e.g. registration, email verification, two-factor enforcement, maintenance mode, and OAuth/billing integration switches). Database, security, and email settings are shown read-only for reference. Configuration changes are restricted to super-admins and recorded in the activity log.

Source: https://docs.kliper.dev/operations/admin-dashboard/index.mdx