Appearance
System, platform and sub-tenants
Settings, administrators and roles, the controllers and the audit trail; tenants, the licence and this documentation; and the sub-tenants a tenant can carve itself into.
Nearly every page below is permission-gated. If a colleague cannot see one, that is their role rather than a fault — Roles is where to look.
System
Settings
/admin/system/settings
The tenant's settings hub — general, prefix, mail server, cron and consent-policy tabs, plus the Organisation, Storage Usage, A.I Model and MCP Connections cards, each card gated by its own permission.
When you would open it. Configuring anything tenant-wide that doesn't have its own dedicated page: account/voucher prefixes, the cron schedule, the tenant's AI provider and model, which MCP servers it exposes, its consent jurisdiction, or its organisation profile and logo.
Before it has anything on it. At least one of the settings permissions this page checks (general, prefix, server or cron), view/edit-organisation, or manage-consent-settings — an admin holding none of them gets a 403 instead of an empty page of cards. The SMTP card is managed by Synchroweb and is not shown to tenant admins.
Cron Timing card: only Profile Reset (daily, weekly, monthly, yearly) and Account Policy times, in local time; the other Kiwire 3 cron fields are gone. A.I Model card: shows which credential this tenant is using (its own key if one is saved, otherwise the platform key), lets the tenant supply its own key, and is also where KAIA is switched on, since KAIA runs on whatever model is configured here. MCP Connections card: per-server on/off switches and key scope for the MCP servers this tenant exposes.
Needs any of manage-settings-general, view-organisation.
Administrators
/admin/system/admins
Tenant admin user management — create, edit, deactivate and reset MFA for the accounts that can log into this tenant's own admin panel, each carrying a role.
When you would open it. Onboarding a new staff member, revoking access when someone leaves, or resetting an admin's MFA when they lose their device.
Before it has anything on it. view-admins permission, and at least one role already set up on Roles to assign — Role is required on the form, so a new admin always has one. An admin is left with no role — and so no permissions — only when they are removed from a role on the Roles page; pick a new role for them here.
You can only hand out what you hold: the Role picker refuses a role holding any permission your own role lacks, and an admin whose current role holds permissions you lack is out of reach — you can't save an edit to them, deactivate, delete, reset their MFA or relaunch their Setup guide. A Manager therefore can't create an Admin or touch one. The same rules apply through the API: an API key acts with its owner's permissions, and stops working when its owner is deactivated or deleted. Setup guide: Edit shows whether the admin has started or completed it, and Relaunch (edit-admins) gives them the Quick Setup guide again at their next sign-in. Bypass Setup Guide (on Create or Edit) skips it for someone who won't set up the network; if Synchroweb has switched off the guide for new admins of the tenant, nobody gets it until it is relaunched.
Needs the view-admins permission.
Roles
/admin/system/roles
Role and permission management — create roles and toggle which of the tenant's currently-licensed permissions each one carries, laid out as a catalog grouped by module.
When you would open it. Setting up a role for a new type of admin (front-desk vs IT, for example), or auditing exactly what a given role can do right now.
Before it has anything on it. view-roles to see the page; an admin can only ever grant permissions they hold themselves, so what they can hand out is never more than their own role carries. The same rule applies to Assigned Admins: Add Admin refuses a role you couldn't grant, and you can't add or remove someone whose current role holds permissions you lack.
Licence-synced, not a bug: the licence sync deletes any permission that isn't covered by the tenant's current licence, cascading through every role that held it — including custom roles. A role that suddenly can't do something it could do yesterday is very often an add-on cancelling or a plan changing, not something broken on this page. Check System › License before assuming a role got corrupted.
Needs the view-roles permission.
Device Controller
/admin/device/device-controller
The network controllers configured on this tenant — the RADIUS clients and gateways whose guests Kiwire authenticates and accounts for.
When you would open it. Onboarding a new site's hardware, checking when Kiwire last heard from a controller, or removing one that's been decommissioned.
Before it has anything on it. Nothing to show the (possibly empty) list itself; adding another needs a free slot under the tenant's licence device quota. What to configure on the controller's own side is vendor-specific — that detail lives on the reference page below, not on this form.
Site Provisioning: select a MikroTik, FortiGate (FortiAP site) or UniFi (UBNT Console; not the Ubiquiti Controller type) controller and click Site Provisioning in the toolbar to have Kiwire set up the equipment — a command or script to paste in, or on UniFi the settings applied straight to the site with a preview and Revert; needs edit-devices. See The quick way: Site Provisioning. Bulk onboarding: Import takes a CSV of controllers (identity, vendor key, shared secret, plus optional address, CoA port, availability and more) for bringing in an existing estate in one pass; see Importing controllers from a spreadsheet. Last heard from: the list and each controller's panel show when Kiwire last heard from it — Active, Idle, Silent or No activity yet — from RADIUS, guest redirects, WiFiDog pings and the UniFi API, since Kiwire runs in the cloud and does not ping devices; see Is the controller talking to Kiwire?. Availability: each controller's edit form can switch its Wi-Fi off (everyone online on it is disconnected) or set opening hours; see Switching Wi-Fi off and opening hours.
Needs the view-devices permission.
Audit Trail
/admin/monitoring/audit-trail
A month-by-month log of admin actions across almost every module on the tenant — who changed what, old value to new value, and when — read from a set of monthly rotated audit tables.
When you would open it. Tracing who made a specific change (an edited profile, a deleted voucher, a role that lost a permission) and when, including telling a licence-driven change apart from something an admin actually did.
Before it has anything on it. view-audit-trail permission. Only months that already have a table populated are offered in the month selector, though the current month is always included even before anything has been written to it.
Needs the view-audit-trail permission.
Platform
License & Plans
/admin/system/license
This tenant's licence and subscription page — the decoded licence (plan, expiry, included modules), an expiry warning as the date approaches, active add-ons with their cancellation dates, and the actions to subscribe, renew, add or cancel an add-on, or re-sync.
When you would open it. Renewing or upgrading the plan before or after it lapses, adding or cancelling an add-on like Passpoint, or re-syncing the licence key after a plan/add-on change so the permissions it unlocks actually land on Roles.
Before it has anything on it. view-license to see the page, manage-license to act on it, and a licence key on file to decode. Subscribing or renewing goes through a hosted Curlec/Razorpay checkout.
Needs the view-license permission.
Documentation
/documentation (opens in a new tab)
This page. It redirects straight through to the documentation site.
When you would open it. Only ever reached by following the "Documentation" menu link — there is nothing to configure here.
Subtenant
Subtenant List
/admin/subtenant/subtenants
Sub-tenants — named groups inside this tenant (for example one per branch, franchise or reseller) that guest accounts and controllers can be assigned to. They are labels for grouping and record-keeping, not separate tenants: every admin still signs in to the tenant itself.
When you would open it. Creating the list of branches or resellers so their guest accounts (Subtenant Users) and controllers (Controller Assignment) can be told apart, and giving each one a shared data pool. Data Pool Monthly Quota (MB) is shared by all the sub-tenant's accounts: their usage is added up, and once the pool is used up they are moved to the Advance Profile, or — with none set — disconnected and refused at sign-in until the pool resets. 0 means no limit. The pool goes back to zero on the Reset Quota day (the last day in shorter months). Under Send email when, Reach Threshold emails the listed addresses and the chosen tenant role once usage passes Threshold (%), and Reach Pool Total Bandwidth emails the chosen role when the pool is used up — each once per cycle, through the tenant's email connector. Checks run every 15 minutes, so an account can go slightly past the pool before it is moved or cut off. Two-factor sign-in and the top-up email are not offered: sub-tenants have no sign-in of their own.
Before it has anything on it. The Subtenants licence module (view-subtenants and friends). The form requires a pool total (0 for no limit), a reset day and a threshold. Notification emails need an email connector on the tenant.
Needs the view-subtenants permission.
Administrator
/admin/subtenant/subtenant-admins
Sub-tenant administrator accounts. This page is switched off on Kiwire and does not appear in the menu: sub-tenant administrators have no way to sign in, so the page is not offered.
When you would open it. Nothing today. To give someone access, add them as an ordinary administrator on System › Administrators with a role that has only the permissions they need.
Before it has anything on it. Not available — switched off for every tenant.
Needs the view-subtenant-admins permission. Not available: switched off across the whole platform, so the page is not in the menu.
Role
/admin/subtenant/subtenant-roles
Roles for sub-tenant administrators. This page is switched off on Kiwire and does not appear in the menu, because sub-tenant administrators cannot sign in.
When you would open it. Nothing today. Limit what an admin can do with a role on System › Roles instead.
Before it has anything on it. Not available — switched off for every tenant.
Needs the view-subtenant-roles permission. Not available: switched off across the whole platform, so the page is not in the menu.
Subtenant Users
/admin/subtenant/subtenant-users
Guest/user accounts tagged with a sub-tenant — the same kind of account as Account › Users, with the sub-tenant they belong to. The account's own profile limits apply as usual, and its usage also counts against the sub-tenant's shared data pool.
When you would open it. Creating or managing guest accounts that belong to one branch or reseller, so they can be listed and found by sub-tenant.
Before it has anything on it. view-subtenant-users permission, at least one sub-tenant and one active profile, and — if zones are in use — a zone to offer on the creation form.
Needs the view-subtenant-users permission.
Controller Assignment
/admin/subtenant/subtenant-controllers
Which network controllers belong to which sub-tenant — an assignment list plus a stats panel showing total controllers, how many are assigned, and how many sub-tenants have none.
When you would open it. Recording which branch or reseller owns each controller. The assignment is a record only — it does not filter any page, report or guest login.
Before it has anything on it. view-subtenants permission (this page shares that gate rather than having its own), and at least one sub-tenant and one controller already on the tenant to have anything to assign.
Needs the view-subtenants permission.
This list is read from the admin menu itself, so it cannot fall behind it.