System

Admin Users

Admin Users manages the administrator accounts that can log in to the Kiwire admin panel. Each admin has a role that determines which modules and actions they can access.

'alt' => 'Dashboard overview', 'caption' => 'The default Kiwire dashboard layout', 'screenshot' => true, 'class' => '', ]) Drop images into: public/assets/img/docs/{page}/{filename} --}}

Image not uploaded yet public/assets/img/docs/admins/overview.png

Admin Users — list of admin accounts with role, status, and last login information.

Admin Fields

Field	Description
`name`	The admin's display name shown in the header and audit trail.
`email`	Login email address. Also used for password resets and security alert emails.
`username`	Optional username for login. When set, the admin can log in with either email or username.
`role`	The assigned role that controls which permissions this admin has.
`is_active`	Active/inactive toggle. Inactive accounts are blocked from login immediately — no logout grace period.
`last_login_at`	Timestamp of the most recent successful login.
`mfa_enabled`	Whether this admin has completed MFA enrolment. Shown as a badge in the grid.
`tenant_id`	Which tenant this admin belongs to. Superuser admins are flagged as system-level accounts.

Actions

Create Admin

Open the side panel with Add Admin. Set the name, email address, and role. Optionally set an initial password, or leave it blank to send an invitation email with a password-setup link. The admin must complete MFA enrolment on first login if Force MFA is enabled.

Edit Admin

Update the admin's name, email, username, or role. Role changes take effect immediately on the admin's next request — they do not need to log out.

Deactivate Admin

Toggling is_active to off blocks the account immediately. The active flag is enforced on every request, so an admin who is currently logged in will be force-logged out within seconds of deactivation.

Reset Password

Sends a password reset email to the admin's address. The link is valid for 60 minutes. The admin must set a new password before the link expires.

Reset MFA

Clears the admin's MFA enrolment. On their next login, they will be redirected to the MFA setup page to scan a new QR code. Use this when an admin has lost access to their authenticator app.

Role Assignment

Select from any role defined in the Roles & Permissions module. Built-in roles are:

Superuser — full system access including tenant management (assigned only by another superuser)
Admin — full access to the tenant
Manager — operational access; cannot change system configuration
Viewer — read-only access to all modules

Custom roles created in the Roles module are also listed.

Superuser Admins

Superuser accounts bypass all RBAC permission checks and have access to the Tenants module for managing all tenant accounts. Superuser logins are separately logged to the system audit trail and trigger a security alert email.

Admins cannot deactivate their own account or lower their own role. This prevents accidental self-lockout. A second superuser or an admin with higher privileges must make those changes.

Deactivating an admin does not delete their audit records. All past actions remain in the audit trail with the admin's ID for compliance purposes.

Required Permissions

view-admins · create-admins · update-admins · delete-admins