Platform admin panel

Use this page to open the platform admin panel on your deployment: every organization and account in one place, usage against plan limits, recent sign-ups, and suspension. It is for the people who run the instance, not for your customers.

Each deployment has its own panel and its own list of admins. A platform admin of your self-hosted instance sees only the organizations and accounts on that instance; on Railhook Cloud (railhook.io) the list belongs to the people who operate the service and is set in its deployment environment, and no customer account is ever on it.

Who is a platform admin

A person is a platform admin when all four of these hold, checked on the server for every admin request:

• Their email address is listed in PLATFORM_ADMIN_EMAILS.
• The address is verified.
• The account is active, not disabled.
• They signed in less than 12 hours ago. After that the panel asks them to sign in again.

An organization OWNER is not a platform admin. Owning an organization gives no access to any other organization, however the role is used.

Caution

List only addresses you control, and make sure each person’s account is protected. The panel shows member addresses of every organization on the deployment.

Turn it on

Nobody is a platform admin until you name someone. There is no “first account to register becomes the admin”: on a public instance that would be whoever finds the sign-up page first.

The quickest way is to name the admins when you install:

curl -fsSL https://railhook.io/install.sh | bash -s -- --domain hooks.example.com --admin-email ops@example.com

Several addresses are separated by commas. The installer refuses anything that is not an email address. For an installation that already exists, run the installer with --refresh --dir <install dir> --admin-email <addresses>, then ./railhook start.

To set or change the list by hand:

1. Sign up or sign in at your Railhook address with the account you want to use, and verify the address.

2. List the address with the helper, which writes it to .env without printing it back:

   printf 'PLATFORM_ADMIN_EMAILS=ops@example.com,oncall@example.com\n' | ./railhook settings

   Addresses are compared without regard to case or surrounding spaces, and only whole addresses match.

3. Recreate the API so it reads the new value:

   ./railhook start

   ./railhook restart restarts the containers but does not re-read .env.

4. Sign in again. A Platform admin entry appears at the bottom of the sidebar and opens /admin/platform.

Caution

With email turned off, which is the default, registration marks an address verified without sending anything to it. Register the listed address yourself straight after installing, or turn email on, so nobody else can claim it first.

On Kubernetes, set the Helm value instead:

values.yaml

platformAdmin:
  emails: "ops@example.com,oncall@example.com"

Leaving the variable empty, which is the default, turns the panel off: nobody sees the entry and the admin API refuses every signed-in user.

What the panel shows

View	What it has
Overview	Organizations, accounts, sign-ups today, in 7 and in 30 days, events today and in 30 days, deliveries succeeded and failed in 24 hours, active tunnels, organizations at 80% or more of their monthly event limit, and the latest sign-ups
Organizations	Name, plan, owner address, created, members, projects, events this month against the plan limit, and status. Search by name or by a member’s address
Organization detail	Members with role, status and sign-in method, projects, usage against the plan, the organization’s recent audit log, and suspend or reinstate
Users	Every account: address, verified, status, sign-in methods, organizations, created and last activity

Platform admins are marked with a Platform admin badge in the Users list and in an organization’s members.

With billing turned off, which is the default on a self-hosted install, every organization is on the unlimited Self-Hosted plan and usage reads Unlimited instead of a limit.

The panel never returns password hashes, tokens, API key material, endpoint secrets or payloads. The organization’s audit log is shown without the request bodies it records.

Suspending an organization

Suspending and reinstating are the only changes the panel can make; everything else in it is read-only.

Suspending stops an organization changing anything, event ingestion included, until it is reinstated. Its members can still sign in and read, and are shown the reason you give. A payment does not lift a suspension.

The panel asks you to type the organization’s name and a reason before it suspends or reinstates. The suspension records your own address as the person who did it.

What is recorded

Every request to the admin API is rate-limited to 120 per minute per admin, and written to the audit log as PLATFORM_ADMIN_ACCESS with the admin, the address the request came from, the organization or account it concerned, and the outcome. These rows are kept apart from every organization’s own audit log. A suspension or reinstatement is also written to the audit log of the organization it affected.

The operator token

PLATFORM_ADMIN_TOKEN is a separate credential for scripts, sent in the X-Platform-Admin-Token header. It reaches the same admin API, and it is the only credential that can rotate encryption keys: a signed-in platform admin cannot. Leave it empty unless you need it. Both variables are described in the configuration reference, and every admin endpoint in the API reference.

Next steps

ConfigurationEvery environment variable, including both platform admin settings.

Organizations and rolesWhat organization members can do, and how tenants are kept apart.

MonitoringHealth checks, metrics and alerts for the deployment itself.