Platform admin panel

The platform admin panel shows every organization and account on a deployment, usage against plan limits, recent sign-ups, and suspension. It is for the people who run the instance, not for customers.

Each deployment has its own panel and admin list. A self-hosted admin sees only that instance. On Railhook Cloud (railhook.io) the list is set in the service’s deployment environment and holds no customer account.

Who is a platform admin

A person is a platform admin when all four hold. The server checks them on every admin request:

• Their email address is listed in PLATFORM_ADMIN_EMAILS.
• The address is verified.
• The account is active, not disabled.
• They signed in less than 12 hours ago. After that the panel asks them to sign in again.

An organization OWNER is not a platform admin and gets no access to any other organization.

Caution

List only addresses you control, and make sure each person’s account is protected. The panel shows member addresses of every organization on the deployment.

Turn it on

Nobody is a platform admin until you name someone. The first account to register does not become admin: on a public instance that would be whoever finds the sign-up page first.

Name the admins at install time:

curl -fsSL https://railhook.io/install.sh | bash -s -- --domain hooks.example.com --admin-email ops@example.com

Separate several addresses with commas. The installer refuses anything that is not an email address. For an installation that already exists, run the installer with --refresh --dir <install dir> --admin-email <addresses>, then ./railhook start.

To set or change the list by hand:

1. Sign up or sign in at your Railhook address with the account you want to use, and verify the address.

2. List the address in .env in the install directory, replacing the line that is there or adding one:

   .env

   PLATFORM_ADMIN_EMAILS=ops@example.com,oncall@example.com

   Matching ignores case and surrounding spaces; only whole addresses match.

3. Recreate the API so it reads the new value:

   ./railhook start

   ./railhook restart restarts the containers but does not re-read .env.

4. Sign in again. A Platform admin entry appears at the bottom of the sidebar and opens /admin/platform.

Caution

With email off (the default), registration marks an address verified without sending anything. Register the listed address yourself right after installing, or turn email on, so nobody else claims it first.

On Kubernetes, set the Helm value instead:

values.yaml

platformAdmin:
  emails: "ops@example.com,oncall@example.com"

An empty variable (the default) turns the panel off: nobody sees the entry and the admin API refuses every signed-in user.

What the panel shows

View	What it has
Overview	Organizations, accounts, sign-ups today, in 7 and in 30 days, events today and in 30 days, deliveries succeeded and failed in 24 hours, active tunnels, organizations at 80% or more of their monthly event limit, and the latest sign-ups
Organizations	Name, plan, owner address, created, members, projects, events this month against the plan limit, and status. Search by name or by a member’s address
Organization detail	Members with role, status and sign-in method, projects, usage against the plan, the organization’s recent audit log, and suspend or reinstate
Users	Every account: address, verified, status, sign-in methods, organizations, created and last activity

Platform admins are marked with a Platform admin badge in the Users list and in an organization’s members.

With billing off (the self-hosted default), every organization is on the unlimited Self-Hosted plan and usage reads Unlimited.

The panel never returns password hashes, tokens, API key material, endpoint secrets or payloads. The organization’s audit log is shown without the request bodies it records.

Suspending an organization

Suspending and reinstating are the only changes the panel can make; the rest is read-only.

A suspended organization cannot change anything, event ingestion included, until reinstated. Members can still sign in and read, and see the reason you give. A payment does not lift a suspension.

The panel asks for the organization’s name and a reason, and records your address as the actor.

What is recorded

Admin API requests are limited to 120 per minute per admin. Each is written to the audit log as PLATFORM_ADMIN_ACCESS with the admin, the source address, the organization or account concerned, and the outcome. These rows are kept apart from organizations’ own audit logs. A suspension or reinstatement is also written to the affected organization’s audit log.

The operator token

PLATFORM_ADMIN_TOKEN is a separate credential for scripts, sent in the X-Platform-Admin-Token header. It reaches the same admin API and is the only credential that can rotate encryption keys; a signed-in platform admin cannot. Leave it empty unless you need it. Both variables are in the configuration reference, every admin endpoint in the API reference.