# Administrators

> Invite and remove the team members who sign in to the dashboard. Set each one's role and permissions, limit them to some products and see what each did.

Administrators are the people on your team who sign in to the dashboard. For example: the support person who serves students, or the teacher who looks after their own course. An administrator runs the account. They are not a student and do not take the lessons.

## How it works

The screen is in **Settings > Administrators**. There, you:

- invite each person;
- set their role and permissions;
- follow what they did;
- remove their access, if needed.

To open this screen, you need the **Administrators** permission, in the **Administration** area. No role includes this permission out of the box. In practice, administrators are managed by the **Super Admin**, or by someone they gave that permission to.

### The list

The list shows every administrator on the account except you. Your own page is the **Profile**, in your account menu ([Profile and two-factor authentication](https://help.cademi.cloud/en/conta/perfil.md)).

- Each row shows **Name**, **Email**, **Profile** (the role) and **Last access**.
- The search looks for a name or an email.
- The trash button shows deleted administrators.

Click a row to open the administrator's page. On the left are their identity and the actions: photo, details, password, resending access and deletion. In the center are four sections: **Activity**, **Permissions**, **API keys** and **Two-factor authentication**.

## Roles

Every administrator has a role. A role is a permission template. When you create someone, the role selects what that person can do. Afterwards, you adjust permission by permission.

**The most important rule:** each role's description on screen is only a summary. The lists below show what each template actually selects, with the names used in the **Permissions** section. Before handing over the access, check there what is selected.

### Super Admin

- **Can:** everything, on the whole account, with no permissions to choose. The account owner.
- **Cannot:** no limits.

**Super Admin** has nothing to configure. To limit someone's access, pick another role.

### Admin

**Can:**

- every area: **Content**, **Student area**, **Students** (with **View activity log**), **Sales**, **Support**, **Settings** (with **Appearance**) and **Integration and data**;
- in the **Administration** area, **API keys**: **Read**, **Edit** and **Policies**.

**Cannot:** **Administrators**, **Account billing** and **Taxonomies**.

### Product Admin

**Can:**

- **Products**: **Read**, **Edit**, **Publish** and **View offer**;
- **Modules**, **Lessons**, **Comments** and **Questions**: everything;
- **Exams**: **Read**, **Create**, **Edit**, **Delete** and **View answer key**;
- **Scheduled release** and **Terms of acceptance**;
- **Certificates**: **Edit** and **Preview**.

**Cannot:**

- create or delete products;
- see exam attempts and answers;
- anything outside content: students, enrollments, sales, tickets, student area, settings and integrations.

### Support

**Can:**

- **Students**: everything, with **View personal data**, **Export**, **Send access** and **View activity log**;
- **Enrollments** (with **Manage access**), **Tags**, **Progress** (with **Adjust**), **Score** (**Adjust balance** and **Delete points**), **Gamification** and **Scheduled release**;
- **Certificates**: **Create**, **Edit**, **Delete**, **Reissue** and **Revoke**;
- on exams, **Reopen attempt** and **Delete result**;
- **Tickets**, **Frequently asked questions**, **Comments** and **Questions**: everything;
- **Sale events**: **Read**, **View payload** and **Reprocess**;
- **Imports** and **Exports**;
- read products and custom fields;
- in settings, only **Registration**.

**Cannot:**

- change content (products, modules, lessons, exams);
- change the student area (showcases, banners, menu);
- **Deliveries**, **Gateways** and **Funnels**;
- **Reports**;
- **Webhooks**;
- the other settings and **Custom code**;
- **Administration** and **Account billing**.

### Designer

**Can:**

- **Products**: **Read**, **Create**, **Edit**, **Delete** and **View offer**;
- **Modules** and **Lessons**: everything, with **Publish**;
- **Showcases**, **Banners** and **Menu items**: everything;
- **Custom code**: everything;
- **Terms of acceptance**;
- **Certificates**: **Edit** and **Preview**;
- **General settings**: **Read**, **Edit**, **Appearance**, **Emails** and **Send test email**.

**Cannot:**

- **Publish** products;
- **Exams**;
- the whole **Students**, **Sales** and **Support** areas;
- **Integration and data** (including **Reports**);
- in settings, **Security**, **Registration** and **Support**;
- **Administration** and **Account billing**.

Apart from **Super Admin**, no role comes with the administrator permissions or the account billing permissions.

## Invite an administrator

1. Open **Settings > Administrators**.
2. Click **New administrator**.
3. Fill in **Name**.
4. Fill in **Email**. The email cannot be in use by another active administrator on the account.
5. In **Access level**, choose the role.
6. Click **Save and send password**.

The platform generates a password and emails it to the person. They sign in at the same login address as the students. Next, the new administrator's page opens. If the role is not enough, adjust the permissions there.

**Attention: this is where most mistakes happen.** Use different emails for an administrator and a student. The login form is the same for both, and the platform tries the administrator password first. "Forgot my password" also reaches the administrator. Someone who needs both accesses uses two emails.

## The administrator's page

### Identity and actions

The left column shows:

- the photo (click it to **Change photo**);
- the name, email, document and phone;
- the role;
- the **active** badge, when the person turned on two-factor authentication;
- the timeline, with **Last access** and **Created on**.

| Action | What it does |
|---|---|
| **Edit profile** | The pencil at the top of the card. Opens the form with **Name**, **Email**, **CPF** (Brazilian tax ID), **Phone** and **Description**. The description is the job title, team or a note, and it shows in the list |
| **Change password** | Sets the password you type in **New password** and **Repeat the new password**. The password follows the account's rules ([Authentication](https://help.cademi.cloud/en/configuracoes/autenticacao.md)) |
| **Resend access** | Generates a new password and emails it. The current password stops working. One resend per administrator every 10 minutes |
| **Delete administrator** | The trash icon at the top. The person loses access to the dashboard right away and goes to the trash |

### Restore a deleted administrator

A deleted administrator shows in the list's trash, with the **Deleted** column. Their page becomes read only and shows the date in **Deleted on**. The **Restore** button is on that page. It gives back access with the same details. The exception: if another active administrator already uses the same email, you cannot restore.

### Activity

The **Activity** section is the record of what happened with this administrator. It has two parts:

- **Done by them** (opens first): what they changed in other administrators and in API keys. For example: created, changed details or permissions, deleted, restored, resent access, created or revoked a key.
- **About them**: their sign-ins to the dashboard, password changes and two-factor authentication turned on or off. Also access resent and the changes others made to them.

Each row shows **Date**, **Event** and **IP**. Changes to administrators and API keys are kept for 30 days.

### Permissions

The **Permissions** section has three blocks. You save all three together with **Save now**, in the bar that appears at the bottom when there are changes.

- **Role**. Picking a role loads its permissions into the editor below. It does not save yet. Adjust what you need and save. With **Super Admin**, the editor disappears and the section shows **Full access**.
- **Permissions**. This is the policy: what the administrator can do and where it applies. See below.
- **Preferences**. **Hide Cademi support contact** hides Cademí support (WhatsApp and the dashboard shortcut) for this administrator. It grants and blocks nothing.

How to build the policy:

- In **Where it applies**, choose **Whole account** or **Specific products**.
- Below, the permissions are grouped by area: **Content**, **Student area**, **Students**, **Sales**, **Support**, **Settings**, **Integration and data** and **Administration**.
- Each area lists its resources: products, lessons, students, enrollments, deliveries, tickets, webhooks, administrators and so on.
- Each resource has the **Read**, **Create**, **Edit** and **Delete** columns, and the **Special actions** for that resource. For example: publish, export, send access, view personal data.
- The **Read only**, **All** and **None** shortcuts set a whole area at once.
- An administrator can have more than one policy, each with its own **Where it applies**. **Add another policy** creates the next one. **Start from scratch** clears the editor.

The **Administration** area is marked **Sensitive**. Whoever has these permissions creates and edits administrators and API keys. Give these permissions only to people you fully trust.

Some permissions carry the **Administrators only** badge. An API key never grants them. Only an administrator grants them to another.

### Limit an administrator to some products

Use this for a teacher who looks after only their own course, or for a specialist who should not see the others' content.

**Attention: this is where most mistakes happen.** A **Product Admin** created through **New administrator** starts on the **Whole account**. They see every product until you choose theirs. So do step 2 even for a **Product Admin**.

1. In the **Permissions** section, check the role.
2. Change **Where it applies** to **Specific products**.
3. In **Choose the products**, select the products.
4. Read the notice about permissions that do not belong to a product: students, reports, settings, administrators and keys. Those still apply to the whole account.
5. Clear the permissions in that notice that you do not want to grant.
6. Click **Save now**.

The policy covers the product and everything inside it: modules, lessons, exams, certificates, comments and questions.

With the policy limited:

- the content of other products (modules, lessons, comments, questions) is out of this administrator's reach;
- the enrollments in other products are out of reach too;
- students and reports are not limited by product. If the policy includes them, they apply to the whole account;
- a deleted product that the policy still names shows crossed out and is removed when you save.

### API keys

The **API keys** section lists the keys this administrator created, with **Last used** and **Status**. It opens each key's page. There is no action here: it is only a view.

Keys belong to the account, not to the person. You manage them in **Settings > API keys** ([API keys](https://help.cademi.cloud/en/configuracoes/chaves-de-api.md)). Removing an administrator does not revoke the keys they created. If needed, revoke them there.

### Two-factor authentication

Two-factor authentication asks for a code, besides the password, at every sign-in to the dashboard. It is available to every administrator on the account. Each one turns it on for themselves, in the **Profile** in the account menu, in the **Two-factor authentication** block. There are two methods:

- **Authenticator app**: a code generated by an app, such as Google Authenticator, Authy or 1Password.
- Email: a code sent to the administrator's email at each login.

On each method, **Enable** opens the confirmation. For the app, scan the QR code and type the 6-digit code. For email, type the code you received. **Disable** asks for a current code from that method. The step by step is in [Profile and two-factor authentication](https://help.cademi.cloud/en/conta/perfil.md).

On the administrator's page, the **Two-factor authentication** section shows the state of each of the person's methods:

- **Authenticator app**: **Enabled since** a date, **Setup not finished** (the person started and did not confirm the code) or **Not set up**.
- **Email code**: **Enabled since** a date or **Not set up**.

You do not turn another person's method on or off from here. If an administrator lost the app or access to their email and cannot sign in, the Cademí team does the reset. Contact support.

## Good to know

- **Who cannot be removed.** You cannot remove yourself. The account's last **Super Admin** cannot be removed either. To change the owner, create another Super Admin first.
- **Nobody changes their own permissions.** Ask another administrator with the reach to do it.
- **In the Permissions section, nobody grants more than they have.** The editor only offers the permissions you hold yourself and refuses anything beyond that. If the person you are editing has permissions you lack, the **Permissions** section opens as **Read only**.
- **Two people editing the same permissions.** If someone else saved after you opened the page, the screen warns you and does not save. Reload the page and redo.
- **The list is for people; API keys are something else.** An integration that reaches your account through code uses an API key, with its own permissions. It does not use an administrator.
- **The administrator also enters the clones.** Whoever administers an origin account also enters its clones.

## Frequently asked questions

**The administrator did not receive the email with the password. What do I do?** Check the email on the form (**Edit profile**). Then use **Resend access**. A new password is generated, and the previous one stops working. There is a 10-minute wait between resends.

**How do I make the teacher see only their own course?** Give them the **Product Admin** role. Change **Where it applies** to **Specific products** and choose the product. Comments, questions and lessons from other products are out of their reach.

**How do I hide billing from the team?** Apart from **Super Admin**, no role comes with billing. If someone received those permissions, open that person's **Permissions** section. In the **Settings** area, clear **Account billing**, and also **Invoices** and **Cards**. Only those who have these permissions open **Billing** and **Plan**. A **Super Admin** sees everything and cannot be limited.

**The administrator turned on two-factor authentication and lost their phone. What now?** The Cademí team does the reset of the methods. Contact support and give the administrator's email.

**Can I turn off two-factor authentication for the whole account?** There is no account-wide switch. Each administrator turns their own methods on and off in their profile. Whoever has not turned on any method signs in with email and password only.