Add an operator#

You will end up with an account for one person, with one role, whose password they must change at their first sign-in. Give every person their own: the audit log records who did what, and it can only do that when "who" is a person rather than a shared admin.

Before you start#

The Admin role. The Admin group of the navigation is shown to administrators only.
The person's name, and a decision about their role.

No licence is needed: accounts belong to the agent, not to the router's configuration.

Step 1 — Choose the role#

Pick the lowest one that lets them do their job. The Users page shows each role with what it allows.

Role	The Users page says	Give it to
Viewer	"Sees everything. Changes nothing."	Anyone who needs to see the router but not change it
Approver	"Applies, keeps and reverts changes others have prepared, and restores earlier configurations. Cannot prepare changes, and does not see the secrets in them."	The person who reviews a change somebody else prepared and applies it
Operator	"Prepares and applies changes, and restores earlier configurations."	Anyone who changes the router's configuration
Admin	"Everything an operator can do, and manages users, API tokens and settings."	Anyone who manages accounts, tokens, agent settings, the licence, backups, restarts or system images

A role can be changed later on the same page, so there is no reason to start anyone above the role they need now.

Step 2 — Add the account#

Admin → Users → Add user. The panel says "They change the password at their first sign-in."

Field	Takes
Username	Letters, digits, dots, hyphens and underscores, up to 64 characters.
Initial password	Any password up to 1024 characters. There is no minimum length and no character rule.
Role	One of the four. The role's description appears under the list.

Add user creates the account at once — accounts are not pending changes — and the page says "User added".

The agent refuses a name that already exists, and the name admin-token and names beginning token:, which are what the break-glass token and API tokens appear as in the audit log. A refusal appears as "Could not add the user" with the agent's reason.

What protects the sign-in is the rate limiting and, when it is on, two-factor authentication — not the password's length.

Step 3 — Hand over the password out of band#

Not in the same message as the router's address.

Check it worked#

They can sign in, and the first thing they see is Set your password: the account reaches nothing else until they choose their own. Until then the Password column of the Users table shows Must change.

The audit log has the creation, attributed to you: System → Audit log tab shows "Added a user", with "jo (operator)" beneath it.

Changing a role, or resetting a password#

Admin → Users, then the person's row. The panel has:

Role — the new role's description, and a note of what the change gives or takes away, such as "jo will no longer be able to apply changes or restore earlier configurations."
Password — New password: "Leave empty to keep the current password. They change it at their next sign-in."

Save changes takes effect at once and signs out every session the account has open: "Their sessions were signed out." The agent refuses to change the role of the only Admin; promote another first.

Your own password is changed on the Account page, not here.

Clearing somebody's second factor#

The lost phone, when their recovery codes are gone too. Admin → Users, their row, Two-factor authentication → Clear two-factor authentication. The button then asks "Clear jo’s two-factor authentication?" and needs a second click.

It deletes the authenticator secret and every recovery code the account holds, and signs out its open sessions. The audit log records it as "Cleared a user’s two-factor authentication", with you as Who and their name beneath the action. They then sign in with their password alone and enrol a new device.

Three things it deliberately will not do:

Your own account. The panel offers no button for it, and says to turn your own off on the Account page. Do that if you still have your authenticator; ask another admin if you do not. Clearing your own here would be a way round the enrolment the router asks of you.
An account with nothing to clear. The panel says the person "has not set up two-factor authentication" instead of offering the button.
Turn off Require two-factor authentication. With that setting on, the account is asked to set up two-factor again at its next sign-in and can reach nothing else until it finishes. An admin restoring one person's access cannot quietly drop the requirement for everybody to do it.

When every admin has lost their phone at once, an admin API token or the break-glass token can clear a second factor through the API, and at the console wheelhouse-rescue totp --user jo does the same — Locked out of the UI.

Removing an account#

Admin → Users, their row, Delete user, which asks "Delete jo?". It signs out their sessions. You cannot delete the account you are signed in as, and the only Admin cannot be deleted until there is another.

Do this when someone leaves. Also revoke any API tokens they issued — a token carries its own role and outlives the account that issued it.

For automation#

The same actions through the API, with an admin token:

bash

R=https://<router>:8443
T=wh_...                                    # an admin token

# Add an account
curl -sk -X POST -H "Authorization: Bearer $T" -H 'Content-Type: application/json' \
  -d '{"name":"jo","role":"operator","password":"a passphrase they will change"}' \
  "$R/api/admin/users"

# Change the role, or set a new password
curl -sk -X PATCH -H "Authorization: Bearer $T" -H 'Content-Type: application/json' \
  -d '{"role":"viewer"}' "$R/api/admin/users/jo"

# Clear the second factor
curl -sk -X POST -H "Authorization: Bearer $T" "$R/api/admin/users/jo/totp/clear"

# Delete the account
curl -sk -X DELETE -H "Authorization: Bearer $T" "$R/api/admin/users/jo"

PATCH takes role, password, oidc_subject and email; the Users page edits the first three. A refusal carries the reason the page would show — 409 for a name that already exists, or for a change that would leave no Admin.