Skip to main content

Manage users and roles

Admin

This guide covers creating and managing users, the built-in role levels, and custom roles.

The role model​

Ticketra ships with three built-in roles and supports custom roles with granular permissions.

RoleTypical useCan manage users?
SUPER_ADMINPlatform ownerYes — sole user manager
ADMINTeam lead / operational adminNo
USERAnalystNo
Only SUPER_ADMIN manages users

There is no self-registration in Ticketra. The SUPER_ADMIN is the only role that can create, disable, or reset users. This is a deliberate security decision.

Create a user​

  1. Sign in as a SUPER_ADMIN.
  2. Go to Admin → Users and choose New User.
  3. Set the username, initial role, and (for local accounts) a temporary password.
  4. Save. The new user will be required to change their password on first login.

Case edit permissions​

Understanding who can edit a case is important:

  • SUPER_ADMIN and ADMIN can edit any case within their tenant scope.
  • A USER can edit a case only if they created it OR are assigned to it.

This rule is enforced on both the backend and the frontend.

Reassigning a case

If you reassign a case to a USER, that user gains edit rights as the assignee even though they didn't create it.

Custom roles​

Beyond the three built-ins, you can define custom roles with a tailored set of permissions (for example, a read-only auditor or a CTI-only operator).

  1. Go to Admin → Roles.
  2. Create a role, give it a name, and select its permissions.
  3. Assign the role to users like any built-in role.

Permissions are evaluated dynamically — changing a role updates the access of everyone assigned to it.

Reset a password or disable a user​

From Admin → Users, a SUPER_ADMIN can:

  • Reset password — forces a password change on next login.
  • Disable — soft-disables the account (the user can no longer authenticate); sessions are revoked.
Last Super Admin protection

Ticketra prevents reassigning or disabling the last active SUPER_ADMIN, so you can never lock yourself out of user management.

Sessions​

Sessions are JWT-backed with an 8-hour default TTL. A SUPER_ADMIN revoking a user's sessions takes effect immediately — including disconnecting any live real-time (SSE) streams.