Users

On the CYPEX side, users and roles are mapped to “login names”. This is done in the Users section of the admin panel:

Users

Active users, Pending SSO, and Rejected SSO tabs. Each row shows the PostgreSQL role, language, active state, and organization membership; use Select organization to filter by tenant.

Info

SSO-specific tabs (Pending SSO, Rejected SSO) and provider configuration are covered in their own section — see SSO Providers for provider setup, and Pending and rejected users for the full state diagram, admin approve/reject/un-reject actions, and audit trail behind these two tabs.

Also note that users are mapped to a database role. This is important, since the database role is what controls access to data — both what a user can do (capabilities) and, since v2.0.0, which organizations they can access. The login name (= email) is merely intended to handle CYPEX logins; permissions to data are managed on the lowest possible level (= PostgreSQL) to ensure consistency between the API, the app, and direct database access.

Users are listed in a table: the email address used to log in, the underlying username, the PostgreSQL role, the default language, whether the account is active, and how many organizations the user can access. Click the Organizations count on a row for the membership detail:

Organization Memberships

A user's organization memberships, including join date and status, come from the mappings of their PostgreSQL role.

Click Create to open the user wizard. Creating a user is a three-step process — the PostgreSQL role chosen in Step 2 determines both what the user can do (capabilities) and which organizations they can access:

Create User

Step 1 — User identity (email, username, password, language). Step 2 — PostgreSQL Role. Step 3 — Organizations, derived from that role.

Once a role is selected, CYPEX shows its capabilities and the organizations it is mapped to — the new user will automatically have access to those organizations, no further step needed:

Role-derived organization access

Selecting smi_org_admin shows its capabilities (cypex_user) and the organization(s) it is mapped to (smi) — filled in automatically for Step 3.

Users are available instantly — there is no synchronization of any sort needed to make this work.

Click the pencil icon on a row to edit an existing user. The Edit User page mirrors the create wizard with three tabs — Basic Information, Organizations, and User Details:

Edit User — Basic Information

Change the PostgreSQL role, set a new password, or toggle Account Status (active/inactive).

The Organizations tab explains where the user’s data access comes from and links directly to the role’s mappings:

Edit User — Organizations

Access is determined by the user's PostgreSQL role and its role → organization mappings. Manage role mappings jumps to the Roles page to change them.

User Details gives a read-only summary of the account — ID, email, username, role, language, status, and organization membership:

Edit User — User Details

A consolidated read-only view, useful for support and audit conversations.

You can change the password and quickly set the user as active / inactive from the Basic Information tab.

• Roles & Capabilities — assign capabilities to a role, and map roles to organizations.
• Organizations — the admin-panel entry point for multi-tenancy.
• Organizations setup guide — assign users to orgs.
• Access Preview — see what a user can do without logging in as them.
• SSO Providers — provider setup.
• Pending and rejected users — the SSO user state diagram, admin actions, and audit trail behind the Pending SSO / Rejected SSO tabs.