Enterprise

# Users

> Register users, give each one a role, and remove them. Includes the permissions of each role.

Each person who uses a Synnax Core logs in as a user. Each user holds one role, and the role sets what the user can see and change. Only users with the **Owner** role can register, change, or delete users.

Owners manage users in the **Users** toolbar. To open it, click in the left navigation bar, or press **U**. Synnax Desktop has one user and no **Users** toolbar.

## Register a user

1. Run the “Register user” command, or click in the **Users** toolbar.
2. Enter the **First** name, **Last** name, **Username**, and **Password**.
3. Select a **Role**.
4. Click **Register**.

Give the username and password to the person. They can log in at once.

[](https://synnax.nyc3.cdn.digitaloceanspaces.com/docs/console/users/register/8f833b8d066f-dark.mp4#t=0.001)

## Change a role

1. In the **Users** toolbar, right-click the user and select **Change role**.
2. Select a **Role**, then click **Assign**.

The new role replaces the user’s role. You cannot change your own role or the role of the root user.

[](https://synnax.nyc3.cdn.digitaloceanspaces.com/docs/console/users/modal-change-role/c2f06f5112bf-dark.mp4#t=0.001)

## Change a username

In the **Users** toolbar, right-click the user and select **Change username**. You cannot change your own username.

## Delete users

1. In the **Users** toolbar, select one or more users.
2. Right-click and select **Delete**, then click **Delete** to confirm.

The root user cannot be deleted. Deleting a user ends all of that user’s sessions at once.

## Change a password

The Console has no password setting. A user can change their own password with the TypeScript client:

```typescript
await client.auth.changePassword("new-password");
```

A password change ends the user’s other sessions. The session that changed the password stays open. A password cannot be empty, and it has no maximum length.

An Owner cannot set the password of another user. To reset a forgotten password, delete the user and register them again.

## Manage users from code

Create a user with a role:

[Enterprise](https://docs.synnaxlabs.com/reference/get-started/editions "Needs Synnax Enterprise")

**Python**

```python
engineer = next(r for r in client.access.roles.retrieve() if r.name == "Engineer")
user = client.users.create(
    username="jdoe", password="secret", name="Jane Doe", role=engineer.key
)
```

**TypeScript**

```typescript
const roles = await client.access.roles.retrieve({});
const engineer = roles.find((r) => r.name === "Engineer");
const user = await client.users.create({
  username: "jdoe",
  password: "secret",
  name: "Jane Doe",
  role: engineer.key,
});
```

To give users a different role, call `client.users.set_role(keys, role)` in Python or `client.users.setRole(keys, role)` in TypeScript. The new role replaces the role of each user. To delete users, call `client.users.delete` with their keys.

You cannot delete a role that a user holds. First give its users a different role.

## The root user

A Core starts with one root user, `synnax` with the password `seldon` by default. The root user always has the **Owner** role. At each start, the Core:

* Creates the root user from `--username` and `--password` if no user has that username. If a user has it, the Core makes that user the root user with the **Owner** role.
* Sets the root password back to `--password`. A changed root password lasts only until the next start.

When you start the Core with a different `--username`, the previous root user stops being root but keeps the **Owner** role and its password. To remove it, delete it.

> Do not change the username of the root user. At the next start, the Core creates a new root user, and the renamed user keeps the **Owner** role.

To change the root password for good, or to recover a forgotten one, restart the Core with a new `--password`. See the [CLI reference](https://docs.synnaxlabs.com/reference/enterprise/cli-reference#start).

## Roles

A Core has five roles. **All** means create, read, change, and delete.

| Resources                                     | Owner | Engineer | Operator | Driver          | Viewer |
| --------------------------------------------- | ----- | -------- | -------- | --------------- | ------ |
| Channels                                      | All   | All      | Read     | Read            | Read   |
| Ranges                                        | All   | All      | All      | All             | Read   |
| Live data                                     | All   | All      | All      | Read and write  | Read   |
| Drivers                                       | All   | All      | Read     | Read and change | Read   |
| Devices, tasks, Arc automations, and statuses | All   | All      | Read     | All             | Read   |
| Projects, visualizations, labels, and aliases | All   | All      | Read     | None            | Read   |
| Users and roles                               | All   | Read     | Read     | None            | Read   |

* **Owner** -> runs the deployment and manages users.
* **Engineer** -> sets up channels, hardware, automations, and visualizations.
* **Operator** -> runs tests: writes live data to control hardware, and edits ranges. An Operator cannot create visualizations.
* **Driver** -> given to each rack, so a Driver logs in as its rack. It can change its rack, but cannot create or delete racks.
* **Viewer** -> sees everything and changes nothing.

An upgrade from v0.60 or earlier gives each user that held no role a new **No access** role, which grants no permissions. A user that held several roles keeps the one that grants the most access.