> ## Documentation Index
> Fetch the complete documentation index at: https://docs.quixa.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Roles, Sessions and Audit

> Who can read, run and change what in a Quixa workspace, how sessions and two-factor sign-in work, and what the audit log records.

# Roles, Sessions and Audit

## Roles

Every user has one role per workspace (tenant). Roles are enforced by the API on every request.

| Role | Read flows, collections, results | Build and change flows | Run flows and suites | Change credentials (auth schemes) | Users, SSO, security settings, audit log |
| :- | :-: | :-: | :-: | :-: | :-: |
| Viewer | ✔ | — | — | — | — |
| Tester | ✔ | ✔ | ✔ | — (may use and test them) | — |
| Developer / Member | ✔ | ✔ | ✔ | ✔ | — |
| Admin | ✔ | ✔ | ✔ | ✔ | ✔ (own workspace) |
| PlatformAdmin | ✔ | ✔ | ✔ | ✔ | ✔ (all workspaces) |

* Credential values are never shown back: the API returns `••••••••` for every stored secret, also to administrators. Flows use them on the server.
* Every workspace sees only its own data; there is no cross-workspace access except for platform administrators.
* Roles can come from Active Directory groups or Entra ID app roles (see [Enterprise SSO](https://docs.quixa.io/security/enterprise-sso.md)).

## Sessions

* Access tokens are valid for 15 minutes and are refreshed automatically while the browser tab is open.
* A session ends after 60 minutes without activity, 12 hours after sign-in, on sign-out, or when it is revoked.
* Sessions are revoked automatically when the password is changed or reset, the role changes, or the account is deactivated, rejected or deleted.
* Users see and end their own sessions in **Security & Audit**; administrators can end all sessions of a user (lost device, suspected compromise).

## Two-factor sign-in

* With LDAP or Entra ID, MFA is enforced by your directory (for example Entra Conditional Access); Quixa does not ask for a second factor on top.
* For local (break-glass) administrators, the installation can require an authenticator app (`ADMIN_MFA_PROVIDER=Local` in `.env`). It is set up with a QR code at the first sign-in and works without e-mail or internet access.
* Other users can turn on e-mail codes. Entra ID users use the MFA of your Conditional Access policies.
* A lost authenticator is reset by another administrator (**Security & Audit → Reset authenticator**); the user sets up a new one at the next sign-in.
* After 5 wrong codes the sign-in has to start again; after 5 wrong passwords the account is locked for 15 minutes.

## Passwords

At least 12 characters with three of: lower-case, upper-case, digits, symbols; not a common password; not containing the e-mail name. The same rule applies to registration, invitations, resets and changes.

## Audit log

The audit log records, with time, user, IP address, user agent and outcome:

| Category | Events |
| :- | :- |
| `auth` | sign-in (success, failure, lockout), two-factor challenge, enrolment and verification, sign-out, password change and reset, session revocation |
| `user`, `role` | invitation, approval, rejection, update, role change, deletion, authenticator reset, sessions ended by an administrator |
| `secret` | credential created, changed, deleted, tested, token refreshed (never the values) |
| `flow` | flow runs, single-node runs, suite runs |
| `settings` | security settings (outbound rules, AI switch, retention) with before and after values |
| `export` | audit log exports |
| `data`, `admin` | workspace deletion, platform setup |

Administrators filter and export it in **Backoffice → Security & Audit** (JSON lines or CSV). It can be forwarded to a SIEM in real time ([hardening guide](https://docs.quixa.io/security/hardening-guide.md#6-siem)). Audit events are kept for 365 days by default (at least 90).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.