Administration

The admin section is reachable from the sidebar. Most areas are superadmin-only; department admins additionally get access to Access Management, Mappers, Raw Data Retention, MQTT Accounts, Entities, and Categories, scoped to their own department(s). It covers: organisations, departments, users, access management, raw data retention, MQTT accounts, and settings.

Data model

The LEAF Portal uses a three-level hierarchy for organising data access:

Organisation
  └── Department
        └── Entity  (individual sensor / device)

Access to sensor data is controlled through access grants (managements), which bind a user to a scope within this hierarchy.

Organisations

URL: /admin/organisations

Organisations are the top-level tenants — typically an organisation, company, or research group. Each department belongs to exactly one organisation.

Creating an organisation

1. Click Add organisation.
2. Enter a unique name.
3. Click Save.

Deleting an organisation

An organisation can only be deleted if it has no departments. Remove all departments first.

Departments

URL: /admin/departments

Departments are subdivisions within an organisation. Sensor data is always tagged with a department.

Creating a department

1. Click Add department.
2. Select the parent organisation.
3. Enter a name (unique within the organisation).
4. Click Save.

Department members

Click the members icon on a department row to manage which users are associated with that department. Department membership is used for alarm rule ownership and portal UI filtering — it does not by itself grant data access (see Access Management below).

Users

URL: /admin/users

User accounts can be created, edited, and deleted here. Each user has a name, email address, and password.

Creating a user

1. Click Add user.
2. Fill in name, email, and password.
3. Optionally tick Superadmin to grant full admin access.
4. Click Save.

Resetting a password

Click the edit icon on a user row and enter a new password.

Users can also reset their own password via the forgot-password link on the login page, provided SMTP is configured in Settings.

Access Management

URL: /admin/access-management

Access grants (called managements) define what sensor data a user can see. A management is a named scope with optional filters:

Field	Meaning
Organisation	Which organisation’s data is included
Department	Restrict to one department (optional)
Entity	Restrict to one entity / sensor (optional)
Time start	Only data from this timestamp onwards (optional)
Time end	Only data up to this timestamp (optional)

Leaving a field empty means no restriction at that level. For example, a management with only an organisation set gives the user access to all data in that organisation across all departments.

Creating an access grant

1. Click New access grant.
2. Enter a descriptive name.
3. Select the organisation and optionally narrow the scope.
4. Click Save.
5. Open the grant and add users to it via the members button.

Example scopes

Use case	Organisation	Department	Entity
Full organisation access	WUR	—	—
Single department	WUR	SSB	—
Single entity	WUR	SSB	R1

Raw Data Retention

URL: /admin/retention

Controls how long raw sensor readings are kept per entity before being permanently deleted. This does not affect the 1-minute/5-minute/10-minute/hourly/daily aggregated history shown in Plots and Data Explorer — those keep their full history indefinitely regardless of an entity’s raw-data retention setting.

Superadmins can manage retention for every entity; department admins are scoped to entities in their own department(s).

The table lists every known entity (including ones with no current data, as long as they’ve reported data at some point) with its current setting — either a number of days or Unlimited (the default; raw data is kept forever).

Changing an entity’s retention

1. Click the edit icon on the entity’s row.
2. Either set a number of days, or tick Keep raw data forever to restore unlimited retention.
3. Click Save.

A scheduled job purges raw data past its retention window once per day; changes take effect on the next run, not immediately.

MQTT Accounts

URL: /admin/mqtt-accounts

Manages credentials for MQTT clients (sensors, gateways, scripts) publishing to or subscribing from the platform’s broker. This page only appears when the connected database has VerneMQ Postgres authentication configured — deployments without it simply don’t show this section.

Each account is a username/password pair scoped to one department: both publish and subscribe access are limited to that department’s topic namespace, so an account for one department cannot read or write another’s data. Superadmins can create accounts for any department; department admins are limited to their own department(s).

Creating an account

1. Click Add account.
2. Select the department and enter a username (and optionally a label to note what the account is for, e.g. a device name).
3. Click Create.
4. Copy the generated password immediately — it is shown once and cannot be retrieved again. If lost, delete the account and create a new one.

Removing an account

Click the delete icon on the account’s row. Any MQTT client currently using that account loses access immediately.

Settings

URL: /admin/settings

Database

Reconnect the portal to a different TimescaleDB instance without restarting. Enter the new connection details and click Save & reconnect. The new credentials are also written to the .env file so they persist across restarts.

Field	Example
Host	timescaledb.example.com
Port	5432
User	leaf
Password	Database password
Database	leaf_portal

Mail (SMTP)

Configure the outgoing mail server used for alarm notifications and password reset emails.

Field	Example
Host	smtp.example.com
Port	587
User	leaf@example.com
Password	SMTP password
From	leaf@example.com