Organization & Access
Users, roles, networks, and API keys.
Organizations
Organizations are the top-level container in Scanopy. Every user belongs to exactly one organization, and all networks, hosts, and services exist within that organization.
Organizations are automatically created during registration and cannot be manually created or transferred.
Roles
| Role | Can do |
|---|---|
| Owner | Full organization control: manage billing, invite any role, and access all administrative features |
| Admin | Manage users and invites, create and modify all entities, but cannot access billing |
| Member | Create and modify entities for specific networks |
| Viewer | View entities. |
Account creation is invite-only — there is no self-registration. Invite users via Platform > Users — generate an invite link, select the invitee's role and which networks they may access, and share the link or send it by email.
Removing a user revokes all of their API keys, pending invitations, and network access grants.
Networks
Networks are the primary organizational unit. Each network represents a distinct environment with its own hosts, services, and topology.
Common patterns:
- Separate networks for production vs. development
- One network per physical location
- Distinct networks for different security zones
Network Settings
Open a network from Assets > Networks to edit its name, type, and its Consider entities stale after window — see Staleness.
Network Access
Users can be restricted to specific networks within an organization. When inviting a user, select which networks they may access — all data queries are filtered to those networks. This allows granting a contractor or external partner visibility into only the networks relevant to them while keeping other environments hidden.
Credentials
Credentials are organization-scoped: managed under Assets > Credentials, and assignable to any network or host in the organization. See Credentials for types, targets, and assignment.
API Keys
Each daemon gets its own API key, minted and bound to it automatically when you create the daemon. You don't create daemon keys by hand.
Platform > API Keys lists them. Any key marked legacy predates 1:1 binding and is shared across a network's daemons; see Daemon Identity for how those behave and how to give a daemon a key of its own.
User API keys, for programmatic access to the API, are created here too — see the API reference.