System Admin guide

This page lists the work of a System Admin and where each task lives under Admin in the Console menu. Most tasks have a detailed guide of their own; this page tells you which one to open.

Who this is for

System Admins: the people who run the Orbit installation for the whole organisation.
A System Admin has every project role on every project, so the Project Admin guide and the QA Lead guide apply too.

Before you start

Your account needs the system role System Admin. Another System Admin gives it on Users.
Set up your authenticator (the code app) on Profile, Security. While the organisation switch is on, admin actions ask for its code: “Admin actions need your authenticator code.” with Enter the code. Pages that need it show Verify now.
The Admin group is the last group of the menu, shown only to System Admins. It has four pages:

Page	Tabs	What it is for
People and access	Users, Teams, Access	Accounts, teams, who can do what
Projects and customers	Projects, Customers, Data resets	Projects, customers, every reset and removal
Stations	Stations, Requests, Settings	The PCs that run tests
System	AI, Email, Security, Appearance, Announcements, Usage, Configuration transfer, Audit log	Organisation settings

Keep at least two System Admins, so one can help the other (a lost authenticator, a role change you cannot make on yourself).

Users and expiry

Open Admin, People and access, Users. It lists every account, with its State, Role, Expires and Teams.

Add user creates an account: Email an invite (the person chooses a password) or Set a password now (you hand it over yourself). Set the Role (Member or System Admin), Account expires and a First team.
Select a person to open their sheet, with the tabs Account, Profile, Teams and Security. There you change the role and expiry (Save account), Resend invite, Confirm email, Set a new password…, Reset authenticator, Change email…, Deactivate…, Reactivate and Delete user….
Select several people in the list for Extend expiry or Deactivate at once.
Send invites to all not invited sends an invite to every account a configuration import created without one.

On the expiry date an account becomes view only for 3 days, then it can do nothing. Extend it before that, or let it lapse on purpose. The full rules and every button are in People and roles. Recipes for the usual problems (an email not confirmed, a changed address, someone leaving, removing a person for good) are in People account recovery.

Most people reach a project more simply through Project settings, People, where a Project Admin adds them with a role. Use Users for System Admins, for accounts with no project yet, and for fixes.

Teams and access

Teams (Admin, People and access, Teams): Shared teams are made by hand and can serve several projects; Project teams are the teams a project manages on its own People section, read only here. Create team, then add Members and Access to projects with a role. Make managed… turns a hand-made team that serves one project into a project team. See People and roles.
Access answers “who can do what, and why”. Tabs Roles, By project and By person; Explain says why one person can or cannot do one action. Export CSV gives one row per person and project for the access review. See People and roles and the quarterly review in People account recovery.

Projects and customers

Open Admin, Projects and customers.

Create a project

On Projects, choose New project.
Fill in the Name, the Short name, the Customer (or New customer…) and Keep artifacts for (7 days, 30 days or 90 days; results stay, only traces, screenshots and videos go).
Keep Create the project team ticked, then choose Create project.
Choose Open settings and follow Onboard a customer project.

The project’s Details (name, short name, time zone, retention, customer) are changed later in Project settings, Overview, by System Admins only. The same page holds Archive…, Restore…, Delete… and Remove project….

Customers

On Customers, New customer groups projects for the Customers pages. Mark a customer Internal (your own products) or Demo customer (shows a Demo tag). Reset demo data… resets the test history of every project of a demo customer at once (see Reset test data). Access still comes from teams, never from the customer.

Data resets

Data resets lists the test data resets and removals of every project: what each removes, where it is, and when the data is removed for good. Open a project to start, cancel or download one. See Reset test data.

Stations

Open Admin, Stations. A Station is a tester’s Windows PC that runs tests and sends results to the Console. The install itself is in Install the Orbit Station.

Approve a request

Testers ask for a Station from their Profile, tab Station. Every System Admin gets a notification.

Open the Requests tab.
Check the PC name and the person. Choose Approve, or Reject… with a note.
The tester then gets a one-time code from their Profile and installs. You never see the code.

Withdraw approval… ends an approval that has not enrolled a Station yet. Show decided shows past requests.

Add a Station yourself

For a shared lab PC with no owner: on Stations, choose Add station, type the Station name (usually the PC’s name) and choose Create code. Give the code and the installer link to the person at the PC. The code works once, for 24 hours. Under Waiting to enroll, Void… stops an unused code at once.

Revoke a Station

Open the Station’s sheet, then Revoke… in its danger zone, and confirm with Revoke . The Station stops syncing within 15 minutes and deletes its cached configuration and secrets. Results it has not sent yet stay on the PC. A revoked Station cannot come back: enroll the PC again with a new code. Remove… then takes it off the list; its executions stay in the history under its name.

Revoke a Station when a PC is lost, given to someone else, or reinstalled. To cut off a person everywhere at once, Deactivate… their account instead.

Settings

Minimum Station version: Stations older than this can still run tests, but the Console refuses their results until they update. Raise it after a release that fixes something important; the page lists the Stations that would fall below.
Sites: where Stations sit, such as an office or “Remote”. Quality compares results by site. Add site, Rename, Archive. Set a Station’s site on its sheet.

The Station sheet also has Advanced, Use the tester’s own Git credentials when the Orbit GitHub App token fails: off by default, it needs Git Credential Manager signed in on that PC.

Organisation settings

Open Admin, System. Each tab is one setting area.

AI

Model providers and limits for AI diagnosis, summaries and the assistant.

For each provider (Groq, tried first; Google Gemini, used when Groq fails or is busy), paste the API key, choose Test connection, then Load models and pick a Model.
Set AI calls per day across all users and Calls per user per day, by feature (an empty field uses the default).
Turn on AI features on for Orbit and choose Save AI settings.

Keys are stored encrypted and never shown again. Prompts are redacted before they leave Orbit, and only call counts are logged. Project Admins can still turn AI off for their own project.

Email

The Gmail account Orbit sends notifications and scheduled reports from.

Tick Send email from Orbit.
Fill in the Gmail address, the Sender name and the App Password. The Gmail account needs 2-Step Verification and an App Password; its normal password does not work.
Set Emails per day at most below about 500 (the Gmail limit).
Choose Save email settings, then Send test email to me.

Security

Authenticator code: whether System Admins confirm an authenticator code before admin actions. It is one setting for the whole organisation. Turn off or Turn on. Signing in with email and password stays either way. Keep it on: without it, a guessed admin password gives full admin access.

Appearance

The theme and mode for people who have not picked their own. Choose them and Save default. Anyone can still choose a different one for themselves.

Announcements

Messages shown under the header of the Console and of every Station.

Choose New announcement.
Pick the Severity, type the Title, and optionally the Message (optional) and Link (optional).
Under Who receives it, choose Everyone or tick projects. Stations from version and up to version limit which Stations show it (the Console always does).
Set Starts and Ends. Tick Ask people to confirm they read it to keep it on screen until they choose “Read and confirm”.
Look at the Preview, then choose Publish.

Edit changes it; Retract… removes it. With confirmation on, Show who lists who confirmed.

Usage

How fast each free plan fills up, how the system is used and whether AI and email work. Pick the Period and a Project (or All projects). The blocks are What stands out, Capacity, What grows, Activity, AI health, Email and the daily Measurements. Export CSV downloads each block.

Look at Capacity once a week. When the database or file storage approaches its limit, shorten the artifact retention of busy projects, reset old test data, or ask the person who runs your Orbit installation to move to a larger hosting plan.

Backups are not a Console feature. The database backups belong to the person who runs your Orbit installation; ask them how often backups run and when a restore was last tested. A configuration export (below) keeps a copy of the setup, not of the run history.

Configuration transfer

Moves the configuration of this installation, or of one project, to another installation, or copies a project as a template. Run history never moves. The steps, the passphrase and the import preview are in Move or copy the configuration.

Audit log

Who changed what in Orbit, newest first. Filter by Area, Action and Resource, then Apply filters. Show routine events adds the frequent, low-interest ones. Export CSV downloads the filtered list. Every admin action on this page, on people and on Stations is written here.

MFA recovery

When someone loses their authenticator:

Another person (any account): open Users, their sheet, tab Security, Reset authenticator. They set up a new one at their next sign-in. Check who is asking first: see People account recovery.
A System Admin: another System Admin resets it the same way. This is why you keep two.
The only System Admin: nobody in the Console can reset it. Ask the person who runs your Orbit installation; the recovery happens in the sign-in service, outside the Console.

Remove a project or an environment

A Project Admin can reset run history. Only a System Admin can remove more: the release records of a project, a whole project, or one environment. A removal always builds an export first, waits 7 days and can be cancelled until then.

Start from Project settings, Overview (Remove project…) or Data reset (Reset or remove…), or from Environments (Remove environment…). Follow Remove a project or an environment, including its offboarding checklist. Agree with a second person before you remove anything on a production installation, and delete the export file once it is no longer needed.

Archiving is often enough: it hides a project or environment, keeps all history and can be undone.

Move or copy the configuration

Use Admin, System, Configuration transfer to:

move every customer, project, team and person to a new installation (Whole installation);
copy one project to another installation, or make a demo copy (One project; also from Project settings, Overview, Export configuration…).

Secrets travel only when you tick Include secret values and give a passphrase. People created by an import have no invite yet: send them from Users with Send invites to all not invited. Steps: Move or copy the configuration.

What can go wrong

You see	Why	What to do
“Verify your authenticator first, then try again.”	Admin actions need a fresh authenticator code in this session.	Choose Verify now and enter the code.
You cannot change your own role	Orbit refuses it on purpose.	Ask another System Admin.
“… cannot be deleted: the account has … Deactivate it instead.”	The account has history.	Use Deactivate….
A tester’s code is refused	Codes work once, expire after 24 hours and a new one voids the old one.	Let them get a new code, or create one with Add station.
Results of a Station are refused	The Station is below the Minimum Station version.	Ask the tester to update the Station.
A revoked Station is needed again	Revoked Stations cannot come back.	Enroll the PC again with a new code.
Email does not arrive	Email is off, the App Password is wrong, or the daily cap is reached.	Check System, Email, then Send test email to me; look at Usage, Email.
AI answers stop	The daily cap is reached, or a provider key failed.	Look at Usage, AI health, then the keys on System, AI.
Capacity shows Watch or Critical	A free plan is filling up.	Shorten retention, reset old test data, or ask the person who runs your Orbit installation to move to a larger hosting plan.
An error code appears	See its meaning and what to do.	Error codes reference.

More answers: FAQ. Who can do what: Roles and permissions reference.

Values to record

Value	Where you find it	Secret?
Names of the System Admins (at least two)	Users, column Role	Not secret. Keep the list with your operations notes.
Your authenticator recovery	Your authenticator app’s backup	Secret, offline backup. Without it, another System Admin must reset it.
AI provider API keys	The provider’s console (Groq: console.groq.com, API Keys; Google Gemini: aistudio.google.com, Get API key)	Secret. Stored encrypted, never shown again; keep a copy in your password manager.
Gmail address and sender name	System, Email	Not secret
Gmail App Password	The Gmail account’s security settings	Secret, shown once by Google. Keep it in your password manager.
Passwords you set for people	Shown once after Create account or Save password	Secret, shown once. Hand it over in person or by phone; do not keep it.
Enrollment codes from Add station	Shown once after Create code	Secret, shown once. Give it to the person at the PC; it expires in 24 hours.
Configuration transfer passphrase	You choose it at export	Secret. Send it by another channel than the file.
Minimum Station version and the sites	Stations, Settings	Not secret