Admin Console Reference
Every section of the /admin console, the route it lives at, and what it shows.
On this page
TL;DR: The console is server-rendered from the Handlebars templates in
storage/files/admin/templates/. Pages are routed in the admin domain crates
(extensions/web/admin/*) and composed in extensions/web/src/router/admin/.
This page lists each section and what it shows; the linked pages cover the
detail.
Who reaches what
Any signed-in user reaches /admin/ (the overview), /admin/profile,
/admin/connect, /admin/connectors, /admin/sync, their own
conversations, requests and traces, and the workflow inbox and runs. Everything
else needs the admin role. The list is in
extensions/web/shared/admin-core/src/middleware/gates.rs.
Sections
| Route | Shows |
|---|---|
/admin/ |
Overview: spend, requests, latency, error rate, models, projects, groups, approvals, anomalies. See Dashboard. |
/admin/profile |
The signed-in person's usage, how they appear in the console, and the account. Sign-in identity comes from the directory. |
/admin/connect |
Pointing Claude Code or any Anthropic- or OpenAI-compatible client at the gateway; personal access tokens. |
/admin/connectors |
Authorising each connector provider once per person. See Connectors. |
/admin/analytics |
What the AI did, by model, skill, tool, session and cost. |
/admin/requests, /admin/requests/{id} |
Gateway requests; a single request's audit chain (identity, policy evaluations, model traffic, linked trace). |
/admin/traces, /admin/traces/{id} |
Gateway calls, governance decisions and tool invocations grouped into a trace, with its waterfall. |
/admin/conversations, /admin/contexts/{id} |
Conversations and the gateway calls each made, in order. |
/admin/artifacts/{id} |
One stored tool result: typed body, provenance and joined rows. See Artifacts and Tool Calls. |
/admin/logs |
Application log entries. |
/admin/sql |
Read-only SQL console with bounded reads. |
/admin/governance |
Governance decisions and safety findings (warn-mode report). Sub-pages: /admin/governance/approvals, /admin/governance/quotas, /admin/governance/secrets, /admin/governance/decisions/{id}. See Governance Modes. |
/admin/gateway |
Gateway routes and usage; /admin/gateway/routes, and /admin/gateway/policies (quotas and scanners, edited live). See Gateway API. |
/admin/access-control |
Entitlement rules per entity, with a Sync tab. See Access Control. |
/admin/users, /admin/users/{id} |
The user roster and a person's detail. See User Management. |
/admin/roles |
Who holds each role. Directory grants are withdrawn in the directory; hand grants are revoked here. |
/admin/groups, /admin/groups/{id} |
Groups: membership, inherited marketplace entitlement, attributed spend. |
/admin/projects, /admin/projects/{id}, /admin/projects/{id}/report |
Projects and their report. |
/admin/identity/service-accounts |
Service accounts. They never sign in; credentials go only to a workflow write-back or farm caller. |
/admin/devices |
Every credential handed out (tokens, device certificates) and whether it is in use. |
/admin/workflows, /admin/workflows/runs, /admin/workflows/inbox |
Workflow definitions, runs, and the decisions waiting on the viewer. See Workflows. |
/admin/brain |
The brain: facts, kinds and their health. See Brain. |
/admin/sync |
Code ↔ Instance: each source and plane, drift, and apply. See Services Sync. |
/admin/configuration |
Live configuration read from the running profile, including retention windows and the last cleanup run. See Data Retention. |
/admin/system/observability |
The OTLP exporter: test connection, export now, lag. See Observability Export. |
Drive is served at /drive (old /admin/drive links redirect there); see
Drive. Sign-in is /admin/login; AD FS SSO is at
/admin/auth/adfs/start.