Most of Settings is readable by every member; most changes need Admin.
The table under Who can do what lists each action. The
role model itself is on Roles and permissions.
Where things are
The sidebar’s Settings entry opens six destinations:
The Settings page itself is a set of tabs. The tab is part of the address, so
you can bookmark or share a link to one:
The Organization, Teams and Preferences entries all land on the first tab,
Profile. Members and invitations are on the People tab. If you arrive
somewhere that does not show what you came for, pick the tab you need from
the strip at the top of the page.
Usage
Usage reports what your organization has ingested in the current calendar month, in UTC, against your plan: records per signal, an approximate total in gigabytes, the percentage of your allowance used, your plan name and your retention window. It deliberately ignores the time picker. A billing figure that changed when someone dragged a dashboard’s time range would be one nobody could act on, so the period is always the calendar month and is printed at the top of the page. Crossing a volume allowance does not stop your ingest and nothing on this page warns you as you approach one — watch it yourself if the figure matters to you. What is enforced and what is only measured is set out on Plan limits and usage.Billing
Billing shows the plan your organization is on and the allowances it carries.People
The People tab lists every member: name, email, role and when they joined this organization.- Invite a member with the invite action on the tab. Invitations are sent by email, so they depend on email delivery being configured for your deployment. See Create your account and sign in.
- Change a role from the member’s row. You can grant a role no higher than your own, and only an Owner can grant Owner — see Who may grant which role.
- Remove a member requires the Owner role.
A role change or a removal ends that person’s existing sessions. Their
next request is refused and they must sign in again, at the new role or not at
all. It does not wait for their current session to expire.
API keys
The API keys tab holds your organization’s license keys — the credential your collectors and SDKs send telemetry with. “API key” and “license key” are the same object here. Every member can see the list: name, a masked prefix, who created it, when, and when it was last used. Creating, revealing, rotating and revoking a key require Admin. The key value is never in the list; revealing one is a separate, Admin-only action. How to create one, and what a key does not control, are on Create a license key. Why there are two credentials — a license key and a session — is on Authentication.Service accounts
Where your release includes them, Service accounts give a CI pipeline or a script its own identity for calling the API, instead of a person’s session. Each has a role ceiling it can never exceed, and issues tokens that are limited to the scopes you choose and that always expire. A token is shown once, when it is created or rotated, and is never shown again. Disabling a service account stops every one of its tokens at once. All service-account actions require Admin.Service accounts are for calling the API. They are not ingest credentials —
telemetry is still sent with a license key.
Notification channels
The Notification channels tab holds the destinations alert rules, escalation policies and error-budget policies deliver to. Every member can see a channel’s name and type, because that is all the list contains. Creating, editing, testing and deleting a channel require Admin, because those are the actions that read or write its credentials. A channel’s credentials — a webhook URL, a routing key, an API key, SMTP details — are sealed when they are saved and are not returned in the list. What each channel type needs is on Alerting, and how channels fit with the rest of the product is on Integrations.Preferences
The Profile tab holds Time and formatting: whether times are shown on a 12-hour or 24-hour clock. The setting applies to everyone in the organization, wherever a time is shown, and changing it requires Admin. With nothing chosen, times are shown on a 24-hour clock. The Light, Dark and System theme switch at the foot of the Settings page is yours alone and applies only to your browser. Sign out is there too.Who can do what
The Auditor role can read everything a Viewer can and cannot change anything
on these pages. Every membership change, key action and channel change is
recorded in the Audit log.
Troubleshooting
The People tab shows an error instead of members
The People tab shows an error instead of members
Listing members requires Admin. A Viewer, Editor or Auditor sees the refusal
rather than an empty list — ask an Admin or Owner if you need to see who
belongs to the organization.
An invitation never arrived
An invitation never arrived
Invitations are sent by email. If email delivery is not configured for your
deployment, sending fails with an explicit error rather than appearing to
succeed. Check with your operator or account contact before re-inviting.
Billing shows an error for invoices
Billing shows an error for invoices
Expected: in-product billing is not available, so the invoice list has
nothing to answer with. Your plan and allowances on the same page are
unaffected. Plan changes go through your account contact.
Next
Roles and permissions
The five roles and the rules on granting them.
Plan limits and usage
Which allowances are enforced and which are only measured.
Security overview
How sign-in, credentials and isolation work.