> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aiaxoniq.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Settings
> What each Settings page in aiAxonIQ does — usage, billing, people, API keys, notification channels and preferences — which role each needs, and what is not self-service.
**Settings** is where your organization is administered rather than observed:
who belongs to it, the credentials it has issued, where notifications go, and
how much of your plan you have used. It sits at the bottom of the sidebar, under
**Manage**.
**Most of Settings is readable by every member; most changes need Admin.**
The table under [Who can do what](#who-can-do-what) lists each action. The
role model itself is on [Roles and permissions](/concepts/roles).
## Where things are
The sidebar's **Settings** entry opens six destinations:
| Sidebar entry | Opens |
| :--------------- | :------------------------------------------------ |
| **Usage** | Consumption this calendar month against your plan |
| **Billing** | Your plan and its allowances |
| **Organization** | The Settings page, on its first tab |
| **Teams** | The Settings page |
| **API keys** | The Settings page, on the **API keys** tab |
| **Preferences** | The Settings page |
The Settings page itself is a set of tabs. The tab is part of the address, so
you can bookmark or share a link to one:
| Tab | What it is for |
| :------------------------ | :--------------------------------------------------------------------------- |
| **Profile** | Organization-wide preferences — currently the clock format |
| **People** | Members of the organization, their roles, and inviting new ones |
| **API keys** | License keys for sending telemetry |
| **Service accounts** | Machine identities for automation, where your release includes them |
| **Projects** | The projects in your organization |
| **Telemetry quality** | Whether the telemetry you send is arriving in the shape the product expects |
| **Notification channels** | Destinations for alerts — Slack, PagerDuty, Microsoft Teams, OpsGenie, email |
**The Organization, Teams and Preferences entries all land on the first tab,
Profile.** Members and invitations are on the **People** tab. If you arrive
somewhere that does not show what you came for, pick the tab you need from
the strip at the top of the page.
## Usage
**Usage** reports what your organization has ingested in the current calendar
month, in UTC, against your plan: records per signal, an approximate total in
gigabytes, the percentage of your allowance used, your plan name and your
retention window.
It deliberately ignores the time picker. A billing figure that changed when
someone dragged a dashboard's time range would be one nobody could act on, so
the period is always the calendar month and is printed at the top of the page.
**The gigabyte figures are estimates.** They are derived from record counts
using typical per-record sizes, and are labelled as estimates on the page. The
record counts themselves are exact. A signal whose plan sets no ceiling shows
**Not set** rather than a percentage.
Crossing a volume allowance does not stop your ingest and nothing on this page
warns you as you approach one — watch it yourself if the figure matters to you.
What is enforced and what is only measured is set out on
[Plan limits and usage](/concepts/limits).
## Billing
**Billing** shows the plan your organization is on and the allowances it
carries.
**Billing is not self-service.** There is no in-product checkout, plan change
or invoice history today; plans are arranged with aiAxonIQ directly. The
invoice list and the plan-management buttons on this page can show an error
for that reason — the plan and its allowances above them are still accurate.
To change your plan, contact your account contact.
## People
The **People** tab lists every member: name, email, role and when they joined
this organization.
* **Invite** a member with the invite action on the tab. Invitations are sent by
email, so they depend on email delivery being configured for your deployment.
See [Create your account and sign in](/get-started/accounts).
* **Change a role** from the member's row. You can grant a role no higher than
your own, and only an Owner can grant Owner — see
[Who may grant which role](/concepts/roles#who-may-grant-which-role).
* **Remove a member** requires the Owner role.
**A role change or a removal ends that person's existing sessions.** Their
next request is refused and they must sign in again, at the new role or not at
all. It does not wait for their current session to expire.
A user account belongs to the person, not the organization: removing someone
from your organization does not delete their account or affect their membership
of any other organization. See
[Organizations and multi-tenancy](/concepts/organizations).
## API keys
The **API keys** tab holds your organization's **license keys** — the
credential your collectors and SDKs send telemetry with. "API key" and "license
key" are the same object here.
Every member can see the list: name, a masked prefix, who created it, when, and
when it was last used. Creating, revealing, rotating and revoking a key require
Admin. The key value is never in the list; revealing one is a separate, Admin-only
action.
How to create one, and what a key does not control, are on
[Create a license key](/get-started/license-keys). Why there are two credentials
— a license key and a session — is on [Authentication](/get-started/authentication).
## Service accounts
Where your release includes them, **Service accounts** give a CI pipeline or a
script its own identity for calling the API, instead of a person's session. Each
has a **role ceiling** it can never exceed, and issues tokens that are limited
to the scopes you choose and that always expire.
A token is shown **once**, when it is created or rotated, and is never shown
again. Disabling a service account stops every one of its tokens at once. All
service-account actions require Admin.
Service accounts are for calling the API. They are not ingest credentials —
telemetry is still sent with a license key.
## Notification channels
The **Notification channels** tab holds the destinations alert rules, escalation
policies and error-budget policies deliver to. Every member can see a channel's
name and type, because that is all the list contains. Creating, editing, testing
and deleting a channel require Admin, because those are the actions that read or
write its credentials.
A channel's credentials — a webhook URL, a routing key, an API key, SMTP details
— are sealed when they are saved and are not returned in the list. What each
channel type needs is on [Alerting](/guides/alerts/overview#notification-channels),
and how channels fit with the rest of the product is on
[Integrations](/guides/integrations/overview).
## Preferences
The **Profile** tab holds **Time and formatting**: whether times are shown on a
12-hour or 24-hour clock. The setting applies to **everyone in the
organization**, wherever a time is shown, and changing it requires Admin. With
nothing chosen, times are shown on a 24-hour clock.
The **Light**, **Dark** and **System** theme switch at the foot of the Settings
page is yours alone and applies only to your browser. **Sign out** is there too.
## Who can do what
| Action | Minimum role |
| :------------------------------------------------------ | :----------- |
| View Usage and Billing | Viewer |
| View the API key list and the notification channel list | Viewer |
| View the People list | Admin |
| Invite a member, or change a member's role | Admin |
| Remove a member | Owner |
| Create, reveal, rotate or revoke a license key | Admin |
| Create, edit, test or delete a notification channel | Admin |
| Manage service accounts and their tokens | Admin |
| Change the organization's clock format | Admin |
| Create or edit a project | Editor |
The Auditor role can read everything a Viewer can and cannot change anything
on these pages. Every membership change, key action and channel change is
recorded in the [Audit log](/guides/audit).
## Troubleshooting
Listing members requires Admin. A Viewer, Editor or Auditor sees the refusal
rather than an empty list — ask an Admin or Owner if you need to see who
belongs to the organization.
Creating a key requires Admin. See
[Create a license key](/get-started/license-keys).
Invitations are sent by email. If email delivery is not configured for your
deployment, sending fails with an explicit error rather than appearing to
succeed. Check with your operator or account contact before re-inviting.
Expected: in-product billing is not available, so the invoice list has
nothing to answer with. Your plan and allowances on the same page are
unaffected. Plan changes go through your account contact.
## Next
The five roles and the rules on granting them.
Which allowances are enforced and which are only measured.
How sign-in, credentials and isolation work.