Admin Dashboard
Manage your organization from the browser
The Vouch admin dashboard provides a browser-based interface for organization administrators to manage members, review audit events, and configure integrations. Access it at https://<your-vouch-server>/admin after logging in with an administrator account.
Member management
The Members page lists all users in your organization with their current status, role, and registered security keys.
Actions
| Action | Description |
|---|---|
| Promote to admin | Grant administrator privileges to a member. |
| Demote from admin | Remove administrator privileges. |
| Deactivate | Suspend a member’s account. They cannot log in or obtain credentials until reactivated. |
| Activate | Reactivate a previously deactivated member. |
| Revoke credentials | Immediately invalidate all active credentials (SSH certificates, AWS sessions, tokens) for a member. |
| Remove | Permanently remove a member from the organization. |
Administrators cannot demote or remove themselves. This prevents accidental lockout.
Audit log
The Audit page (/admin/audit) displays a chronological record of security-relevant events across the organization. Each entry includes:
- Timestamp – When the event occurred.
- Actor – The user who performed the action.
- Event type – What happened (login, credential issuance, member change, etc.).
- Location – Approximate geographic location based on the client IP address (city, country).
- Details – Additional context such as credential type, target resource, or policy name.
Filtering
Use the event type filter buttons to narrow the audit log to specific categories: Logins, Promotions, Demotions, Deactivations, Removals, or Revocations.
Geographic data
Vouch enriches audit events with GeoIP location data. Login events show the approximate location of the client, helping security teams identify anomalous access patterns such as logins from unexpected countries.
Programmatic export
For SIEM ingestion, backfills, and scripting, the same events are available from the audit events API (GET /api/v1/org/audit-events), with cursor-based polling, NDJSON streaming, and an OCSF projection. See Audit Log Export.
SCIM token management
The SCIM Tokens page (/admin/scim-tokens) lets administrators create and revoke SCIM provisioning tokens from the browser. These tokens are used by your identity provider to authenticate SCIM 2.0 API requests.
| Action | Description |
|---|---|
| Create token | Generate a new SCIM bearer token. The token is displayed once at creation – copy it immediately. |
| Revoke token | Invalidate an existing token. Your identity provider will no longer be able to push user changes using that token. |
When creating a token, checking “Also grant read-only audit log access” adds the audit:read scope, allowing the same token to authenticate audit log export pollers.
For full SCIM setup instructions including identity provider configuration, see SCIM Provisioning.
Device posture policies
The Policies page lets administrators enforce device security requirements. Built-in policies cover disk encryption, firewall, screen lock, endpoint protection, MDM enrollment, platform integrity, and OS recency, plus history-aware policies for rate limiting, failed-login bursts, and step-up on token exchange. Custom policies are composed in a guided rule builder, or written directly as Dogwood (opens in new tab) (Cedar-based) policy text.
For full details on available signals, custom policy rules, and enforcement behavior, see Device Posture Policies.
Email domains
The Email Domains page (/admin/domains) manages the additional email domains owned by your organization. Domains are verified by DNS TXT record and, once verified, route new enrollments to your organization and gate SCIM provisioning. See Email Domains & Issuer Subdomains.
Issuer subdomain
The Issuer Subdomain page (/admin/subdomain) lets your organization claim a dedicated OIDC issuer (e.g. acme-com.us.vouch.sh) with its own signing key set for AWS federation, and manage staged key rotation. See Issuer subdomains.
Access control
Only organization administrators can access the admin dashboard. If you are not an administrator, the dashboard returns an error. To become an administrator, ask an existing admin to promote your account from the Members page.