KW Knowledge base

Users, Groups & Permissions

Vistralio uses RBAC plus tenant assignment plus group-based device visibility.

Mitch Wigham
Updated 14 July 2026 · 38 views

Users, Groups & Permissions

Vistralio uses RBAC plus tenant assignment plus group-based device visibility.

Access model

User access is controlled by:

  1. permissions
  2. assigned tenants
  3. assigned groups inside those tenants

2FA

Users can now enable TOTP-based 2FA from their account settings page.

Login flow is now:

  1. username/password
  2. 2FA challenge if enabled
  3. tenant selection if the account can access more than one tenant

Single-tenant users do not need a tenant picker.

Common permissions

Permission Purpose
cameras.view View devices
cameras.edit Create/edit devices
cameras.delete Delete devices
cameras.talk Use two-way audio
cameras.stream_switch Switch between live and full-quality recording stream in live view
events.view View events
events.acknowledge Acknowledge events
events.delete Delete events
recordings.view View playback/live recordings
recordings.export Export footage
recordings.delete Delete recordings
users.view View users
users.edit Manage users
groups.view View groups
groups.edit Manage groups
tenants.view View tenants
tenants.edit Manage tenants and cross-tenant assignments
sites.view View edge routers and their status
sites.edit Create and manage edge routers
sites.command Send remote commands (update/restart/reboot) to edge bridges
settings.admin Global admin override
system.restart Restart services from the UI
system.update.view View update status
system.update.check Check for updates
system.update.apply Apply updates
system.logs View operational logs
system.diagnostics Run diagnostics
ai.configure Configure AI detectors
ai.faces Manage face recognition
ai.plates Manage plate recognition
dashboard.view View dashboard
dashboard.edit Customise dashboard
branding.edit Edit logos, colours, and product name
dns.edit Manage DNS / hostname settings
licensing.view View licence status
licensing.edit Manage licences and customers

cameras.stream_switch — live stream quality

This permission, combined with the tenant-level stream_switch feature flag, enables the Live / Full HD toggle in the camera live view. When toggled to Full HD, the live viewer switches from the detection sub-stream to the full-resolution recording stream.

The stream_switch feature flag is set per-tenant by an admin in Admin → Tenants → Features.

sites.command — remote edge router control

Required to use the Update, Restart, and Reboot command buttons on edge routers in the admin panel. Commands are only sent when the router is online.

Groups

Groups still control device visibility for non-admin users.

Multi-tenant user assignment

Examples:

  • global admin: all tenants, full switcher
  • manager: two tenants, can switch, can create users in either allowed tenant if they have users.edit and tenants.edit
  • standard user: one tenant only, no switcher shown

Related endpoints

  • GET /api/users
  • GET /api/users/permissions/catalog
  • POST /api/users
  • PUT /api/users/{id}
  • DELETE /api/users/{id}
  • GET /api/groups
  • POST /api/groups
  • PUT /api/groups/{id}
  • DELETE /api/groups/{id}
  • GET /api/tenants
  • POST /api/tenants
  • PUT /api/tenants/{id}
  • DELETE /api/tenants/{id}
  • GET /api/auth/2fa/status
  • POST /api/auth/2fa/setup/start
  • POST /api/auth/2fa/setup/enable
  • POST /api/auth/2fa/disable

Still need help?

Log a support ticket and the team will pick it up from this page.