Managing users & activity

This page covers the day-to-day administration surfaces in the admin console: administrators, realm users, changing a user's email address, erasing personal data on request, the audit trails (Activity, Events, Emails), and your own session management.

Administrators

The Users page (/users) lists the administrators of your organization — the people who can sign in to the admin console. Columns include Email, Verified, Passkey, Active Sessions, Last Login, and Created.

To add one, use the Add Admin User form (a single Email field). The account is created unverified and passwordless: the new admin proves ownership of the address by completing their first magic-link sign-in, exactly like any other SemAuth user. There is no password to set or send.

Each administrator can be deactivated, reactivated, or erased from this page. SemAuth refuses to deactivate or erase your own account or the last active administrator, so your organization can never be left without one.

Realm users

Open a realm's Users page (/realms/{issuer_id}/users) to see its end users — Email, Verified, Passkey, Linked IDPs, Active Sessions, Last Login, Created, and Status. Most end users are created automatically the first time they sign in (via magic link or federation); you generally don't pre-create them.

Deactivate / reactivate

• Deactivate immediately revokes the user's sessions and tokens — they're signed out everywhere at once. Use this to off-board someone fast.
• Reactivate restores access; the user signs in again normally.

Change a user's email address

Use Change email on a user's row to move the account to a new address — to fix a typo made at first sign-in, or because the person's address changed. The account itself stays the same: its user ID (sub), passkeys, linked external identities and history are all kept, so your applications keep recognizing the user.

• The new address starts out unverified. The user verifies it the next time they sign in with a magic link.
• An address that already belongs to another user in the realm is refused.
• The new address appears in tokens issued from the user's next sign-in. Existing sessions are not ended — to sign the user out everywhere, deactivate them.
• Administrators' addresses are not changed here.

Erasing personal data

When a person asks you to delete their data — for example under the GDPR's right to erasure — erase them. Erasure removes their account, their sign-in methods (passkeys and linked external identities) and their sessions, and makes every record of them in your audit trails permanently unreadable. The records themselves stay, so your history still shows what happened and when; where the person's details were, the console shows erased.

Each erasure returns a dated receipt: the account that was removed (if any) and how many audit records mentioned the person. The same actions are available from the Admin API, so you can answer data-subject requests from your own tooling.

Audit trails

SemAuth records every meaningful action in a permanent, append-only history. Three views expose it:

Personal data in these views — email addresses, the network address and the browser a person used — is protected per person, which is what makes erasure possible without rewriting your history. Activity that belongs to nobody in particular keeps only a shortened network address.

Your own sessions

The Account → Sessions page (/account/sessions) lets you, the signed-in administrator, review your active admin-console sessions (device, IP, created, last seen) and revoke any that aren't the current one. A "Recent activity" section lists sessions ended in the last 30 days with the reason (logged out, revoked, expired). To end your current session, use logout. You can also manage your own passkeys from /account/passkeys.

Where each task lives