Users

This page describes how to create and manage users in Facets. Users are individuals who access and utilize the Facets platform. User is the central component of user management in Facets.

Two users are not individuals. Every control plane ships with ci-user@facets.cloud and praxis@facets.cloud, service accounts that exist so automation can act as an authorised identity rather than as a person. See Built-in service accounts below.

Prerequisites

Before you can manage users in Facets, you need the following:

Access to the Settings area of the Facets Control Plane.
Appropriate permissions to manage users, which may be tied to a specific role.

Use cases:

Creating a User

In the console, a user is created directly: you set the password as part of the form.

Using command

The CLI has a separate invite flow, which takes email addresses rather than a password and accepts more than one at a time:

raptor create user --emails alice@company.com,bob@company.com --group <USER_GROUP_ID>

--group is optional there.

New to the CLI? Install it first.

Open Settings, and under User management in the left sidebar select Users.
Click Create New User. The Create New User drawer opens.
Enter the User email. This is the address used as the login username, and the field takes a single address.
Set a Password and repeat it in Confirm Password. The password must be 8 to 20 characters and include at least one uppercase letter, one lowercase letter, one number, and one special character.
Choose a Permission Assignment Method:
- Assign to User Group (recommended): select one or more entries under User group. When the selected group carries a base role, the resulting role is shown as Derived Default Role.
- Assign Direct Role: select a Default Role, and optionally the Accessible Environments for this user.
Click Create User.

Built-in service accounts

ci-user@facets.cloud is there for automation: pipelines, CI/CD flows, and anywhere a command has to run as an authorised user rather than as a person. praxis@facets.cloud is the equivalent for Praxis automation. Both are present by default on every control plane, and neither belongs to a person.

Each carries its own role, and both roles are fully editable, so you decide exactly what the automation is allowed to do. Treat them the way you would any other role: grant the permissions the automation needs and no more.

Tokens for both are issued and managed in one place, which is the point of them. Rotating the credential a pipeline uses means rotating that account's token, with no human user touched and no personal token shared.

🚧

A personal access token belongs to the person who generated it, and it carries that person's permissions. Using one to authenticate a pipeline ties the pipeline to an individual: their access changes, or they leave, and the pipeline breaks. Point automation at a service account instead.

Generating an Authentication Token (Personal Token)

A personal access token is the password half of Facets' basic authentication. Use it for API calls and for raptor login.

Sign in to the Control Plane and click your avatar to open the user menu.
Select Personal access token. The Personal Access Tokens drawer opens and lists the tokens you have generated so far.
Click Generate Token.
In the Create Personal Access Token drawer, give the token a Token Name you will recognise later, add an optional Description, and click Generate Token.
The token is copied to your clipboard automatically and shown once in a confirmation message. Store it in your secret manager before that message clears.

The token is shown only once and cannot be retrieved afterwards. If you lose it, generate a new one and delete the old entry. Delete a token you no longer need from the same drawer; applications using it will lose access to the Facets API. You can open the drawer directly at <your-control-plane-url>/v2/home#personal-access-tokens.

User Attributes

When creating a user, you can configure the following attributes:

User email: A mandatory field, used as the user's login username.
Password: Set in the Create New User drawer and repeated in Confirm Password.
User group: Required when Permission Assignment Method is Assign to User Group. Accepts more than one group.
Default Role: Selected directly when Permission Assignment Method is Assign Direct Role. Under Assign to User Group it is instead derived from the selected group(s) and shown as Derived Default Role. It sets the basic, CP-wide access level for the user.

FAQs

What should I do if I lose my personal access token? You will need to generate a new personal access token as the previous one is not recoverable.
How can a user be removed from Facets? Click on the Delete action button for that particular user to remove access.
How to update permissions of an existing user? Create a new role with the updated permissions if it doesn't exist already, create a user group using this role and assign this new user group to the user.
How to provide access for a new project environment to existing users? Create a new user group that grants access to the new project or environment, with the appropriate default and environment-specific roles, then assign that user group to the existing users.