Settings

Settings in Rewst are robust and can be configured however you desire. This menu governs organization-level configuration and is organized into tabs, each with their own submenus.

Click on any of the menu tab names below to expand and view its documentation.

General

This menu is in development. Check back for documentation updates as we proceed with platform release.

Organizations

The Organizations tab manages the organization hierarchy between your child, customer organizations and your parent, MSP organization. The list contains the current organization's direct child organizations.

Manually create a new organization in Rewst

Remember, organizations are divided up into parent and child organizations. Every new customer you onboard into Rewst will need its own separate child org.

1. Navigate to > Organizations.

2. Click + Add Sub-Org.

3. Fill out the following fields in the Add Sub-Org dialog that appears:

   1. Organization Name: This is the display name for the organization - keep it short and recognizable, and avoid special characters

   2. Organization Type:

   3. Admin Email (optional): Fill in this field if you want an admin user to be created. They will be able to sign in using their email and a verification code emailed to that listed address.

   4. Plan:

   5. Metadata (JSON, optional): Use this field to enter optional JSON metadata for custom attributes.

4. Click Create.

Select an organization

Once an organization is created, it will appear in the organizations list of this organizations menu, as well as the drop-down organizations selector in the top right of the Rewst platform.

Click ⌄ to expand your organization selector

Delete an organization

Once an organization is deleted, it can’t be brought back, even by Rewst support. Make sure that you intend to delete an organization permanently before proceeding with the following steps.

1. Click ... next to the organization you wish to delete.

2. Click Delete.

   

   Delete organizations will only appear once an org has been selected
3. Confirm that you wish to delete the organization in the dialog that appears.

4. Note that the Recently Deleted filter in the menu only appears after your org has been deleted, or if an org has been recently deleted.

Move an organization

1. Click ... next to the organization you wish to move.

2. Click Move.

3. Choose the new parent org for your selected org. Note that moving this org also moves any orgs nested beneath it.

4. Click Move.

Integrations

The Integrations tab is a shortcut to the total Integrations menu. View its documentation here.

Credentials

The Credentials tab is a shortcut to the total credentials menu. View its documentation here.

Auth Methods

The Auth Methods tab defines authentication templates for credentials, including custom templates for vendor-specific authentication flows. The Platform Auth Methods section lists the built-in templates that come stock in the platform and can't be modified. Each entry is tagged with its authentication type and, where relevant, the vendor it was built for.

• Custom auth methods are defined in your own organization.

• Platform auth methods are built by Rewst and available to everyone.

SSO (Single Sign On)

The SSO tab configures OIDC single sign-on for the organization, and lets your people log into Rewst with your existing company login instead of a separate Rewst password.

OIDC Configuration

• Redirect URI - Rewst generates this and gives you a copy button - you paste it into your identity provider's configuration

• Identity Provider - select your identity provider to customize field labels and ordering

• IdP Issuer URL - the OIDC issuer URL must serve a .well-known/openid-configuration endpoint

• Client ID - The application identifier your provider issues to Rewst

• Client Secret -the client secret value

• Default Role - set what new role users receive on first SSO login

• Default MSP Role - optional MSP-provided role to grant automatically when a qualifying user first signs in via this tenant

• Auto-provision users - control whether new users are created automatically on sign-in

• Allowed email domains - Comma-separated list of email domains allowed to auto-provision new users via SSO, which should be left empty to block auto-provisioning for every domain

Domain Verification

Verify ownership of email domains to restrict the SSO login.

• Click Add Domain to add a new domain

• Click Refresh to manually push sync the domain

• Click Remove to remove a domain after it has been added to the list

Users

A user in Rewst is an individual. That individual will be allowed to interact with Rewst in some way, as dictated by their role. Users should not be confused with organizations. The Users tab manages people and access for the organization. Filter users by search, status, and sign-in method, along with the inclusion or exclusion child-tenant users. Each row lists the user's email, name, assigned roles, status, sign-in method, home tenant, last login, and creation date, with an actions menu for each entry.

Add and remove users from Rewst

Adding users into Rewst allows them access to build workflows, view forms, or update configuration items, like integrations or organization variables. When adding a user, you'll select their role from either the Rewst pre-set roles, or any custom roles that you have already set up. Learn more about roles and how to manage them here.

Add a user to an organization

Note that new users need an initial role in the organization before they can sign in. To give a user at your organization access, first double check that the selected organization in the org selector is set to your desired organization.

1. Navigate to Settings > Users.

2. Click Add User.

3. Enter the Name and Email of the user into the respective fields. Email is only necessary if you are planning to use the email code option.

4. Select their role from the list in the Roles drop- down selector.

5. Choose the Sign-in type from the drop-down selector:

   1. Password setup link - after creation, a dialog will appear with a link to copy for manual sharing

   2. Email code - after creation, an email will be sent to the user

   3. SSO only - only available after SSO has been configured. After creation, the user will have the role you applied in the previous step when they log in. Note: SSO can be configured to auto-provision users upon sign in with a specified default role.

6. Click Create user.

Edit a user's role

1. Navigate to Settings > Users.

2. Find your desired user in the Users list.

3. Click ... > Manage roles.

4. Click Remove to the far right of the user's record to remove the user's existing role. This will not delete the user. Their other roles will remain, and they'll stay connected to this organization.

5. If you wish to add another role to the user:

   1. Select a role from the Role to add drop-down selector, or

   2. Give the user a role in the customer organizations under this current org, without creating a separate account in each org, via the Roles in customer orgs drop-down selector

      1. Check the All customer orgs checkbox to apply this to every customer org, even orgs created after this settings update

6. Click Done.

Remove a user

If needed, re-add a removed user by inviting them again. Removing a user won’t remove any workflows they’ve built or delete any activity in the platform, such as results of workflows or edits they made to forms.

1. Navigate to Settings > Users.

2. Find your desired user in the Users list.

3. Click ... > Delete.

4. Confirm that you want to Delete in the confirmation dialog that appears. The user will will lose access to this organization and disappear from the active users list. This can't be undone from the UI.

Roles

The Roles tab defines scoped permission bundles for assignments and templates. A role is a named set of "can do this, can't do that." You build them here, then assign them to individuals in the users part of the settings menu. System roles are created by Rewst and can't be edited. Create custom roles when you need a narrower permission bundle for a team, organization, or external identity.

The stock, Rewst-set role catalog currently includes:

Role	Description	Permissions
Admin	Full admin control in this organization. Descendants do not inherit Admin from this role, only Owner cascades that access.	84
Editor	Build and run automations without tenant governance write access.	67
Owner	Full control in this organization and every descendant organization. Owner access cascades down the organization tree.	1, represented as a wildcard covering everything
Viewer	Read-only access to all tenant-visible features.	32

Each role has a View option that opens its full permission list.

Add a role

1. Navigate to Settings > Roles.

2. Click Add role.

3. Give your role a clear, unique name.

4. Enter an explanation for who should use this role and what it is for into the Description field.

5. Check off boxes for all desired permissions for this role. Use the Find permissions search bar to narrow down the list by resource or permission key.

6. Click Create role.

Edit a role

If you simply need to view existing permissions for a role, click View instead of edit.

1. Navigate to Settings > Roles.

2. Scroll down the Role catalog list until you find your desired role.

3. Click Edit.

4. Make changes to your role's settings as desired.

5. Click Save changes.

Delete a role

1. Navigate to Settings > Roles.

2. Scroll down the Role catalog list until you find your desired role.

3. Click Delete.

Make role available to child organizations

This doesn't apply to users in the current organization, because local users can already be assigned the role directly here. Scope stays on the availability, not the role itself.

1. Navigate to Settings > Roles.

2. Scroll down the Role catalog list until you find your desired role.

3. Click Make available.

4. Check All customer tenants to set that current and future descendants of this organization can use this role. Leave unchecked if you do not want this setting applied.

5. Pick one or more descendants that should see this role. You may also choose this via previously made tags.

6. Click Save availability.

7. Any settings from previous modifications will appear in the Current availability section of the dialog.

Teams

The teams tab is for grouping people together so that access can be granted to a group rather than repeated person by person. From this tab, create a team, refresh the directory, and manage the membership and roles of a team.

Note that assigning roles to a team is gated separately from creating and editing teams. It is possible to have permission to manage teams while not having permission to assign roles to them, in which case you will see the directory and the create button but not the role controls.

Create a team

1. Navigate to Settings> Teams.

2. Click Add team.

3. Give your team a clear, unique name.

4. Enter an explanation for who is on this team and what they own into the Description field.

5. Assign the team a color. Use the pre-selected Rewst options or add a custom color via preferred hexcode.

6. Assign the team an icon or choose to have no icon for the team.

7. Click Create team.

Manage membership and roles of a team

1. Navigate to Settings> Teams.

   1. Click Manage members.

      1. Enter a name or email into the Add member search field.

      2. Click on your desired member from the search results to add them to the list.

      3. Click Remove next to the user in the list to remove them from the team.

   2. Click Manage roles.

      1. Choose a role to grant to the team from the Assign a role drop-down selector.

      2. Any roles previously granted to the team will appear in the Roles assigned to this team list. Once you add a role, it too will appear here.

Platform Identities

The Platform Identities tab manages the identities workflows use when they act on Rewst itself as opposed to an external system. If your workflows only reach outward into vendor systems, you will rarely need these settings. The tab matters when a workflow needs to perform actions inside Rewst.

Workflows bound to an identity can only perform what its assigned permissions allow. This tab has two distinct permission levels behind it: one for operating an identity, and one for administering it. Two people with access to the same tab may see different controls.

Create an identity

1. Navigate to Settings > Platform identities.

2. Click Create identity.

3. Give your identity a clear, unique name.

4. Enter an explanation of what the identity will do in the Description field.

5. Click Create identity.

Assign roles to an identity

1. Find your desired identity in the identity list.

2. Click ... > Manage roles.

3. Select a role for the identity from the Add another role drop-down selector.

4. Select a role from the Roles in customer orgs drop-down selector to assign this identity a parent-owned role in customer organizations. This doesn't enable sign-in or operation eligibility.

5. Check All current and future customer orgs to set this decision for organizations, even ones created in future. Leave unchecked if you do not want this setting applied.

6. Click Done.

Manage client credentials for an identity

Credentials let the created identity authenticate. They're separate from its Roles, which decide what it's authorized to do.

1. Navigate to Settings > Platform identities.

2. Click ... > Client credentials.

3. View any existing credentials in the dialog that appears.

4. Click Create client secret.

5. Copy the secret generated and displayed in the dialog. It will be shown once and can't be retrieved again.

6. Click Revoke client to invalidate the secret.

7. Click Rotate secret to generate a new secret value.

8. Click Done to close the dialog and lose visibility of secret values.

AI Access

The AI Access tab manages tokens and connected apps that let AI tools reach new Rewst. AI tools connect in one of two ways: a token created and pasted into the tool, or a connected app authorized by signing in. Learn more about MCP functionality in Rewst, including how to use this tab, in our MCP documentation here.

Tags

The Tags tab manages portable tags for the environment. These labels can travel with assets and installed Crates, and a New tag button creates them alongside a Refresh control and a search field. The table lists each tag's color, name, description, and available actions, and prompts the user to create a tag or install a crate to import its tags when none exist yet. For quick visual reference of categories, tags can be color coded.

Example use cases for tags

• Give better visual indicators for your long list of automations, not just text. For example, you could choose to make all Powershell workflows red.

• Tags can also be used to mark associations between pieces of a larger workflow. Consider a parent workflow which contains several child workflows and a form. Each piece of that parent workflow could be tagged with one tag. Then, you’d select that tag to isolate everything for just that one workflow, regardless of the pieces you used to create it.

• Try creating tags for the development status of a workflow: In Development, In Testing, In Production, etc. If your MSP has multiple builders on staff, different individuals will know not to edit or experiment on an In Production workflow, which could cause problems for their team.

Bulk editing workflow tags will overwrite all previous tags currently set for those selected workflows.

Add a tag

1. Navigate to Settings > Tags.

2. Click New tag.

3. Enter a clear, unique name for your tag.

4. Assign the tag a color. Click on the displayed color to expand the color picker, where you may choose from Rewst's preset colors or add your own custom color via hex code.

5. Optionally add a description to provide information for what the tag should be used for.

6. Click Create tag.

Edit a tag

1. Navigate to Settings > Tags.

2. Locate your desired tag in the tags list.

3. Click Edit.

4. Make any changes as desired.

5. Click Save tag.

Delete a tag

1. Navigate to Settings > Tags.

2. Locate your desired tag in the tags list.

3. Click Delete.

4. Confirm click Delete tag.

Activity

The Activity tab lets you view a running audit log of user actions and system events across your workspace. Each row in the log represents a single event, such as a user creating or deleting an org variable, along with who triggered it, what it targeted, and whether it succeeded.

Filter log events by time window, or limit results to a specific action type.

• Click Start live tail to stream new events into the table as they happen instead of requiring a manual refresh.

• Click Export CSV and Export NDJSON to download the current filtered results in those respective formats.

• Click on any record to expand its details: Event ID, Code, and Data.

Data Storage

The Data Storage tab shows guardrails and usage for the workflow datastore, which is where automations keep data between runs. Use it to monitor how much workflow datastore you are consuming and how close you are to hitting the guardrails.

It's Workflow-only, meaning the data belongs to workflow execution rather than general application storage, and Guardrails enforced, meaning the limits described below are actively applied rather than advisory.

• Tenant scope covers this organization alone.

• MSP subtree scope is shared across the MSP tenant tree, with descendant organizations able to read and write to it.

• Each card breaks its usage down into KV keys and records, alongside a remaining-capacity indicator.

• A Critical guardrails section documents the limits that apply to both scopes:

Guardrail	Limit
Default quota	50 MB per scope, with a warning at 80% usage
Default KV TTL	86,400 seconds, or one day
KV limits	Max value of 32 KB, max TTL of 2,592,000 seconds, max namespace length of 128 characters, max key length of 256 characters
Records limits	Max record size of 256 KB, max collection length of 128 characters, max record key length of 256 characters
Records paging and writes	Page size of 50, capped at 500, and a bulk upsert limit of 1,000 items
Records indexing and filtering	Up to 12 indexed fields, max index field length of 128 characters, max index value length of 256 characters, up to 10 filters, and a max cursor length of 1,024 characters

• A Usage details section below breaks consumption down further, with Tenant and MSP Subtree views showing the top namespaces, top collections, and top workflow nodes by storage use.