> For the complete documentation index, see [llms.txt](https://docs.rewst.help/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.rewst.help/rewst-documentation/documentation/settings.md). # Settings Settings in Rewst are robust and can be configured however you desire. This menu governs organization-level configuration and is organized into tabs, each with their own submenus. {% hint style="info" %} Click on any of the menu tab names below to expand and view its documentation. {% endhint %}
General This menu is in development. Check back for documentation updates as we proceed with platform release.
Organizations
The Organizations tab manages the organization hierarchy between your child, customer organizations and your parent, MSP organization. The list contains the current organization's direct child organizations. #### Manually create a new organization in Rewst {% hint style="warning" %} Remember, organizations are divided up into parent and child organizations. Every new customer you onboard into Rewst will need its own separate child org. {% endhint %}
1. Navigate to ![](https://3039672601-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fh0G0em3PH6aDfPoI5XpN%2Fuploads%2F8wYgOUd6u8V96UH3wOv1%2FScreenshot%202026-04-30%20at%203.51.49%E2%80%AFPM.png?alt=media\&token=aa56a51b-dfa6-486e-8855-c60c801596f2) **> Organizations**. 2. Click **+ Add Sub-Org**.\ \ ![A modal window titled “Create a New Organization” within a dark-themed user interface. The form includes several input fields: A checkbox labeled “Enabled” (checked by default) A required “Name” field marked with a red asterisk “Org Slug” field “Domain” field “Microsoft Tenant ID” field A dropdown labeled “Managing Organization ID” with the value “Real Fake Customer” preselected At the bottom of the form are two buttons: a “Cancel” link and a pink “Submit” button. All input fields are styled with a dark background and light text.](https://3039672601-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fh0G0em3PH6aDfPoI5XpN%2Fuploads%2FDupduUVZzN5D7zsCPRN0%2FScreenshot%202026-04-30%20at%203.52.36%E2%80%AFPM.png?alt=media\&token=6b3002b4-faf9-46d7-a384-a92770c680ce) 3. Fill out the following fields in the **Add Sub-Org** dialog that appears: 1. **Organization Name**: This is the display name for the organization - keep it short and recognizable, and avoid special characters 2. **Organization Type**: 3. **Admin Email (optional)**: Fill in this field if you want an admin user to be created. They will be able to sign in using their email and a verification code emailed to that listed address. 4. **Plan**: 5. **Metadata (JSON, optional)**: Use this field to enter optional JSON metadata for custom attributes. 4. Click **Create**. #### Select an organization Once an organization is created, it will appear in the organizations list of this organizations menu, as well as the drop-down organizations selector in the top right of the Rewst platform.

Click ⌄ to expand your organization selector

#### Delete an organization {% hint style="danger" %} Once an organization is deleted, it can’t be brought back, even by Rewst support. Make sure that you intend to delete an organization permanently before proceeding with the following steps. {% endhint %} 1. Click **...** next to the organization you wish to delete. 2. Click **Delete**.\

Delete organizations will only appear once an org has been selected

3. Confirm that you wish to delete the organization in the dialog that appears. 4. Note that the **Recently Deleted** filter in the menu only appears after your org has been deleted, or if an org has been recently deleted.
#### Move an organization 1. Click **...** next to the organization you wish to move. 2. Click **Move**. 3. Choose the new parent org for your selected org. Note that moving this org also moves any orgs nested beneath it. 4. Click **Move**. ![](https://3039672601-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fh0G0em3PH6aDfPoI5XpN%2Fuploads%2FrbrMbVBh09RXMZhwiP1H%2FScreenshot%202026-09-09%20at%2010.49.27%E2%80%AFAM.png?alt=media\&token=aea85816-f333-42e6-965f-d592de1c0e73)
Integrations The Integrations tab is a shortcut to the total Integrations menu. View its documentation [here](/rewst-documentation/documentation/integrations.md).
Credentials The Credentials tab is a shortcut to the total credentials menu. View its documentation [here](/rewst-documentation/documentation/credentials.md).
Auth Methods
The Auth Methods tab defines authentication templates for credentials, including custom templates for vendor-specific authentication flows. The Platform Auth Methods section lists the built-in templates that come stock in the platform and can't be modified. Each entry is tagged with its authentication type and, where relevant, the vendor it was built for. * Custom auth methods are defined in your own organization. * Platform auth methods are built by Rewst and available to everyone.
SSO (Single Sign On) The SSO tab configures OIDC single sign-on for the organization, and lets your people log into Rewst with your existing company login instead of a separate Rewst password. #### OIDC Configuration * **Redirect URI** - Rewst generates this and gives you a copy button - you\ paste it into your identity provider's configuration * **Identity Provider** - select your identity provider to customize field labels and ordering * **IdP Issuer URL** - the OIDC issuer URL must serve a .well-known/openid-configuration endpoint * **Client ID** - The application identifier your provider issues to Rewst * **Client Secret** -the client secret value * **Default Role** - set what new role users receive on first SSO login * **Default MSP Role** - optional MSP-provided role to grant automatically when a qualifying user first signs in via this tenant * **Auto-provision users -** control whether new users are created automatically on sign-in * **Allowed email domains** - Comma-separated list of email domains allowed to auto-provision new users via SSO, which should be left empty to block auto-provisioning for every domain #### Domain Verification Verify ownership of email domains to restrict the SSO login. * Click **Add Domain** to add a new domain * Click **Refresh** to manually push sync the domain * Click **Remove** to remove a domain after it has been added to the list
Users
A *user* in Rewst is an individual. That individual will be allowed to interact with Rewst in some way, as dictated by their role. Users should not be confused with [organizations](#organizations). The Users tab manages people and access for the organization. Because the organization uses email code login, users sign in by entering their email and verifying a code sent to their inbox, and they appear in this list either after their first sign-in or once an admin creates them manually with the **Add User** button. Filter users by search, status, and sign-in method, along with the inclusion or exclusion child-tenant users. Each row lists the user's email, name, assigned roles, status, sign-in method, home tenant, last login, and creation date, with an actions menu for each entry. ### Add and remove users from Rewst Adding users into Rewst allows them access to build workflows, view forms, or update configuration items, like integrations or organization variables. When adding a user, you'll select their role from either the Rewst pre-set roles, or any custom roles that you have already set up. Learn more about roles and how to manage them [here](#roles). #### Add a user to an organization Note that new users need an initial role in the organization before they can sign in. To give a user at your organization access, first double check that the selected organization in the org selector is set to your desired organization. 1. Navigate to **Settings > Users**. 2. Click **Add User**. 3. Enter the **Name** and **Email** of the user into the respective fields. Email is only necessary if you are planning to use the email code option. 4. Select their role from the list in the **Roles** drop- down selector. 5. Choose the **Sign-in type** from the drop-down selector: 1. Password setup link - after creation, a dialog will appear with a link to copy for manual sharing 2. Email code - after creation, an email will be sent to the user 6. Click **Create user**.\ \ ![](https://3039672601-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fh0G0em3PH6aDfPoI5XpN%2Fuploads%2FJTmyjBKYoLvnoPMgiOom%2FScreenshot%202026-09-21%20at%203.32.10%E2%80%AFPM.png?alt=media\&token=99e76e49-7568-403f-8466-a7f1df69dd78)
#### Edit a user's role 1. Navigate to **Settings > Users**. 2. Find your desired user in the Users list. 3. Click .**.. > Manage roles**. 4. Click **Remove** to the far right of the user's record to remove the user's existing role. This will not delete the user. Their other roles will remain, and they'll stay connected to this organization. 5. If you wish to add another role to the user: 1. Select a role from the **Role to add** drop-down selector, or 2. Give the user a role in the customer organizations under this current org, without creating a separate account in each org, via the **Roles in customer orgs** drop-down selector 1. Check the **All customer orgs** checkbox to apply this to every customer org, even orgs created after this settings update 6. Click **Done**. #### Remove a user {% hint style="warning" %} If needed, re-add a removed user by inviting them again. Removing a user won’t remove any workflows they’ve built or delete any activity in the platform, such as results of workflows or edits they made to forms. {% endhint %} 1. Navigate to **Settings > Users**. 2. Find your desired user in the Users list. 3. Click .**.. > Delete**. 4. Confirm that you want to **Delete** in the confirmation dialog that appears. The user will will lose access to this organization and disappear from the active users list. This can't be undone from the UI.
Roles The Roles tab defines scoped permission bundles for assignments and templates. A *role* is a named set of "can do this, can't do that." You build them here, then assign them to individuals in the [users](#users) part of the settings menu. System roles are created by Rewst and can't be edited. Create custom roles when you need a narrower permission bundle for a team, organization, or external identity. The stock, Rewst-set role catalog currently includes: | Role | Description | Permissions | | ------ | -------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------ | | Admin | Full admin control in this organization. Descendants do not inherit Admin from this role, only Owner cascades that access. | 84 | | Editor | Build and run automations without tenant governance write access. | 67 | | Owner | Full control in this organization and every descendant organization. Owner access cascades down the organization tree. | 1, represented as a wildcard covering everything | | Viewer | Read-only access to all tenant-visible features. | 32 | Each role has a **View** option that opens its full permission list. ### Add a role 1. Navigate to **Settings > Roles.** 2. Click **Add role**. 3. Give your role a clear, unique name. 4. Enter an explanation for who should use this role and what it is for into the **Description** field. 5. Check off boxes for all desired permissions for this role. Use the **Find permissions** search bar to narrow down the list by resource or permission key. 6. Click **Create role**.
### Edit a role {% hint style="info" %} If you simply need to view existing permissions for a role, click **View** instead of edit. {% endhint %} 1. Navigate to **Settings > Roles.** 2. Scroll down the **Role catalog** list until you find your desired role. 3. Click **Edit**. 4. Make changes to your role's settings as desired. 5. Click **Save changes**. ### Delete a role 1. Navigate to **Settings > Roles.** 2. Scroll down the **Role catalog** list until you find your desired role. 3. Click **Delete**. ### Make role available to child organizations This doesn't apply to users in the current organization, because local users can already be assigned the role directly here. Scope stays on the availability, not the role itself. 1. Navigate to **Settings > Roles.** 2. Scroll down the **Role catalog** list until you find your desired role. 3. Click **Make available**. 4. Check **All customer tenants** to set that current and future descendants of this organization can use this role. Leave unchecked if you do not want this setting applied. 5. Pick one or more descendants that should see this role. You may also choose this via previously made tags. 6. Click **Save availability.** 7. Any settings from previous modifications will appear in the **Current availability** section of the dialog.
Teams The teams tab is for grouping people together so that access can be granted to\ a group rather than repeated person by person. From this tab, create a team, refresh the directory, and manage the membership and roles of a team. {% hint style="info" %} Note that assigning roles to a team is gated separately from creating and editing teams. It is possible to have permission to manage teams while not having permission to assign roles to them, in which case you will see the directory and the create button but not the role controls. {% endhint %} ### Create a team 1. Navigate to **Settings> Teams**. 2. Click **Add team**. 3. Give your team a clear, unique name. 4. Enter an explanation for who is on this team and what they own into the **Description** field. 5. Assign the team a color. Use the pre-selected Rewst options or add a custom color via preferred hexcode. 6. Assign the team an icon or choose to have no icon for the team. 7. Click **Create team**. ### Manage membership and roles of a team 1. Navigate to **Settings> Teams**. 1. Click **Manage members**. 1. Enter a name or email into the **Add member** search field. 2. Click on your desired member from the search results to add them to the list. 3. Click **Remove** next to the user in the list to remove them from the team. 2. Click **Manage roles**. 1. Choose a role to grant to the team from the **Assign a role** drop-down selector. 2. Any roles previously granted to the team will appear in the **Roles assigned to this team** list. Once you add a role, it too will appear here.
Platform Identities The Platform Identities tab manages the identities workflows use when they act on Rewst itself as opposed to an external system. If your workflows only reach outward into vendor\ systems, you will rarely need these settings. The tab matters when a workflow needs to perform actions inside Rewst. Workflows bound to an identity can only perform what its assigned permissions allow. This tab has two distinct permission levels behind it: one for operating an identity, and one for administering it. Two people with access to the same tab may see different controls. ### Create an identity 1. Navigate to **Settings > Platform identities.** 2. Click **Create identity**. 3. Give your identity a clear, unique name. 4. Enter an explanation of what the identity will do in the **Description** field. 5. Click **Create identity**. ### Assign roles to an identity 1. Find your desired identity in the identity list. 2. Click **... > Manage roles**. 3. Select a role for the identity from the **Add another role** drop-down selector. 4. Select a role from the **Roles in customer orgs** drop-down selector to assign this identity a parent-owned role in customer organizations. This doesn't enable sign-in or operation eligibility. 5. Check **All current and future customer orgs** to set this decision for organizations, even ones created in future. Leave unchecked if you do not want this setting applied. 6. Click **Done**. ### Manage client credentials for an identity Credentials let the created identity authenticate. They're separate from its Roles, which decide what it's authorized to do. 1. Navigate to **Settings > Platform identities.** 2. Click **... > Client credentials**. 3. View any existing credentials in the dialog that appears. 4. Click **Create client secret**. 5. Copy the secret generated and displayed in the dialog. It will be shown once and can't be retrieved again. 6. Click **Revoke client** to invalidate the secret. 7. Click **Rotate secret** to generate a new secret value. 8. Click **Done** to close the dialog and lose visibility of secret values.
AI Access The AI Access tab manages tokens and connected apps that let AI tools reach new Rewst. AI tools connect in one of two ways: a token created and pasted into the tool, or a connected app authorized by signing in. Learn more about MCP functionality in Rewst, including how to use this tab, in our MCP documentation [here](/rewst-documentation/documentation/rewst-agent/mcp-servers-and-rewst.md).
Tags The Tags tab manages portable tags for the environment. These labels can travel with assets and installed Crates, and a **New tag** button creates them alongside a **Refresh** control and a search field. The table lists each tag's color, name, description, and available actions, and prompts the user to create a tag or install a crate to import its tags when none exist yet. For quick visual reference of categories, tags can be color coded.
### Example use cases for tags * Give better visual indicators for your long list of automations, not just text. For example, you could choose to make all Powershell workflows red. * Tags can also be used to mark associations between pieces of a larger workflow. Consider a parent workflow which contains several child workflows and a form. Each piece of that parent workflow could be tagged with one tag. Then, you’d select that tag to isolate everything for just that one workflow, regardless of the pieces you used to create it. * Try creating tags for the development status of a workflow: In Development, In Testing, In Production, etc. If your MSP has multiple builders on staff, different individuals will know not to edit or experiment on an In Production workflow, which could cause problems for their team. {% hint style="warning" %} Bulk editing workflow tags will overwrite all previous tags currently set for those selected workflows. {% endhint %} ### Add a tag 1. Navigate to **Settings > Tags**. 2. Click **New tag**. 3. Enter a clear, unique name for your tag. 4. Assign the tag a color. Click on the displayed color to expand the color picker, where you may choose from Rewst's preset colors or add your own custom color via hex code. 5. Optionally add a description to provide information for what the tag should be used for. 6. Click **Create tag**. ### Edit a tag 1. Navigate to **Settings > Tags**. 2. Locate your desired tag in the tags list. 3. Click **Edit**. 4. Make any changes as desired. 5. Click **Save tag**. ### Delete a tag 1. Navigate to **Settings > Tags**. 2. Locate your desired tag in the tags list. 3. Click **Delete**. 4. Confirm click **Delete tag**.
Activity
The Activity tab lets you view a running audit log of user actions and system events across your workspace. Each row in the log represents a single event, such as a user creating or deleting an org variable, along with who triggered it, what it targeted, and whether it succeeded. Filter log events by time window, or limit results to a specific action type. * Click **Start live tail** to stream new events into the table as they happen instead of requiring a manual refresh. * Click **Export CSV** and **Export NDJSON** to download the current filtered results in those respective formats. * Click on any record to expand its details: **Event ID**, **Code**, and **Data**.
Data Storage The Data Storage tab shows guardrails and usage for the workflow *datastore*, which is where automations keep data between runs. Use it to monitor how much workflow datastore you are consuming and how close you are to hitting the guardrails. It's Workflow-only, meaning the data belongs to workflow execution rather than general application storage, and Guardrails enforced, meaning the limits described below are actively applied rather than advisory. * Tenant scope covers this organization alone. * MSP subtree scope is shared across the MSP tenant tree, with descendant organizations able to read and write to it. * Each card breaks its usage down into KV keys and records, alongside a remaining-capacity indicator. * A Critical guardrails section documents the limits that apply to both scopes: | Guardrail | Limit | | ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Default quota | 50 MB per scope, with a warning at 80% usage | | Default KV TTL | 86,400 seconds, or one day | | KV limits | Max value of 32 KB, max TTL of 2,592,000 seconds, max namespace length of 128 characters, max key length of 256 characters | | Records limits | Max record size of 256 KB, max collection length of 128 characters, max record key length of 256 characters | | Records paging and writes | Page size of 50, capped at 500, and a bulk upsert limit of 1,000 items | | Records indexing and filtering | Up to 12 indexed fields, max index field length of 128 characters, max index value length of 256 characters, up to 10 filters, and a max cursor length of 1,024 characters | * A Usage details section below breaks consumption down further, with Tenant and MSP Subtree views showing the top namespaces, top collections, and top workflow nodes by storage use.
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.rewst.help/rewst-documentation/documentation/settings.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.