# CLAUDE
Source: https://altostrat.io/docs/CLAUDE
# Mintlify documentation
## Working relationship
* You can push back on ideas-this can lead to better documentation. Cite sources and explain your reasoning when you do so
* ALWAYS ask for clarification rather than making assumptions
* NEVER lie, guess, or make up information
## Project context
* Format: MDX files with YAML frontmatter
* Config: docs.json for navigation, theme, settings
* Components: Mintlify components
* Weekly Studio changelog: see `/changelog-update` slash command for the maintenance process. Source git history lives in `~/prototype`.
## Content strategy
* Document just enough for user success - not too much, not too little
* Prioritize accuracy and usability of information
* Make content evergreen when possible
* Search for existing information before adding new content. Avoid duplication unless it is done for a strategic reason
* Check existing patterns for consistency
* Start by making the smallest reasonable changes
## docs.json
* Refer to the [docs.json schema](https://mintlify.com/docs.json) when building the docs.json file and site navigation
## Frontmatter requirements for pages
* title: Clear, descriptive page title
* description: Concise summary for SEO/navigation
## Writing standards
* Second-person voice ("you")
* Prerequisites at start of procedural content
* Test all code examples before publishing
* Match style and formatting of existing pages
* Include both basic and advanced use cases
* Language tags on all code blocks
* Alt text on all images
* Relative paths for internal links
## Git workflow
* NEVER use --no-verify when committing
* Ask how to handle uncommitted changes before starting
* Create a new branch when no clear branch exists for changes
* Commit frequently throughout development
* NEVER skip or disable pre-commit hooks
## Do not
* Skip frontmatter on any MDX file
* Use absolute URLs for internal links
* Include untested code examples
* Make assumptions - always ask for clarification
# Generate a temporary access token
Source: https://altostrat.io/docs/api/en/access-tokens/generate-a-temporary-access-token
/api/en/faults.yaml post /fault/token
Generates a short-lived JSON Web Token (JWT) that can be used to provide temporary, read-only access to specific fault data, typically for embedding in external dashboards.
# Read a shared health dashboard
Source: https://altostrat.io/docs/api/en/access-tokens/read-a-shared-health-dashboard
/api/en/faults.yaml get /fault/token/{id}
Returns the fault list associated with a shared health-dashboard token.
# Attach Tag to Container
Source: https://altostrat.io/docs/api/en/account-containers/attach-tag-to-container
/api/en/radius.yaml post /radius/account-containers/{id}/tags/{tagId}
# Create Container
Source: https://altostrat.io/docs/api/en/account-containers/create-container
/api/en/radius.yaml post /radius/account-containers
# Delete Container
Source: https://altostrat.io/docs/api/en/account-containers/delete-container
/api/en/radius.yaml delete /radius/account-containers/{id}
Deletes a container. The container must be empty (no child containers or accounts).
# Detach Tag from Container
Source: https://altostrat.io/docs/api/en/account-containers/detach-tag-from-container
/api/en/radius.yaml delete /radius/account-containers/{id}/tags/{tagId}
# Get Container
Source: https://altostrat.io/docs/api/en/account-containers/get-container
/api/en/radius.yaml get /radius/account-containers/{id}
# List Containers
Source: https://altostrat.io/docs/api/en/account-containers/list-containers
/api/en/radius.yaml get /radius/account-containers
Retrieve a list of account containers. Can be filtered by parent or level for tree traversal. Includes a separate list of pinned containers.
# Move Container
Source: https://altostrat.io/docs/api/en/account-containers/move-container
/api/en/radius.yaml post /radius/account-containers/{id}/move
Initiates an asynchronous job to move a container (and its entire subtree) to a new parent.
# Pin Container
Source: https://altostrat.io/docs/api/en/account-containers/pin-container
/api/en/radius.yaml post /radius/account-containers/{id}/pin
Pins a container to the user's dashboard/sidebar for quick access.
# Transfer Users
Source: https://altostrat.io/docs/api/en/account-containers/transfer-users
/api/en/radius.yaml post /radius/account-containers/{id}/transfer-users
Bulk transfer all users from this container to another container.
# Unpin Container
Source: https://altostrat.io/docs/api/en/account-containers/unpin-container
/api/en/radius.yaml delete /radius/account-containers/{id}/pin
Removes a container from the user's pinned list.
# Update Container
Source: https://altostrat.io/docs/api/en/account-containers/update-container
/api/en/radius.yaml patch /radius/account-containers/{id}
# Attach Tag to Account
Source: https://altostrat.io/docs/api/en/accounts/attach-tag-to-account
/api/en/radius.yaml post /radius/accounts/{id}/tags/{tagId}
# Create an Account
Source: https://altostrat.io/docs/api/en/accounts/create-an-account
/api/en/radius.yaml post /radius/accounts
# Delete an Account
Source: https://altostrat.io/docs/api/en/accounts/delete-an-account
/api/en/radius.yaml delete /radius/accounts/{id}
# Detach Tag from Account
Source: https://altostrat.io/docs/api/en/accounts/detach-tag-from-account
/api/en/radius.yaml delete /radius/accounts/{id}/tags/{tagId}
# List Account Groups
Source: https://altostrat.io/docs/api/en/accounts/list-account-groups
/api/en/radius.yaml get /radius/accounts/{id}/groups
# List Accounts
Source: https://altostrat.io/docs/api/en/accounts/list-accounts
/api/en/radius.yaml get /radius/accounts
# Move Account
Source: https://altostrat.io/docs/api/en/accounts/move-account
/api/en/radius.yaml post /radius/accounts/{id}/move
Move an account to a different container.
# Retrieve an Account
Source: https://altostrat.io/docs/api/en/accounts/retrieve-an-account
/api/en/radius.yaml get /radius/accounts/{id}
# Update an Account
Source: https://altostrat.io/docs/api/en/accounts/update-an-account
/api/en/radius.yaml patch /radius/accounts/{id}
# Generate Script from Prompt
Source: https://altostrat.io/docs/api/en/ai-script-generation/generate-script-from-prompt
/api/en/scripts.yaml post /scripts/gen-ai
Submits a natural language prompt to the AI engine to generate a MikroTik RouterOS script. The response includes the generated script content, a flag indicating if the script is potentially destructive, and any errors or warnings from the AI.
# Get top faulty resources
Source: https://altostrat.io/docs/api/en/analytics/get-top-faulty-resources
/api/en/faults.yaml get /fault/top_faults
Retrieves a list of the top 10 most frequently faulting resources over the last 14 days, along with a sample of their most recent fault events. This is useful for identifying problematic areas in your network.
# List faults from the last seven days
Source: https://altostrat.io/docs/api/en/analytics/list-faults-from-the-last-seven-days
/api/en/faults.yaml get /fault/last-7-days
Returns recent fault records for the last seven days for dashboard and health views.
# Create an API key
Source: https://altostrat.io/docs/api/en/api-keys/create-an-api-key
/api/en/api-keys.yaml post /api/keys
Creates an API key with the selected permissions. The `secret` is shown exactly once in the response, so store it in a secret manager before you close the dialog or discard the response body.
# Delete an API key
Source: https://altostrat.io/docs/api/en/api-keys/delete-an-api-key
/api/en/api-keys.yaml delete /api/keys/{id}
Revokes an API key and removes its backing machine-to-machine application.
# List API keys
Source: https://altostrat.io/docs/api/en/api-keys/list-api-keys
/api/en/api-keys.yaml get /api/keys
Returns the API keys owned by the current organization. Secrets are never returned from this endpoint.
# Retrieve an API key
Source: https://altostrat.io/docs/api/en/api-keys/retrieve-an-api-key
/api/en/api-keys.yaml get /api/keys/{id}
Returns metadata for one API key. The secret is not returned.
# Rotate an API key secret
Source: https://altostrat.io/docs/api/en/api-keys/rotate-an-api-key-secret
/api/en/api-keys.yaml post /api/keys/{id}/rotate
Rotates the API key secret and invalidates the previous secret. The new `secret` is shown exactly once in the response.
# Search ARP Entries
Source: https://altostrat.io/docs/api/en/arp-inventory/search-arp-entries
/api/en/monitoring-metrics.yaml post /metrics/arps
Performs a paginated search for ARP entries across one or more sites, with options for filtering and sorting. This is the primary endpoint for building an inventory of connected devices.
# Update ARP Entry
Source: https://altostrat.io/docs/api/en/arp-inventory/update-arp-entry
/api/en/monitoring-metrics.yaml put /metrics/arps/{siteId}/{arpEntryId}
Updates metadata for a specific ARP entry, such as assigning it to a group or setting a custom alias.
# List audit log events
Source: https://altostrat.io/docs/api/en/audit-logs/list-audit-log-events
/api/en/audit-logs.yaml get /audit-logs
Retrieve a list of audit log events for your organization. This endpoint supports powerful filtering and pagination to help you find specific events for security, compliance, or debugging purposes.
Results are returned in reverse chronological order (most recent first) by default.
# Create an auth integration
Source: https://altostrat.io/docs/api/en/auth-integrations/create-an-auth-integration
/api/en/captive-portal.yaml post /captive/auth-integrations
Creates a new authentication integration for use with captive portal instances that have an 'oauth2' strategy.
# Delete an auth integration
Source: https://altostrat.io/docs/api/en/auth-integrations/delete-an-auth-integration
/api/en/captive-portal.yaml delete /captive/auth-integrations/{authIntegrationId}
Permanently deletes an authentication integration. This action cannot be undone and may affect captive portal instances that rely on it.
# List all auth integrations
Source: https://altostrat.io/docs/api/en/auth-integrations/list-all-auth-integrations
/api/en/captive-portal.yaml get /captive/auth-integrations
Retrieves a list of all OAuth2 authentication integrations (IDPs) configured for the user's account.
# Retrieve an auth integration
Source: https://altostrat.io/docs/api/en/auth-integrations/retrieve-an-auth-integration
/api/en/captive-portal.yaml get /captive/auth-integrations/{authIntegrationId}
Retrieves the details of a specific authentication integration by its unique ID.
# Update an auth integration
Source: https://altostrat.io/docs/api/en/auth-integrations/update-an-auth-integration
/api/en/captive-portal.yaml put /captive/auth-integrations/{authIntegrationId}
Updates the configuration of an existing authentication integration.
# Create a workflow authorization URL
Source: https://altostrat.io/docs/api/en/authorizations/create-a-workflow-authorization-url
/api/en/workflows.yaml post /workflows/authorization
Creates an authorization flow URL that lets a workflow act on behalf of the current user.
# Delete a workflow authorization
Source: https://altostrat.io/docs/api/en/authorizations/delete-a-workflow-authorization
/api/en/workflows.yaml delete /workflows/authorization/{authId}
Deletes a workflow authorization so workflows can no longer use that delegated account context.
# List workflow authorizations
Source: https://altostrat.io/docs/api/en/authorizations/list-workflow-authorizations
/api/en/workflows.yaml get /workflows/authorization
Returns workflow account authorizations available to the authenticated user.
# List Backups for a Site
Source: https://altostrat.io/docs/api/en/backups/list-backups-for-a-site
/api/en/backups.yaml get /backup/{siteId}
Retrieves a list of all available configuration backup files for a specific site, sorted from newest to oldest. This allows you to see the entire history of captured configurations for a device.
# List discovered site subnets
Source: https://altostrat.io/docs/api/en/backups/list-discovered-site-subnets
/api/en/backups.yaml get /backup/{siteId}/subnets
Returns the subnet routes discovered from the latest configuration data for a site. SDX uses this when you attach site subnets to captive portal, VPN, CVE scan, and other network services.
# Request a New Backup
Source: https://altostrat.io/docs/api/en/backups/request-a-new-backup
/api/en/backups.yaml post /backup/{siteId}
Asynchronously triggers a new configuration backup for the specified site. The backup process runs in the background. This endpoint returns immediately with a status indicating the request has been accepted for processing.
# Retrieve a Specific Backup
Source: https://altostrat.io/docs/api/en/backups/retrieve-a-specific-backup
/api/en/backups.yaml get /backup/{siteId}/{filename}
Fetches the contents of a specific backup file. The format of the response can be controlled via HTTP headers to return JSON metadata, raw text, highlighted HTML, or a downloadable file.
# Create a BGP Threat Intelligence Policy
Source: https://altostrat.io/docs/api/en/bgp-threat-intelligence/create-a-bgp-threat-intelligence-policy
/api/en/utm-ips.yaml post /content/bgp/policy
Creates a new BGP policy, specifying which IP reputation lists to use for blocking traffic.
# Delete a BGP Policy
Source: https://altostrat.io/docs/api/en/bgp-threat-intelligence/delete-a-bgp-policy
/api/en/utm-ips.yaml delete /content/bgp/policy/{policyId}
Permanently deletes a BGP policy. This operation will fail if the policy is currently attached to one or more sites.
# List BGP IP Reputation Lists
Source: https://altostrat.io/docs/api/en/bgp-threat-intelligence/list-bgp-ip-reputation-lists
/api/en/utm-ips.yaml get /content/bgp/category
Retrieves a list of all available BGP IP reputation lists that can be included in a BGP policy.
# List BGP Threat Intelligence Policies
Source: https://altostrat.io/docs/api/en/bgp-threat-intelligence/list-bgp-threat-intelligence-policies
/api/en/utm-ips.yaml get /content/bgp/policy
Retrieves a list of all BGP Threat Intelligence policies associated with your account.
# Retrieve a BGP Policy
Source: https://altostrat.io/docs/api/en/bgp-threat-intelligence/retrieve-a-bgp-policy
/api/en/utm-ips.yaml get /content/bgp/policy/{policyId}
Retrieves the details of a specific BGP Threat Intelligence policy by its unique identifier.
# Update a BGP Policy
Source: https://altostrat.io/docs/api/en/bgp-threat-intelligence/update-a-bgp-policy
/api/en/utm-ips.yaml put /content/bgp/policy/{policyId}
Updates the properties of an existing BGP policy, including its name, status, selected IP lists, and site attachments.
# Create a billing account
Source: https://altostrat.io/docs/api/en/billing-accounts/create-a-billing-account
/api/en/workspaces.yaml post /workspaces/{workspaceId}/billing-accounts
Creates a new billing account within a workspace. This also creates a corresponding Customer object in Stripe. The behavior is constrained by the workspace's billing mode; for `single` mode, only one billing account can be created. For `pooled` and `assigned` modes, up to 10 can be created.
# Delete a billing account
Source: https://altostrat.io/docs/api/en/billing-accounts/delete-a-billing-account
/api/en/workspaces.yaml delete /workspaces/{workspaceId}/billing-accounts/{billingAccountId}
Permanently deletes a billing account. This action cannot be undone. A billing account cannot be deleted if it has any active subscriptions.
# List billing accounts
Source: https://altostrat.io/docs/api/en/billing-accounts/list-billing-accounts
/api/en/workspaces.yaml get /workspaces/{workspaceId}/billing-accounts
Returns a list of billing accounts associated with a workspace.
# Retrieve a billing account
Source: https://altostrat.io/docs/api/en/billing-accounts/retrieve-a-billing-account
/api/en/workspaces.yaml get /workspaces/{workspaceId}/billing-accounts/{billingAccountId}
Retrieves the details of a specific billing account.
# Update a billing account
Source: https://altostrat.io/docs/api/en/billing-accounts/update-a-billing-account
/api/en/workspaces.yaml patch /workspaces/{workspaceId}/billing-accounts/{billingAccountId}
Updates the details of a billing account. Any parameters not provided will be left unchanged. This operation also updates the corresponding Customer object in Stripe.
# Create a captive portal instance
Source: https://altostrat.io/docs/api/en/captive-portal-instances/create-a-captive-portal-instance
/api/en/captive-portal.yaml post /captive/instances
Creates a new captive portal instance with a basic configuration. Further details, such as themes and sites, can be added via an update operation.
# Delete a captive portal instance
Source: https://altostrat.io/docs/api/en/captive-portal-instances/delete-a-captive-portal-instance
/api/en/captive-portal.yaml delete /captive/instances/{instanceId}
Permanently deletes a captive portal instance and all associated subnets, sites, coupons, and assets. This action cannot be undone.
# List all captive portal instances
Source: https://altostrat.io/docs/api/en/captive-portal-instances/list-all-captive-portal-instances
/api/en/captive-portal.yaml get /captive/instances
Retrieves a list of all captive portal instances accessible to the authenticated user.
# Retrieve a captive portal instance
Source: https://altostrat.io/docs/api/en/captive-portal-instances/retrieve-a-captive-portal-instance
/api/en/captive-portal.yaml get /captive/instances/{instanceId}
Retrieves the complete details of a specific captive portal instance by its unique ID.
# Update a captive portal instance
Source: https://altostrat.io/docs/api/en/captive-portal-instances/update-a-captive-portal-instance
/api/en/captive-portal.yaml put /captive/instances/{instanceId}
Updates the configuration of a specific captive portal instance, including its theme, sites, subnets, and other settings.
# Upload an instance image
Source: https://altostrat.io/docs/api/en/captive-portal-instances/upload-an-instance-image
/api/en/captive-portal.yaml post /captive/instances/{instanceId}/images/{type}
Uploads a logo or icon for a specific captive portal instance. The image will be stored and served via a signed URL in the instance's theme.
# Download Client CA
Source: https://altostrat.io/docs/api/en/certificates/download-client-ca
/api/en/radius.yaml get /radius/client-ca/certificate
# Download NAS Certificate
Source: https://altostrat.io/docs/api/en/certificates/download-nas-certificate
/api/en/radius.yaml get /radius/nas/{id}/certificates/certificate
# Download NAS Private Key
Source: https://altostrat.io/docs/api/en/certificates/download-nas-private-key
/api/en/radius.yaml get /radius/nas/{id}/certificates/private-key
# Fetch a VPN client configuration
Source: https://altostrat.io/docs/api/en/client-configuration/fetch-a-vpn-client-configuration
/api/en/managed-vpn.yaml get /vpn/client
Returns the VPN client configuration for a share token. The portal calls this endpoint with the share token in the bearer `Authorization` header.
# Add a comment to a fault
Source: https://altostrat.io/docs/api/en/comments/add-a-comment-to-a-fault
/api/en/faults.yaml post /fault/{faultId}/comment
Adds a new comment to an existing fault. Comments are useful for tracking troubleshooting steps, adding context, or communicating with team members about an incident.
# Get Raw README Content
Source: https://altostrat.io/docs/api/en/community-scripts/get-raw-readme-content
/api/en/scripts.yaml get /scripts/community-scripts/{communityScriptId}.md
Downloads the raw, plain-text markdown content of a community script's README file, if one exists.
# Get Raw Script Content
Source: https://altostrat.io/docs/api/en/community-scripts/get-raw-script-content
/api/en/scripts.yaml get /scripts/community-scripts/{communityScriptId}.rsc
Downloads the raw, plain-text content of a community script, suitable for direct use or inspection.
# List Community Scripts
Source: https://altostrat.io/docs/api/en/community-scripts/list-community-scripts
/api/en/scripts.yaml get /scripts/community-scripts
Retrieves a paginated list of scripts from the public community repository. This is a valuable resource for finding pre-built solutions for common MikroTik tasks.
# Retrieve a Community Script
Source: https://altostrat.io/docs/api/en/community-scripts/retrieve-a-community-script
/api/en/scripts.yaml get /scripts/community-scripts/{communityScriptId}
Fetches detailed information about a specific community script, including its content, description, and metadata about the author and source repository.
# Submit a Community Script
Source: https://altostrat.io/docs/api/en/community-scripts/submit-a-community-script
/api/en/scripts.yaml post /scripts/community-scripts
Submits a new script to the community repository by providing a URL to a raw `.rsc` file on GitHub. The system will then fetch the script content and associated repository metadata.
# Create a coupon schedule
Source: https://altostrat.io/docs/api/en/coupon-schedules/create-a-coupon-schedule
/api/en/captive-portal.yaml post /captive/instances/{instanceId}/coupon-schedules
Creates a new schedule to automatically generate coupons on a recurring basis (daily, weekly, or monthly).
# Delete a coupon schedule
Source: https://altostrat.io/docs/api/en/coupon-schedules/delete-a-coupon-schedule
/api/en/captive-portal.yaml delete /captive/instances/{instanceId}/coupon-schedules/{scheduleId}
Permanently deletes a coupon schedule. This will not delete coupons that have already been generated by the schedule.
# Generate a signed coupon URL
Source: https://altostrat.io/docs/api/en/coupon-schedules/generate-a-signed-coupon-url
/api/en/captive-portal.yaml get /captive/instances/{instanceId}/coupon-schedules/{scheduleId}/generate_url
Creates a temporary, signed URL that can be used to retrieve the list of valid coupons generated by a specific schedule. This is useful for distributing coupons to third-party systems without exposing API keys. The URL is valid for 24 hours.
# List coupon schedules
Source: https://altostrat.io/docs/api/en/coupon-schedules/list-coupon-schedules
/api/en/captive-portal.yaml get /captive/instances/{instanceId}/coupon-schedules
Retrieves a list of all coupon generation schedules for a specific captive portal instance.
# Retrieve a coupon schedule
Source: https://altostrat.io/docs/api/en/coupon-schedules/retrieve-a-coupon-schedule
/api/en/captive-portal.yaml get /captive/instances/{instanceId}/coupon-schedules/{scheduleId}
Retrieves the details of a specific coupon schedule by its ID.
# Run a coupon schedule now
Source: https://altostrat.io/docs/api/en/coupon-schedules/run-a-coupon-schedule-now
/api/en/captive-portal.yaml post /captive/instances/{instanceId}/coupon-schedules/{scheduleId}/run
Manually triggers a coupon schedule to generate a new batch of coupons immediately, outside of its normal recurrence.
# Update a coupon schedule
Source: https://altostrat.io/docs/api/en/coupon-schedules/update-a-coupon-schedule
/api/en/captive-portal.yaml put /captive/instances/{instanceId}/coupon-schedules/{scheduleId}
Updates the configuration of an existing coupon schedule.
# Create coupons
Source: https://altostrat.io/docs/api/en/coupons/create-coupons
/api/en/captive-portal.yaml post /captive/instances/{instanceId}/coupons
Generates a batch of one-time use coupons for a specified captive portal instance.
# List valid coupons for an instance
Source: https://altostrat.io/docs/api/en/coupons/list-valid-coupons-for-an-instance
/api/en/captive-portal.yaml get /captive/instances/{instanceId}/coupons
Retrieves a list of all valid (unredeemed and not expired) coupons for a specific captive portal instance.
# Get Data Transferred Volume
Source: https://altostrat.io/docs/api/en/dashboard/get-data-transferred-volume
/api/en/monitoring-metrics.yaml get /metrics/dashboard/data-transferred
Retrieves the total volume of data transferred (in bytes) across specified sites, aggregated into time buckets. Use this endpoint to analyze data consumption and usage patterns.
# Get Network Throughput
Source: https://altostrat.io/docs/api/en/dashboard/get-network-throughput
/api/en/monitoring-metrics.yaml get /metrics/dashboard/throughput
Retrieves time-series data representing the average network throughput (in bits per second) across specified sites over a given time window. Use this endpoint to visualize traffic rates for dashboards and reports.
# Delete Job
Source: https://altostrat.io/docs/api/en/data-migration/delete-job
/api/en/radius.yaml delete /radius/migration/jobs/{jobId}
# Download Example CSV
Source: https://altostrat.io/docs/api/en/data-migration/download-example-csv
/api/en/radius.yaml get /radius/migration/examples/{type}.csv
Download a template CSV file for bulk import.
# Get Columns
Source: https://altostrat.io/docs/api/en/data-migration/get-columns
/api/en/radius.yaml get /radius/migration/columns/{type}
# Get Job Status
Source: https://altostrat.io/docs/api/en/data-migration/get-job-status
/api/en/radius.yaml get /radius/migration/jobs/{jobId}
# Get Upload URL
Source: https://altostrat.io/docs/api/en/data-migration/get-upload-url
/api/en/radius.yaml get /radius/migration/signed-url
# List Jobs
Source: https://altostrat.io/docs/api/en/data-migration/list-jobs
/api/en/radius.yaml get /radius/migration/jobs
# Preview File
Source: https://altostrat.io/docs/api/en/data-migration/preview-file
/api/en/radius.yaml get /radius/migration/{filename}/preview
# Start Dry Run
Source: https://altostrat.io/docs/api/en/data-migration/start-dry-run
/api/en/radius.yaml post /radius/migration/dry-run
# Start Import
Source: https://altostrat.io/docs/api/en/data-migration/start-import
/api/en/radius.yaml post /radius/migration/import
# Queue an asynchronous RouterOS script
Source: https://altostrat.io/docs/api/en/developer-api/queue-an-asynchronous-routeros-script
/api/en/mikrotik-api.yaml post /api/asynchronous/{siteId}
Queues a RouterOS script for execution on a managed site. Use asynchronous scripts for configuration changes, backups, and work that should be tracked as a device job.
# Run a synchronous RouterOS command
Source: https://altostrat.io/docs/api/en/developer-api/run-a-synchronous-routeros-command
/api/en/mikrotik-api.yaml post /api/synchronous/{siteId}
Runs a RouterOS command against a managed site and returns the router response. Use synchronous commands for reads or short diagnostics, not long-running configuration changes.
# Get router metadata
Source: https://altostrat.io/docs/api/en/developer-routers/get-router-metadata
/api/en/mikrotik-api.yaml get /api/routers/{siteId}/metadata
Get router metadata exposed by the SDX developer API for a managed router.
# Get router metrics summary
Source: https://altostrat.io/docs/api/en/developer-routers/get-router-metrics-summary
/api/en/mikrotik-api.yaml get /api/routers/{siteId}/metrics
Get router metrics summary exposed by the SDX developer API for a managed router.
# Get router OEM data
Source: https://altostrat.io/docs/api/en/developer-routers/get-router-oem-data
/api/en/mikrotik-api.yaml get /api/routers/{siteId}/oem
Get router OEM data exposed by the SDX developer API for a managed router.
# List developer API routers
Source: https://altostrat.io/docs/api/en/developer-routers/list-developer-api-routers
/api/en/mikrotik-api.yaml get /api/routers
Lists routers that the authenticated API key or user can access through the developer API.
# List router faults
Source: https://altostrat.io/docs/api/en/developer-routers/list-router-faults
/api/en/mikrotik-api.yaml get /api/routers/{siteId}/faults
List router faults exposed by the SDX developer API for a managed router.
# List router jobs
Source: https://altostrat.io/docs/api/en/developer-routers/list-router-jobs
/api/en/mikrotik-api.yaml get /api/routers/{siteId}/jobs
List router jobs exposed by the SDX developer API for a managed router.
# Get Device Heartbeat History
Source: https://altostrat.io/docs/api/en/device-health-&-status/get-device-heartbeat-history
/api/en/monitoring-metrics.yaml get /metrics/mikrotik-stats/{siteId}
Retrieves the device's heartbeat and connectivity status over the past 24 hours, aggregated hourly. This helps identify periods of downtime or missed check-ins.
# Get Last Seen Time
Source: https://altostrat.io/docs/api/en/device-health-&-status/get-last-seen-time
/api/en/monitoring-metrics.yaml get /metrics/last-seen/{siteId}
Returns the time since the device at the specified site last reported its status.
# Get Recent Device Health Stats
Source: https://altostrat.io/docs/api/en/device-health-&-status/get-recent-device-health-stats
/api/en/monitoring-metrics.yaml get /metrics/mikrotik-stats-all/{siteId}
Retrieves a time-series of key health metrics (CPU, memory, disk, uptime) for a specific site's device from the last 8 hours.
# Retrieve Site Stats Over a Date Range
Source: https://altostrat.io/docs/api/en/device-stats/retrieve-site-stats-over-a-date-range
/api/en/mikrotik-api.yaml get /sites/{siteId}/mikrotik-stats
Fetches time-series performance metrics (CPU, memory, disk, uptime) for a site within a specified date range. For ranges over 48 hours, data is automatically aggregated hourly to ensure a fast response. For shorter ranges, raw data points are returned.
# JSON Web Key Set (JWKS) Endpoint
Source: https://altostrat.io/docs/api/en/discovery/json-web-key-set-jwks-endpoint
/api/en/authentication.yaml get /.well-known/jwks.json
Provides the set of public keys used to verify the signature of JWTs issued by the authentication server. Clients should use the `kid` (Key ID) from a JWT's header to select the correct key for validation.
# OIDC Discovery Endpoint
Source: https://altostrat.io/docs/api/en/discovery/oidc-discovery-endpoint
/api/en/authentication.yaml get /.well-known/openid-configuration
Returns a JSON document containing the OpenID Provider's configuration metadata. OIDC-compliant clients use this endpoint to automatically discover the locations of the authorization, token, userinfo, and JWKS endpoints, as well as all supported capabilities.
# Create a DNS Content Filtering Policy
Source: https://altostrat.io/docs/api/en/dns-content-filtering/create-a-dns-content-filtering-policy
/api/en/utm-ips.yaml post /content/policy
Creates a new DNS Content Filtering policy with specified filtering rules, application blocks, and safe search settings.
# Delete a DNS Policy
Source: https://altostrat.io/docs/api/en/dns-content-filtering/delete-a-dns-policy
/api/en/utm-ips.yaml delete /content/policy/{policyId}
Permanently deletes a DNS policy. This operation will fail if the policy is currently attached to one or more sites.
# List Application Categories
Source: https://altostrat.io/docs/api/en/dns-content-filtering/list-application-categories
/api/en/utm-ips.yaml get /content/category
Retrieves a list of all available application categories. Each category contains a list of applications that can be targeted in DNS policies.
# List DNS Content Filtering Policies
Source: https://altostrat.io/docs/api/en/dns-content-filtering/list-dns-content-filtering-policies
/api/en/utm-ips.yaml get /content/policy
Retrieves a list of all DNS Content Filtering policies associated with your account.
# List Safe Search Services
Source: https://altostrat.io/docs/api/en/dns-content-filtering/list-safe-search-services
/api/en/utm-ips.yaml get /content/category/safe_search
Retrieves a list of services (e.g., Google, YouTube) for which Safe Search can be enforced in a DNS policy.
# Retrieve a DNS Policy
Source: https://altostrat.io/docs/api/en/dns-content-filtering/retrieve-a-dns-policy
/api/en/utm-ips.yaml get /content/policy/{policyId}
Retrieves the details of a specific DNS Content Filtering policy by its unique identifier.
# Update a DNS Policy
Source: https://altostrat.io/docs/api/en/dns-content-filtering/update-a-dns-policy
/api/en/utm-ips.yaml put /content/policy/{policyId}
Updates the properties of an existing DNS policy. You can change its name, application blocks, safe search settings, and site attachments.
# Search Altostrat Documentation
Source: https://altostrat.io/docs/api/en/documentation-search/search-altostrat-documentation
/api/en/search.yaml get /search/docs
Use this endpoint to integrate Altostrat's official help and developer documentation search directly into your tools. It's designed to provide quick answers and code references, helping developers resolve issues and build integrations faster.
# Search for Platform Entities
Source: https://altostrat.io/docs/api/en/entity-search/search-for-platform-entities
/api/en/search.yaml get /search
This endpoint allows for a powerful, full-text search across all indexed entities within a user's tenancy scope. By default, it searches all resources within the user's organization. You can narrow the scope to a specific workspace or apply fine-grained filters based on entity type and creation date to pinpoint the exact information you need.
# Activate Failover Service
Source: https://altostrat.io/docs/api/en/failover-service/activate-failover-service
/api/en/wan-failover.yaml post /failover/{site_id}/configs
Activates the WAN Failover service for a specified site. This is the first step to enabling SD-WAN capabilities. Activating the service automatically creates two default, unconfigured WAN tunnels.
# Deactivate Failover Service
Source: https://altostrat.io/docs/api/en/failover-service/deactivate-failover-service
/api/en/wan-failover.yaml delete /failover/{site_id}/configs/{subscription_id}
Deactivates the WAN Failover service for a site, removing all associated WAN tunnels and their configurations from both the Altostrat platform and the on-site router. This action is irreversible.
# Get Failover Service Status
Source: https://altostrat.io/docs/api/en/failover-service/get-failover-service-status
/api/en/wan-failover.yaml get /failover/{site_id}/configs
Checks the status of the WAN Failover service for a specific site, returning the subscription ID if it is active.
# List Sites with Failover Service
Source: https://altostrat.io/docs/api/en/failover-service/list-sites-with-failover-service
/api/en/wan-failover.yaml get /failover/service-counts
Retrieves a list of all sites associated with the authenticated user that have the WAN Failover service currently activated.
# Create a fault
Source: https://altostrat.io/docs/api/en/faults/create-a-fault
/api/en/faults.yaml post /fault
Manually creates a new fault object. This is typically used for creating faults from external systems or for testing purposes. For automated ingestion, other microservices push events that are processed into faults.
# Delete a fault
Source: https://altostrat.io/docs/api/en/faults/delete-a-fault
/api/en/faults.yaml delete /fault/{faultId}
Permanently deletes a fault object. This action cannot be undone.
# List all faults
Source: https://altostrat.io/docs/api/en/faults/list-all-faults
/api/en/faults.yaml get /fault
Returns a paginated list of fault objects for your account. The faults are returned in reverse chronological order by creation time. You can filter the results using the query parameters.
# Retrieve a fault
Source: https://altostrat.io/docs/api/en/faults/retrieve-a-fault
/api/en/faults.yaml get /fault/{faultId}
Retrieves the details of an existing fault. You need only supply the unique fault identifier that was returned upon fault creation.
# Update a fault
Source: https://altostrat.io/docs/api/en/faults/update-a-fault
/api/en/faults.yaml put /fault/{faultId}
Updates the specified fault by setting the values of the parameters passed. Any parameters not provided will be left unchanged. This is useful for changing a fault's severity or manually resolving it.
# Delete a Generated Report
Source: https://altostrat.io/docs/api/en/generated-reports/delete-a-generated-report
/api/en/reports.yaml delete /reports/sla/reports/{reportId}
Permanently deletes a previously generated report and its associated PDF and JSON data from storage.
# List Generated Reports
Source: https://altostrat.io/docs/api/en/generated-reports/list-generated-reports
/api/en/reports.yaml get /reports/sla/reports
Retrieves a paginated list of all historically generated reports for the workspace, sorted by creation date in descending order.
# Export dashboard panel CSV
Source: https://altostrat.io/docs/api/en/grafana-dashboards/export-dashboard-panel-csv
/api/en/monitoring-metrics.yaml post /metrics/dashboards/{dashboardUid}/panels/{panelId}/export
Exports a single Grafana dashboard panel as CSV for reporting, audit, or billing workflows.
# List dashboards
Source: https://altostrat.io/docs/api/en/grafana-dashboards/list-dashboards
/api/en/monitoring-metrics.yaml get /metrics/dashboards
Lists available Grafana dashboards with their variables and panel metadata.
# List dashboards in a folder
Source: https://altostrat.io/docs/api/en/grafana-dashboards/list-dashboards-in-a-folder
/api/en/monitoring-metrics.yaml get /metrics/dashboards/{folderName}
Lists Grafana dashboards from a specific folder.
# Query a dashboard
Source: https://altostrat.io/docs/api/en/grafana-dashboards/query-a-dashboard
/api/en/monitoring-metrics.yaml post /metrics/dashboards/{dashboardUid}/query
Executes the Prometheus queries defined by a Grafana dashboard, optionally limiting the request to selected panels.
# Attach Tag to Group
Source: https://altostrat.io/docs/api/en/groups/attach-tag-to-group
/api/en/radius.yaml post /radius/groups/{id}/tags/{tagId}
# Create Group
Source: https://altostrat.io/docs/api/en/groups/create-group
/api/en/radius.yaml post /radius/groups
# Delete Group
Source: https://altostrat.io/docs/api/en/groups/delete-group
/api/en/radius.yaml delete /radius/groups/{id}
# Detach Tag from Group
Source: https://altostrat.io/docs/api/en/groups/detach-tag-from-group
/api/en/radius.yaml delete /radius/groups/{id}/tags/{tagId}
# List Accounts in Group
Source: https://altostrat.io/docs/api/en/groups/list-accounts-in-group
/api/en/radius.yaml get /radius/groups/{id}/accounts
# List Groups
Source: https://altostrat.io/docs/api/en/groups/list-groups
/api/en/radius.yaml get /radius/groups
# Retrieve Group
Source: https://altostrat.io/docs/api/en/groups/retrieve-group
/api/en/radius.yaml get /radius/groups/{id}
# Update Group
Source: https://altostrat.io/docs/api/en/groups/update-group
/api/en/radius.yaml patch /radius/groups/{id}
# List Router Interfaces
Source: https://altostrat.io/docs/api/en/helper-endpoints/list-router-interfaces
/api/en/wan-failover.yaml get /wan/{site_id}/tunnel/interfaces
Retrieves a list of available physical and logical network interfaces from the router at the specified site. This is useful for identifying the correct `interface` name when configuring a tunnel.
# List Router Interfaces for Failover
Source: https://altostrat.io/docs/api/en/helper-endpoints/list-router-interfaces-for-failover
/api/en/wan-failover.yaml get /failover/{site_id}/interfaces
Retrieves available physical and logical interfaces from the router at the specified site for WAN failover configuration.
# Look up Eligible Gateways
Source: https://altostrat.io/docs/api/en/helper-endpoints/look-up-eligible-gateways
/api/en/wan-failover.yaml post /wan/{site_id}/tunnel/gateways
For a given router interface, this endpoint attempts to detect eligible upstream gateway IP addresses. This helps automate the process of finding the correct `gateway` IP for a tunnel configuration.
# Look up Eligible Gateways for Failover
Source: https://altostrat.io/docs/api/en/helper-endpoints/look-up-eligible-gateways-for-failover
/api/en/wan-failover.yaml post /failover/{site_id}/gateways
Detects eligible upstream gateway IP addresses for a router interface used in WAN failover configuration.
# Active Sessions Count
Source: https://altostrat.io/docs/api/en/insights/active-sessions-count
/api/en/radius.yaml get /radius/insights/active-sessions
# Auth Events History
Source: https://altostrat.io/docs/api/en/insights/auth-events-history
/api/en/radius.yaml get /radius/insights/authentication-events-over-time
# Authentication Latency
Source: https://altostrat.io/docs/api/en/insights/authentication-latency
/api/en/radius.yaml get /radius/insights/authentication-latency
# Authentication Outliers
Source: https://altostrat.io/docs/api/en/insights/authentication-outliers
/api/en/radius.yaml get /radius/insights/authentication-outliers
# Disconnection Stats
Source: https://altostrat.io/docs/api/en/insights/disconnection-stats
/api/en/radius.yaml get /radius/insights/disconnection-stats
# Frequent Disconnects
Source: https://altostrat.io/docs/api/en/insights/frequent-disconnects
/api/en/radius.yaml get /radius/insights/frequently-disconnected-users
# Misconfigured NAS
Source: https://altostrat.io/docs/api/en/insights/misconfigured-nas
/api/en/radius.yaml get /radius/insights/misconfigured-nas
# Most Active NAS
Source: https://altostrat.io/docs/api/en/insights/most-active-nas
/api/en/radius.yaml get /radius/insights/most-active-nas
# NAS Disconnect Reasons
Source: https://altostrat.io/docs/api/en/insights/nas-disconnect-reasons
/api/en/radius.yaml get /radius/insights/nas-disconnect-summary
# Network Health Snapshot
Source: https://altostrat.io/docs/api/en/insights/network-health-snapshot
/api/en/radius.yaml get /radius/insights/network-health-snapshot
# Peak Concurrency
Source: https://altostrat.io/docs/api/en/insights/peak-concurrency
/api/en/radius.yaml get /radius/insights/peak-concurrency-over-time
# Session Duration History
Source: https://altostrat.io/docs/api/en/insights/session-duration-history
/api/en/radius.yaml get /radius/insights/session-duration-over-time
# Session Termination History
Source: https://altostrat.io/docs/api/en/insights/session-termination-history
/api/en/radius.yaml get /radius/insights/session-terminations-over-time
# Short Lived Sessions
Source: https://altostrat.io/docs/api/en/insights/short-lived-sessions
/api/en/radius.yaml get /radius/insights/short-lived-sessions
# Simultaneous Use Violations
Source: https://altostrat.io/docs/api/en/insights/simultaneous-use-violations
/api/en/radius.yaml get /radius/insights/simultaneous-use-violations
# Top Talkers
Source: https://altostrat.io/docs/api/en/insights/top-talkers
/api/en/radius.yaml get /radius/insights/top-talkers
# Create a VPN instance
Source: https://altostrat.io/docs/api/en/instances/create-a-vpn-instance
/api/en/managed-vpn.yaml post /vpn/instances
Provisions a new VPN server instance in a specified region with a unique hostname. This is the first step in setting up a new VPN.
# Delete a VPN instance
Source: https://altostrat.io/docs/api/en/instances/delete-a-vpn-instance
/api/en/managed-vpn.yaml delete /vpn/instances/{instanceId}
Permanently decommissions a VPN instance and all its associated servers and peers. This action cannot be undone.
# List all VPN instances
Source: https://altostrat.io/docs/api/en/instances/list-all-vpn-instances
/api/en/managed-vpn.yaml get /vpn/instances
Retrieves a list of all VPN instances accessible by the authenticated user.
# Retrieve a VPN instance
Source: https://altostrat.io/docs/api/en/instances/retrieve-a-vpn-instance
/api/en/managed-vpn.yaml get /vpn/instances/{instanceId}
Fetches the details of a specific VPN instance by its unique identifier.
# Retrieve instance bandwidth
Source: https://altostrat.io/docs/api/en/instances/retrieve-instance-bandwidth
/api/en/managed-vpn.yaml get /vpn/instances/{instanceId}/bandwidth
Fetches the bandwidth usage statistics for the primary server associated with a VPN instance.
# Update a VPN instance
Source: https://altostrat.io/docs/api/en/instances/update-a-vpn-instance
/api/en/managed-vpn.yaml put /vpn/instances/{instanceId}
Modifies the configuration of an existing VPN instance, such as its name, DNS settings, or pushed routes.
# API Reference
Source: https://altostrat.io/docs/api/en/introduction
Find generated OpenAPI reference material for public Altostrat SDX endpoints.
The API Reference tab contains generated endpoint documentation for teams that automate SDX outside the portal. The public base URL is:
```text theme={null}
https://v1.api.altostrat.io
```
Use the product documentation first when you are learning how SDX features behave. Use the generated API groups when you already know the workflow you want to automate and need endpoint names, request shapes, response fields, and authentication details.
## Before You Build
* Use the paths exactly as shown in this reference. Several SDX services are mounted behind gateway prefixes such as `/api`, `/workflows`, `/vpn`, `/content`, `/metrics`, `/reports`, and `/scripts`.
* Confirm the portal workflow manually before automating it.
* Use API keys only for integrations that need server-to-server access.
* Store credentials in a secret manager or the SDX vault where appropriate.
* Prefer the narrowest role and team access that lets the integration do its job.
* Test automation in a non-critical team or site before you run it across production.
## What Is Included
This reference focuses on APIs that customers encounter in the portal or use for product automation. Internal service-to-service endpoints, local development endpoints, health checks, and backend-only token exchange routes are intentionally omitted.
API keys and workflow vault secrets can grant powerful access. Treat them like production credentials, rotate them when ownership changes, and remove unused keys.
# List invoices
Source: https://altostrat.io/docs/api/en/invoices/list-invoices
/api/en/workspaces.yaml get /workspaces/{workspaceId}/billing-accounts/{billingAccountId}/invoices
Returns a list of invoices for a billing account. Invoices are returned in reverse chronological order.
# Preview an invoice
Source: https://altostrat.io/docs/api/en/invoices/preview-an-invoice
/api/en/workspaces.yaml post /workspaces/{workspaceId}/billing-accounts/{billingAccountId}/invoices/preview
Previews an upcoming invoice for a billing account, showing the financial impact of potential subscription changes, such as adding products or changing quantities. This does not modify any existing subscriptions.
# Cancel a Pending Job
Source: https://altostrat.io/docs/api/en/jobs/cancel-a-pending-job
/api/en/mikrotik-api.yaml delete /site/{siteId}/job/{jobId}
Deletes a job that has not yet started execution. Jobs that are in progress, completed, or failed cannot be deleted.
# Create a Job for a Site
Source: https://altostrat.io/docs/api/en/jobs/create-a-job-for-a-site
/api/en/mikrotik-api.yaml post /site/{siteId}/job
Creates and queues a new job to be executed on the specified site. The job's payload is a raw RouterOS script, and metadata is provided via headers.
# List Jobs for a Site
Source: https://altostrat.io/docs/api/en/jobs/list-jobs-for-a-site
/api/en/mikrotik-api.yaml get /site/{siteId}/job
Retrieves a list of all jobs that have been created for a specific site, ordered by creation date (most recent first).
# Retrieve a Job
Source: https://altostrat.io/docs/api/en/jobs/retrieve-a-job
/api/en/mikrotik-api.yaml get /site/{siteId}/job/{jobId}
Retrieves the complete details of a specific job by its unique identifier (UUID).
# List Account Logs
Source: https://altostrat.io/docs/api/en/logs/list-account-logs
/api/en/radius.yaml get /radius/accounts/{id}/logs
# List NAS Logs
Source: https://altostrat.io/docs/api/en/logs/list-nas-logs
/api/en/radius.yaml get /radius/nas/{id}/logs
# Create a metadata object
Source: https://altostrat.io/docs/api/en/metadata/create-a-metadata-object
/api/en/metadata.yaml post /metadata
Creates a new metadata object for a given resource, or fully overwrites an existing one for that resource. The metadata itself is a flexible key-value store.
# Delete a metadata object
Source: https://altostrat.io/docs/api/en/metadata/delete-a-metadata-object
/api/en/metadata.yaml delete /metadata/{resourceId}
Deletes all custom metadata associated with a resource. This action clears the `metadata` field but does not delete the resource itself.
# List all metadata objects
Source: https://altostrat.io/docs/api/en/metadata/list-all-metadata-objects
/api/en/metadata.yaml get /metadata
Retrieves a collection of all resources that have metadata associated with them for the current customer.
# Retrieve a metadata object
Source: https://altostrat.io/docs/api/en/metadata/retrieve-a-metadata-object
/api/en/metadata.yaml get /metadata/{resourceId}
Fetches the metadata object for a single resource, identified by its unique ID.
# Update a metadata object
Source: https://altostrat.io/docs/api/en/metadata/update-a-metadata-object
/api/en/metadata.yaml put /metadata/{resourceId}
Updates the metadata for a specific resource. This operation performs a merge; any keys you provide will be added or will overwrite existing keys, while keys you don't provide will be left untouched. To remove a key, set its value to `null` or an empty string.
# Create NAS Device
Source: https://altostrat.io/docs/api/en/nas-devices/create-nas-device
/api/en/radius.yaml post /radius/nas
# Delete NAS Device
Source: https://altostrat.io/docs/api/en/nas-devices/delete-nas-device
/api/en/radius.yaml delete /radius/nas/{id}
# List NAS Devices
Source: https://altostrat.io/docs/api/en/nas-devices/list-nas-devices
/api/en/radius.yaml get /radius/nas
# Retrieve NAS Device
Source: https://altostrat.io/docs/api/en/nas-devices/retrieve-nas-device
/api/en/radius.yaml get /radius/nas/{id}
# Update NAS Device
Source: https://altostrat.io/docs/api/en/nas-devices/update-nas-device
/api/en/radius.yaml patch /radius/nas/{id}
# Get BGP Security Report
Source: https://altostrat.io/docs/api/en/network-logs/get-bgp-security-report
/api/en/monitoring-metrics.yaml get /metrics/bgp-report/{siteId}
Generates a BGP security report for a site based on the last 24 hours of data. The report includes top 10 destination ports, top 10 blocklists triggered, and top 10 source IPs initiating blocked traffic.
# Get DNS Security Report
Source: https://altostrat.io/docs/api/en/network-logs/get-dns-security-report
/api/en/monitoring-metrics.yaml get /metrics/dns-report/{siteId}
Generates a DNS security report for a site based on the last 24 hours of data. The report includes top 10 blocked categories, top 10 blocked applications, and top 10 internal source IPs making blocked requests.
# Get Site Syslog Entries
Source: https://altostrat.io/docs/api/en/network-logs/get-site-syslog-entries
/api/en/monitoring-metrics.yaml get /metrics/syslogs/{siteId}
Retrieves a paginated list of syslog messages for a specific site, ordered by the most recent first.
# Create a Notification Group
Source: https://altostrat.io/docs/api/en/notification-groups/create-a-notification-group
/api/en/notifications.yaml post /notifications
Creates a new notification group. This allows you to define a new rule for who gets notified about which topics, for which sites, and on what schedule.
# Delete a Notification Group
Source: https://altostrat.io/docs/api/en/notification-groups/delete-a-notification-group
/api/en/notifications.yaml delete /notifications/{groupId}
Permanently deletes a notification group. This action cannot be undone.
# List Notification Groups
Source: https://altostrat.io/docs/api/en/notification-groups/list-notification-groups
/api/en/notifications.yaml get /notifications
Retrieves a list of all notification groups configured for the authenticated user's workspace. Each group represents a specific set of rules for routing alerts.
# Retrieve a Notification Group
Source: https://altostrat.io/docs/api/en/notification-groups/retrieve-a-notification-group
/api/en/notifications.yaml get /notifications/{groupId}
Fetches the details of a specific notification group by its unique ID.
# Update a Notification Group
Source: https://altostrat.io/docs/api/en/notification-groups/update-a-notification-group
/api/en/notifications.yaml put /notifications/{groupId}
Updates the configuration of an existing notification group. This operation replaces the entire group object with the provided data.
# Exchange Code or Refresh Token for Tokens
Source: https://altostrat.io/docs/api/en/oauth-20-&-oidc/exchange-code-or-refresh-token-for-tokens
/api/en/authentication.yaml post /oauth/token
Used to exchange an `authorization_code` for tokens, or to use a `refresh_token` to get a new `access_token`. Client authentication can be performed via `client_secret_post` (in the body), `client_secret_basic` (HTTP Basic Auth), or `private_key_jwt`.
# Get User Profile
Source: https://altostrat.io/docs/api/en/oauth-20-&-oidc/get-user-profile
/api/en/authentication.yaml get /userinfo
Retrieves the profile of the user associated with the provided `access_token`. The claims returned are based on the scopes granted during authentication.
# Initiate User Authentication
Source: https://altostrat.io/docs/api/en/oauth-20-&-oidc/initiate-user-authentication
/api/en/authentication.yaml get /authorize
This is the starting point for user authentication. The Altostrat web application redirects the user's browser to this endpoint to begin the OAuth 2.0 Authorization Code Flow with PKCE.
# Log Out User (Legacy)
Source: https://altostrat.io/docs/api/en/oauth-20-&-oidc/log-out-user-legacy
/api/en/authentication.yaml get /v2/logout
Logs the user out of their Altostrat session and redirects them back to a specified URL.
# Log Out User (OIDC Compliant)
Source: https://altostrat.io/docs/api/en/oauth-20-&-oidc/log-out-user-oidc-compliant
/api/en/authentication.yaml get /oidc/logout
This endpoint conforms to the OIDC Session Management specification. It logs the user out and can redirect them back to the application.
# Revoke Token
Source: https://altostrat.io/docs/api/en/oauth-20-&-oidc/revoke-token
/api/en/authentication.yaml post /oauth/revoke
Revokes an `access_token` or `refresh_token`, invalidating it immediately. This is useful for scenarios like password changes or user-initiated logouts from all devices.
# Create a child organization
Source: https://altostrat.io/docs/api/en/organizations/create-a-child-organization
/api/en/workspaces.yaml post /workspaces/{workspaceId}/organizations/{organizationId}/children
Creates a new organization as a direct child of the specified parent organization. The hierarchy cannot exceed 10 levels of depth, and a parent cannot have more than 100 direct children.
# Create an organization
Source: https://altostrat.io/docs/api/en/organizations/create-an-organization
/api/en/workspaces.yaml post /workspaces/{workspaceId}/organizations
Creates a new top-level organization within a workspace. To create a child organization, use the `/organizations/{organizationId}/children` endpoint. A workspace cannot have more than 1,000 organizations in total.
# Delete an organization
Source: https://altostrat.io/docs/api/en/organizations/delete-an-organization
/api/en/workspaces.yaml delete /workspaces/{workspaceId}/organizations/{organizationId}
Permanently deletes an organization. An organization cannot be deleted if it or any of its descendants have active resource usage.
# Export organization usage as CSV
Source: https://altostrat.io/docs/api/en/organizations/export-organization-usage-as-csv
/api/en/workspaces.yaml get /workspaces/{workspaceId}/organizations/usage.csv
Generates and downloads a CSV file detailing the resource usage and limits for all organizations within the specified workspace.
# Export organization usage as PDF
Source: https://altostrat.io/docs/api/en/organizations/export-organization-usage-as-pdf
/api/en/workspaces.yaml get /workspaces/{workspaceId}/organizations/usage.pdf
Generates and downloads a PDF file detailing the resource usage and limits for all organizations within the specified workspace.
# List all descendant organizations
Source: https://altostrat.io/docs/api/en/organizations/list-all-descendant-organizations
/api/en/workspaces.yaml get /workspaces/{workspaceId}/organizations/{organizationId}/descendants
Returns a flat list of all organizations that are descendants (children, grandchildren, etc.) of the specified parent organization.
# List child organizations
Source: https://altostrat.io/docs/api/en/organizations/list-child-organizations
/api/en/workspaces.yaml get /workspaces/{workspaceId}/organizations/{organizationId}/children
Returns a list of immediate child organizations of a specified parent organization.
# List organizations
Source: https://altostrat.io/docs/api/en/organizations/list-organizations
/api/en/workspaces.yaml get /workspaces/{workspaceId}/organizations
Returns a list of all organizations within the specified workspace.
# Retrieve an organization
Source: https://altostrat.io/docs/api/en/organizations/retrieve-an-organization
/api/en/workspaces.yaml get /workspaces/{workspaceId}/organizations/{organizationId}
Retrieves the details of a specific organization within a workspace.
# Retrieve organization limits
Source: https://altostrat.io/docs/api/en/organizations/retrieve-organization-limits
/api/en/workspaces.yaml get /workspaces/{workspaceId}/organizations/{organizationId}/limits
Retrieves a detailed breakdown of usage, limits, and available capacity for each meterable product type for a specific organization. This takes into account the organization's own limits, limits inherited from its parents, and the total capacity available from its subscription.
# Retrieve parent organization
Source: https://altostrat.io/docs/api/en/organizations/retrieve-parent-organization
/api/en/workspaces.yaml get /workspaces/{workspaceId}/organizations/{organizationId}/parent
Retrieves the parent organization of a specified child organization. If the organization is at the top level, this endpoint will return a 204 No Content response.
# Update an organization
Source: https://altostrat.io/docs/api/en/organizations/update-an-organization
/api/en/workspaces.yaml patch /workspaces/{workspaceId}/organizations/{organizationId}
Updates specified attributes of an organization. This endpoint can be used to change the organization's name, update its resource limits, or modify branding settings. You only need to provide the fields you want to change.
# Create a Setup Intent
Source: https://altostrat.io/docs/api/en/payment-methods/create-a-setup-intent
/api/en/workspaces.yaml post /workspaces/{workspaceId}/billing-accounts/{billingAccountId}/payment-methods
Creates a Stripe Setup Intent to collect payment method details for future payments. This returns a `client_secret` that you can use with Stripe.js or the mobile SDKs to display a payment form. A billing account cannot have more than 5 payment methods.
# Detach a payment method
Source: https://altostrat.io/docs/api/en/payment-methods/detach-a-payment-method
/api/en/workspaces.yaml delete /workspaces/{workspaceId}/billing-accounts/{billingAccountId}/payment-methods/{paymentMethodId}
Detaches a payment method from a billing account. You cannot detach the only payment method on an account, nor can you detach the default payment method if there are active subscriptions.
# List payment methods
Source: https://altostrat.io/docs/api/en/payment-methods/list-payment-methods
/api/en/workspaces.yaml get /workspaces/{workspaceId}/billing-accounts/{billingAccountId}/payment-methods
Returns a list of payment methods attached to a billing account.
# Set default payment method
Source: https://altostrat.io/docs/api/en/payment-methods/set-default-payment-method
/api/en/workspaces.yaml put /workspaces/{workspaceId}/billing-accounts/{billingAccountId}/payment-methods/{paymentMethodId}
Sets a specified payment method as the default for a billing account. This payment method will be used for all future subscription invoices.
# Create a peer
Source: https://altostrat.io/docs/api/en/peers/create-a-peer
/api/en/managed-vpn.yaml post /vpn/instances/{instanceId}/peers
Creates a new peer (a client or a site) and associates it with a VPN instance.
# Delete a peer
Source: https://altostrat.io/docs/api/en/peers/delete-a-peer
/api/en/managed-vpn.yaml delete /vpn/instances/{instanceId}/peers/{peerId}
Permanently removes a peer from a VPN instance. This revokes its access.
# List all peers for an instance
Source: https://altostrat.io/docs/api/en/peers/list-all-peers-for-an-instance
/api/en/managed-vpn.yaml get /vpn/instances/{instanceId}/peers
Retrieves a list of all peers (clients and sites) associated with a specific VPN instance.
# Retrieve a peer
Source: https://altostrat.io/docs/api/en/peers/retrieve-a-peer
/api/en/managed-vpn.yaml get /vpn/instances/{instanceId}/peers/{peerId}
Fetches the details of a specific peer by its unique identifier.
# Update a peer
Source: https://altostrat.io/docs/api/en/peers/update-a-peer
/api/en/managed-vpn.yaml put /vpn/instances/{instanceId}/peers/{peerId}
Modifies the configuration of an existing peer, such as its subnets or routing behavior.
# Get Workspace Statistics
Source: https://altostrat.io/docs/api/en/platform/get-workspace-statistics
/api/en/radius.yaml get /radius/
# List Available RADIUS Attributes
Source: https://altostrat.io/docs/api/en/platform/list-available-radius-attributes
/api/en/radius.yaml get /radius/attributes
# Create a policy
Source: https://altostrat.io/docs/api/en/policies/create-a-policy
/api/en/control-plane.yaml post /control-plane/policies
Creates a new security policy. You can define rules for services like Winbox, SSH, and HTTP/S, including which networks are allowed to access them.
# Delete a policy
Source: https://altostrat.io/docs/api/en/policies/delete-a-policy
/api/en/control-plane.yaml delete /control-plane/policies/{policyId}
Deletes a policy. You cannot delete the default policy. Any sites using the deleted policy will be reassigned to the default policy.
# List all policies
Source: https://altostrat.io/docs/api/en/policies/list-all-policies
/api/en/control-plane.yaml get /control-plane/policies
Retrieves a list of all security policies belonging to your workspace. Policies define the firewall rules and service access configurations applied to your sites.
# Retrieve a policy
Source: https://altostrat.io/docs/api/en/policies/retrieve-a-policy
/api/en/control-plane.yaml get /control-plane/policies/{policyId}
Retrieves the details of a specific policy, including its rules and a list of sites it is applied to.
# Update a policy
Source: https://altostrat.io/docs/api/en/policies/update-a-policy
/api/en/control-plane.yaml put /control-plane/policies/{policyId}
Updates the specified policy by setting the values of the parameters passed. Any parameters not provided will be left unchanged.
# Create a prefix list
Source: https://altostrat.io/docs/api/en/prefix-lists/create-a-prefix-list
/api/en/security-groups.yaml post /vpc/prefix-lists
Creates a new prefix list with a defined set of CIDR blocks and initial site associations. Site associations and address list deployments are handled asynchronously.
# Delete a prefix list
Source: https://altostrat.io/docs/api/en/prefix-lists/delete-a-prefix-list
/api/en/security-groups.yaml delete /vpc/prefix-lists/{prefixListId}
Permanently deletes a prefix list. This action will fail if the prefix list is currently referenced by any security group rule. An asynchronous process will remove the corresponding address list from all associated sites.
# List prefix lists
Source: https://altostrat.io/docs/api/en/prefix-lists/list-prefix-lists
/api/en/security-groups.yaml get /vpc/prefix-lists
Retrieves a list of all prefix lists within your organization. This endpoint provides a summary view and does not include the detailed list of prefixes or sites for performance. To get full details, retrieve a specific prefix list by its ID.
# Retrieve a prefix list
Source: https://altostrat.io/docs/api/en/prefix-lists/retrieve-a-prefix-list
/api/en/security-groups.yaml get /vpc/prefix-lists/{prefixListId}
Retrieves the complete details of a specific prefix list, including its name, description, status, associated sites, and a full list of its prefixes.
# Update a prefix list
Source: https://altostrat.io/docs/api/en/prefix-lists/update-a-prefix-list
/api/en/security-groups.yaml put /vpc/prefix-lists/{prefixListId}
Updates an existing prefix list by fully replacing its attributes, including its name, description, prefixes, and site associations. This is a full replacement operation (PUT); any omitted fields will result in those items being removed.
# List Products
Source: https://altostrat.io/docs/api/en/products/list-products
/api/en/mikrotik-oem-data.yaml get /oem/products
Returns a paginated list of MikroTik products. The list can be filtered by product name or model number, allowing for powerful search and cataloging capabilities.
# Retrieve a Product
Source: https://altostrat.io/docs/api/en/products/retrieve-a-product
/api/en/mikrotik-oem-data.yaml get /oem/product/{slug}
Retrieves the complete details of a single MikroTik product, identified by its unique slug. This endpoint provides an exhaustive set of specifications, including core hardware details, performance test results, included accessories, and downloadable assets.
# Execute a Prometheus query
Source: https://altostrat.io/docs/api/en/prometheus-querying/execute-a-prometheus-query
/api/en/monitoring-metrics.yaml post /metrics/query
Executes a Prometheus query through the SDX metrics gateway and scopes the result to the authenticated workspace and organization.
# List label values
Source: https://altostrat.io/docs/api/en/prometheus-querying/list-label-values
/api/en/monitoring-metrics.yaml get /metrics/labels/{labelName}/values
Returns Prometheus values for a label available to the authenticated workspace and organization.
# List metric labels
Source: https://altostrat.io/docs/api/en/prometheus-querying/list-metric-labels
/api/en/monitoring-metrics.yaml get /metrics/labels
Returns Prometheus label names available to the authenticated workspace and organization for the requested time window.
# List metric names
Source: https://altostrat.io/docs/api/en/prometheus-querying/list-metric-names
/api/en/monitoring-metrics.yaml get /metrics/metrics
Returns metric names available to the authenticated workspace and organization for the requested time window.
# Retrieve coupons from a signed URL
Source: https://altostrat.io/docs/api/en/public-coupon-urls/retrieve-coupons-from-a-signed-url
/api/en/captive-portal.yaml get /captive/coupons
Returns valid coupons for a coupon schedule when called with the signed query string generated by `GET /captive/instances/{instanceId}/coupon-schedules/{scheduleId}/generate_url`.
# Get public branding information
Source: https://altostrat.io/docs/api/en/public/get-public-branding-information
/api/en/workspaces.yaml get /organizations/{id}/branding
Retrieves the public branding information for an organization, such as its display name, logo, and theme colors. You can use either the organization's primary ID (`org_...`) or its external UUID as the identifier. This is a public, unauthenticated endpoint.
# Resolve login hint
Source: https://altostrat.io/docs/api/en/public/resolve-login-hint
/api/en/workspaces.yaml get /organizations/resolve/{login_hint}
Given a unique login hint (e.g., a short company name like 'acme'), this endpoint returns the corresponding organization ID. This is useful for pre-filling organization details in a login flow. This is a public, unauthenticated endpoint.
# Create Realm
Source: https://altostrat.io/docs/api/en/realms/create-realm
/api/en/radius.yaml post /radius/realms
# Delete Realm
Source: https://altostrat.io/docs/api/en/realms/delete-realm
/api/en/radius.yaml delete /radius/realms/{id}
# Get Realm
Source: https://altostrat.io/docs/api/en/realms/get-realm
/api/en/radius.yaml get /radius/realms/{id}
# List Realms
Source: https://altostrat.io/docs/api/en/realms/list-realms
/api/en/radius.yaml get /radius/realms
# Update Realm
Source: https://altostrat.io/docs/api/en/realms/update-realm
/api/en/radius.yaml patch /radius/realms/{id}
# List common services
Source: https://altostrat.io/docs/api/en/reference-data/list-common-services
/api/en/security-groups.yaml get /vpc/reference/services
Retrieves a list of common network services and their standard port numbers to aid in the creation of firewall rules.
# List supported protocols
Source: https://altostrat.io/docs/api/en/reference-data/list-supported-protocols
/api/en/security-groups.yaml get /vpc/reference/protocols
Retrieves a list of all supported network protocols and their corresponding integer values, which are required when creating firewall rules.
# List Resellers
Source: https://altostrat.io/docs/api/en/resellers/list-resellers
/api/en/mikrotik-oem-data.yaml get /oem/mikrotik-resellers
Returns a paginated list of official MikroTik resellers. This allows you to find resellers based on their geographical location or name, providing valuable information for procurement and partnership purposes.
# Retrieve a Runbook
Source: https://altostrat.io/docs/api/en/runbooks/retrieve-a-runbook
/api/en/mikrotik-api.yaml get /runbooks/{runbookId}
Retrieves the details of a specific runbook, including its name and the bootstrap command used to onboard new devices with this configuration.
# Start a Scan
Source: https://altostrat.io/docs/api/en/scan-execution/start-a-scan
/api/en/cve-scans.yaml post /scans/cve/scheduled/{scanScheduleId}/invoke
Manually triggers a scan for a given schedule, overriding its normal timetable. The scan will be queued for execution immediately.
# Start On-Demand Multi-IP Scan
Source: https://altostrat.io/docs/api/en/scan-execution/start-on-demand-multi-ip-scan
/api/en/cve-scans.yaml post /scans/cve/scan/multiple-ips
Initiates an immediate, on-demand scan for a specific list of IP addresses. This uses the configuration of an existing scan schedule but targets only the specified IPs within a particular site.
# Start On-Demand Single-IP Scan
Source: https://altostrat.io/docs/api/en/scan-execution/start-on-demand-single-ip-scan
/api/en/cve-scans.yaml post /scans/cve/scheduled/single-ip
Initiates an immediate, on-demand scan for a single IP address. This uses the configuration of an existing scan schedule but targets only the specified IP within a particular site.
# Stop a Scan
Source: https://altostrat.io/docs/api/en/scan-execution/stop-a-scan
/api/en/cve-scans.yaml delete /scans/cve/scheduled/{scanScheduleId}/invoke
Forcefully stops a scan that is currently in progress for a given schedule.
# Get Latest Scan Status
Source: https://altostrat.io/docs/api/en/scan-results/get-latest-scan-status
/api/en/cve-scans.yaml get /scans/cve/{scanScheduleId}/status
Retrieves the status of the most recent scan associated with a specific schedule, whether it is running, completed, or failed.
# List Scan Reports
Source: https://altostrat.io/docs/api/en/scan-results/list-scan-reports
/api/en/cve-scans.yaml get /scans/cve
Retrieves a list of completed scan reports for your account, ordered by the most recent first. Each item in the list is a summary of a scan run.
# Retrieve a Scan Report
Source: https://altostrat.io/docs/api/en/scan-results/retrieve-a-scan-report
/api/en/cve-scans.yaml get /scans/cve/{scan_id}
Fetches the detailed report for a specific completed scan run. The report includes scan metadata and links to download the full JSON or PDF report.
# Create Scan Schedule
Source: https://altostrat.io/docs/api/en/scan-schedules/create-scan-schedule
/api/en/cve-scans.yaml post /scans/cve/scheduled
Creates a new recurring CVE scan schedule. You must define the timing, frequency, target sites and subnets, and notification settings. A successful creation returns the full schedule object.
# Delete a Scan Schedule
Source: https://altostrat.io/docs/api/en/scan-schedules/delete-a-scan-schedule
/api/en/cve-scans.yaml delete /scans/cve/scheduled/{scanScheduleId}
Permanently deletes a scan schedule. This action cannot be undone and will stop any future scans for this schedule.
# List Scan Schedules
Source: https://altostrat.io/docs/api/en/scan-schedules/list-scan-schedules
/api/en/cve-scans.yaml get /scans/cve/scheduled
Retrieves a list of all CVE scan schedules configured for your account. This is useful for displaying all configured scans in a dashboard or for programmatic management.
# Retrieve a Scan Schedule
Source: https://altostrat.io/docs/api/en/scan-schedules/retrieve-a-scan-schedule
/api/en/cve-scans.yaml get /scans/cve/scheduled/{scanScheduleId}
Fetches the details of a specific scan schedule by its unique identifier.
# Update a Scan Schedule
Source: https://altostrat.io/docs/api/en/scan-schedules/update-a-scan-schedule
/api/en/cve-scans.yaml put /scans/cve/scheduled/{scanScheduleId}
Updates the configuration of an existing scan schedule. All fields are replaced by the new values provided in the request body.
# Cancel or Delete a Scheduled Script
Source: https://altostrat.io/docs/api/en/scheduled-scripts/cancel-or-delete-a-scheduled-script
/api/en/scripts.yaml delete /scripts/scheduled/{scheduledScriptId}
This endpoint has dual functionality. If the script is 'unauthorized' and has not been launched, it will be permanently deleted. If the script is 'scheduled' or 'launched', it will be marked as 'cancelled' to prevent further execution, but the record will be retained.
# Get Execution Progress
Source: https://altostrat.io/docs/api/en/scheduled-scripts/get-execution-progress
/api/en/scripts.yaml get /scripts/scheduled/{scheduledScriptId}/progress
Retrieves the real-time execution progress for a script that has been launched. It provides lists of sites where the script has completed, failed, or is still pending.
# Immediately Run a Scheduled Script
Source: https://altostrat.io/docs/api/en/scheduled-scripts/immediately-run-a-scheduled-script
/api/en/scripts.yaml put /scripts/scheduled/{scheduledScriptId}/run
Triggers an immediate execution of an already authorized script, overriding its scheduled 'launch_at' time. This is useful for urgent deployments. The script must be in an 'authorized' state to be run immediately.
# List Scheduled Scripts
Source: https://altostrat.io/docs/api/en/scheduled-scripts/list-scheduled-scripts
/api/en/scripts.yaml get /scripts/scheduled
Retrieves a list of all scripts scheduled for execution that are accessible by the authenticated user. This provides an overview of pending, in-progress, and completed automation tasks.
# Request Script Authorization
Source: https://altostrat.io/docs/api/en/scheduled-scripts/request-script-authorization
/api/en/scripts.yaml get /scripts/scheduled/{scheduledScriptId}/authorize
Initiates the authorization workflow for an 'unauthorized' script. This action sends notifications (e.g., WhatsApp, email) to the configured recipients, containing a unique link to approve the script's execution.
# Retrieve a Scheduled Script
Source: https://altostrat.io/docs/api/en/scheduled-scripts/retrieve-a-scheduled-script
/api/en/scripts.yaml get /scripts/scheduled/{scheduledScriptId}
Fetches the detailed information for a single scheduled script, including its current status, progress, and configuration.
# Run a Test Execution
Source: https://altostrat.io/docs/api/en/scheduled-scripts/run-a-test-execution
/api/en/scripts.yaml put /scripts/scheduled/{scheduledScriptId}/run-test
Immediately dispatches the script for execution on the designated 'test_site_id'. This allows for validation of the script's logic and impact in a controlled environment before a full-scale launch. The script does not need to be authorized to run a test.
# Schedule a New Script
Source: https://altostrat.io/docs/api/en/scheduled-scripts/schedule-a-new-script
/api/en/scripts.yaml post /scripts/scheduled
Creates a new scheduled script entry. This involves defining the script content, selecting target devices (sites), specifying a launch time, and configuring notification recipients. The script will be in an 'unauthorized' state until an authorization workflow is completed.
# Update a Scheduled Script
Source: https://altostrat.io/docs/api/en/scheduled-scripts/update-a-scheduled-script
/api/en/scripts.yaml put /scripts/scheduled/{scheduledScriptId}
Modifies an existing scheduled script. This is only possible if the script has not yet been launched. Updating a script will reset its authorization status to 'unauthorized', requiring re-approval before it can be executed.
# Create a new schedule
Source: https://altostrat.io/docs/api/en/schedules/create-a-new-schedule
/api/en/schedules.yaml post /chrono/schedules
Creates a new schedule with a defined set of recurring time slots. Upon creation, the schedule's `active` status is automatically calculated based on the current time and the provided slots.
# Delete a schedule
Source: https://altostrat.io/docs/api/en/schedules/delete-a-schedule
/api/en/schedules.yaml delete /chrono/schedules/{scheduleId}
Permanently deletes a schedule, including all of its associated time slots and metadata. This action cannot be undone.
# List all schedules
Source: https://altostrat.io/docs/api/en/schedules/list-all-schedules
/api/en/schedules.yaml get /chrono/schedules
Retrieves a list of all schedule objects belonging to your workspace. The schedules are returned sorted by creation date, with the most recently created schedules appearing first.
# Retrieve a schedule
Source: https://altostrat.io/docs/api/en/schedules/retrieve-a-schedule
/api/en/schedules.yaml get /chrono/schedules/{scheduleId}
Retrieves the details of an existing schedule by its unique identifier.
# Update a schedule
Source: https://altostrat.io/docs/api/en/schedules/update-a-schedule
/api/en/schedules.yaml put /chrono/schedules/{scheduleId}
Updates the specified schedule by setting the properties of the request body. Any properties not provided will be left unchanged. When updating `hours`, the entire array is replaced. When updating `metadata`, providing a key with a `null` value will delete that metadata entry.
# Create a Script Template
Source: https://altostrat.io/docs/api/en/script-templates/create-a-script-template
/api/en/scripts.yaml post /scripts/templates
Creates a new, private script template for the user's organization. This allows for the storage and reuse of standardized scripts within a team.
# Delete a Script Template
Source: https://altostrat.io/docs/api/en/script-templates/delete-a-script-template
/api/en/scripts.yaml delete /scripts/templates/{templateId}
Permanently removes a private script template. This action cannot be undone and is only permitted on templates that the user is authorized to edit.
# List Script Templates
Source: https://altostrat.io/docs/api/en/script-templates/list-script-templates
/api/en/scripts.yaml get /scripts/templates
Retrieves a collection of script templates. Templates can be filtered to show public (global), private (organization-specific), or all accessible templates. They can also be searched by name or description.
# Retrieve a Script Template
Source: https://altostrat.io/docs/api/en/script-templates/retrieve-a-script-template
/api/en/scripts.yaml get /scripts/templates/{templateId}
Fetches the details of a specific script template, including its content.
# Update a Script Template
Source: https://altostrat.io/docs/api/en/script-templates/update-a-script-template
/api/en/scripts.yaml put /scripts/templates/{templateId}
Modifies an existing script template. This action is only permitted on templates that are private to the user's organization and were created by the user. Global templates are read-only.
# Create a security group
Source: https://altostrat.io/docs/api/en/security-groups/create-a-security-group
/api/en/security-groups.yaml post /vpc/security-groups
Creates a new security group with a defined set of firewall rules and initial site associations. The group is created atomically. Site associations and rule deployments are handled asynchronously. The response will indicate a `syncing` status if there are sites to update.
# Delete a security group
Source: https://altostrat.io/docs/api/en/security-groups/delete-a-security-group
/api/en/security-groups.yaml delete /vpc/security-groups/{securityGroupId}
Permanently deletes a security group. This action cannot be undone. An asynchronous process will remove the corresponding firewall rules from all associated sites.
# List security groups
Source: https://altostrat.io/docs/api/en/security-groups/list-security-groups
/api/en/security-groups.yaml get /vpc/security-groups
Retrieves a list of all security groups within your organization. This endpoint provides a summary view of each group and does not include the detailed list of rules or associated sites for performance reasons. To get full details, retrieve a specific security group by its ID.
# Retrieve a security group
Source: https://altostrat.io/docs/api/en/security-groups/retrieve-a-security-group
/api/en/security-groups.yaml get /vpc/security-groups/{securityGroupId}
Retrieves the complete details of a specific security group, including its name, description, status, associated sites, and a full list of its firewall rules.
# Update a security group
Source: https://altostrat.io/docs/api/en/security-groups/update-a-security-group
/api/en/security-groups.yaml put /vpc/security-groups/{securityGroupId}
Updates an existing security group by fully replacing its attributes, including its name, description, rules, and site associations. This is a full replacement operation (PUT); any omitted fields in the `rules` or `sites` arrays will result in those items being removed.
# Create a site note
Source: https://altostrat.io/docs/api/en/site-files/create-a-site-note
/api/en/metadata.yaml post /metadata/{siteId}/notes
Creates a new markdown note and attaches it to the specified site.
# Delete a document file
Source: https://altostrat.io/docs/api/en/site-files/delete-a-document-file
/api/en/metadata.yaml delete /metadata/{siteId}/documents/{documentId}
Permanently deletes a document file from a site.
# Delete a media file
Source: https://altostrat.io/docs/api/en/site-files/delete-a-media-file
/api/en/metadata.yaml delete /metadata/{siteId}/media/{mediaId}
Permanently deletes a media file from a site.
# Delete a site note
Source: https://altostrat.io/docs/api/en/site-files/delete-a-site-note
/api/en/metadata.yaml delete /metadata/{siteId}/notes/{noteId}
Permanently deletes a note from a site.
# Download a document file
Source: https://altostrat.io/docs/api/en/site-files/download-a-document-file
/api/en/metadata.yaml get /metadata/{siteId}/documents/{documentId}
Downloads a specific document file associated with a site.
# Download a media file
Source: https://altostrat.io/docs/api/en/site-files/download-a-media-file
/api/en/metadata.yaml get /metadata/{siteId}/media/{mediaId}
Downloads a specific media file associated with a site.
# Get document upload URL
Source: https://altostrat.io/docs/api/en/site-files/get-document-upload-url
/api/en/metadata.yaml post /metadata/{siteId}/documents
Requests a pre-signed URL that can be used to upload a document file (e.g., PDF, DOCX) directly to secure storage. You should perform a PUT request to the returned `signed_url` with the file content as the request body.
# Get media upload URL
Source: https://altostrat.io/docs/api/en/site-files/get-media-upload-url
/api/en/metadata.yaml post /metadata/{siteId}/media
Requests a pre-signed URL that can be used to upload a media file (e.g., image, video) directly to secure storage. You should perform a PUT request to the returned `signed_url` with the file content as the request body.
# Get site note content
Source: https://altostrat.io/docs/api/en/site-files/get-site-note-content
/api/en/metadata.yaml get /metadata/{siteId}/notes/{noteId}
Downloads the raw Markdown content of a specific site note.
# List site notes
Source: https://altostrat.io/docs/api/en/site-files/list-site-notes
/api/en/metadata.yaml get /metadata/{siteId}/notes
Retrieves a list of all markdown notes associated with a specific site.
# Get Interface Metrics
Source: https://altostrat.io/docs/api/en/site-interfaces-&-metrics/get-interface-metrics
/api/en/monitoring-metrics.yaml post /metrics/interfaces/{interfaceId}/metrics
Fetches time-series traffic metrics (ifInOctets for inbound, ifOutOctets for outbound) for a specific network interface over a given time period. The values are returned as bits per second.
# List Site Interfaces
Source: https://altostrat.io/docs/api/en/site-interfaces-&-metrics/list-site-interfaces
/api/en/monitoring-metrics.yaml get /metrics/interfaces/{siteId}
Retrieves a list of all network interfaces monitored via SNMP for a specific site.
# Get site note
Source: https://altostrat.io/docs/api/en/site-notes/get-site-note
/api/en/control-plane.yaml get /control-plane/{siteId}/note
Returns the note metadata stored for a managed site.
# Update site note
Source: https://altostrat.io/docs/api/en/site-notes/update-site-note
/api/en/control-plane.yaml post /control-plane/{siteId}/note
Creates or replaces the note stored for a managed site.
# Get API credentials for a site
Source: https://altostrat.io/docs/api/en/site-operations/get-api-credentials-for-a-site
/api/en/control-plane.yaml get /control-plane/{siteId}/credentials
Retrieves the current API credentials for a site. These credentials are used by the Altostrat platform to manage the device.
# Get management server for a site
Source: https://altostrat.io/docs/api/en/site-operations/get-management-server-for-a-site
/api/en/control-plane.yaml get /control-plane/{siteId}/management-server
Retrieves the hostname of the Altostrat management server currently responsible for the site's secure tunnel. This is useful for diagnostics.
# Perform an action on a site
Source: https://altostrat.io/docs/api/en/site-operations/perform-an-action-on-a-site
/api/en/control-plane.yaml post /control-plane/{siteId}/action
Sends a command to a site to perform a specific, predefined action. This is used for remote operations like rebooting or clearing firewall rules.
Available actions: - `site.upgrade`: Triggers a software upgrade on the device. - `site.clear_firewall`: Clears the device's firewall rules. - `site.reboot`: Reboots the device. - `site.recreate_management_filter`: Re-applies the Altostrat management firewall rules. - `site.recreate_tunnel`: Tears down and rebuilds the secure tunnel to the platform. - `site.resend_api_user`: Pushes the current API user credentials to the device again.
# Resend bootstrap scheduler
Source: https://altostrat.io/docs/api/en/site-operations/resend-bootstrap-scheduler
/api/en/control-plane.yaml post /control-plane/{siteId}/resend-scheduler
Re-sends the SDX bootstrap scheduler to a managed router. Use this when the router is reachable but scheduled check-ins need to be repaired.
# Rotate API credentials for a site
Source: https://altostrat.io/docs/api/en/site-operations/rotate-api-credentials-for-a-site
/api/en/control-plane.yaml post /control-plane/{siteId}/credentials
Generates new API credentials for the specified site. The old credentials will be invalidated and replaced on the device.
# Attach BGP Policy to a Site
Source: https://altostrat.io/docs/api/en/site-security-configuration/attach-bgp-policy-to-a-site
/api/en/utm-ips.yaml post /content/bgp/{siteId}
Attaches a BGP Threat Intelligence policy to a specific site, activating IP reputation blocking for that site.
# Attach DNS Policy to a Site
Source: https://altostrat.io/docs/api/en/site-security-configuration/attach-dns-policy-to-a-site
/api/en/utm-ips.yaml post /content/{siteId}
Attaches a DNS Content Filtering policy to a specific site, activating its rules for all traffic from that site.
# Detach BGP Policy from a Site
Source: https://altostrat.io/docs/api/en/site-security-configuration/detach-bgp-policy-from-a-site
/api/en/utm-ips.yaml delete /content/bgp/{siteId}
Detaches the currently active BGP Threat Intelligence policy from a specific site, deactivating IP reputation blocking.
# Detach DNS Policy from a Site
Source: https://altostrat.io/docs/api/en/site-security-configuration/detach-dns-policy-from-a-site
/api/en/utm-ips.yaml delete /content/{siteId}
Detaches the currently active DNS Content Filtering policy from a specific site, deactivating its rules.
# List All Site Security Configurations
Source: https://altostrat.io/docs/api/en/site-security-configuration/list-all-site-security-configurations
/api/en/utm-ips.yaml get /content/tunnel
Retrieves a list of all sites (tunnels) associated with your account and their current security policy attachments.
# Retrieve a Site's Security Configuration
Source: https://altostrat.io/docs/api/en/site-security-configuration/retrieve-a-sites-security-configuration
/api/en/utm-ips.yaml get /content/tunnel/{siteId}
Retrieves the current DNS and BGP policy attachments for a specific site.
# Delete a Site
Source: https://altostrat.io/docs/api/en/sites/delete-a-site
/api/en/mikrotik-api.yaml delete /sites/{siteId}
Schedules a site for deletion. The device will be sent a command to remove its bootstrap scheduler, and after a grace period, the site record and all associated data will be permanently removed.
# List Recent Sites
Source: https://altostrat.io/docs/api/en/sites/list-recent-sites
/api/en/mikrotik-api.yaml get /sites/recent
Returns a list of the 5 most recently accessed sites for the authenticated user, ordered by most recent access.
# List Sites
Source: https://altostrat.io/docs/api/en/sites/list-sites
/api/en/mikrotik-api.yaml get /sites
Retrieves a paginated list of all MikroTik sites associated with the authenticated user's workspace.
# List Sites (Minimal)
Source: https://altostrat.io/docs/api/en/sites/list-sites-minimal
/api/en/mikrotik-api.yaml get /sites/minimal
Retrieves a condensed list of MikroTik sites, suitable for UI elements like navigation menus where only essential information is needed.
# Retrieve a Site
Source: https://altostrat.io/docs/api/en/sites/retrieve-a-site
/api/en/mikrotik-api.yaml get /sites/{siteId}
Retrieves the complete details of a specific MikroTik site by its unique identifier (UUID).
# Update a Site
Source: https://altostrat.io/docs/api/en/sites/update-a-site
/api/en/mikrotik-api.yaml patch /sites/{siteId}
Updates the mutable properties of a site, such as its name, location, or timezone. Only the fields provided in the request body will be updated.
# Create SLA Report Schedule
Source: https://altostrat.io/docs/api/en/sla-report-schedules/create-sla-report-schedule
/api/en/reports.yaml post /reports/sla/schedules
Creates a new SLA report schedule. This schedule defines a recurring report, including its frequency, site selection criteria, and SLA targets. The `id` for the schedule will be generated by the server.
# Delete a Report Schedule
Source: https://altostrat.io/docs/api/en/sla-report-schedules/delete-a-report-schedule
/api/en/reports.yaml delete /reports/sla/schedules/{scheduleId}
Permanently deletes an SLA report schedule. This action cannot be undone.
# List SLA Report Schedules
Source: https://altostrat.io/docs/api/en/sla-report-schedules/list-sla-report-schedules
/api/en/reports.yaml get /reports/sla/schedules
Retrieves a list of all configured SLA report schedules for the authenticated customer's workspace.
# Retrieve a Report Schedule
Source: https://altostrat.io/docs/api/en/sla-report-schedules/retrieve-a-report-schedule
/api/en/reports.yaml get /reports/sla/schedules/{scheduleId}
Retrieves the details of a single SLA report schedule by its unique ID.
# Run a Report On-Demand
Source: https://altostrat.io/docs/api/en/sla-report-schedules/run-a-report-on-demand
/api/en/reports.yaml post /reports/sla/schedules/{scheduleId}/run
Triggers an immediate, on-demand generation of a report for a specified date range. This does not affect the regular schedule. The report generation is asynchronous and the result will appear in the Generated Reports list when complete.
# Update a Report Schedule
Source: https://altostrat.io/docs/api/en/sla-report-schedules/update-a-report-schedule
/api/en/reports.yaml put /reports/sla/schedules/{scheduleId}
Updates the configuration of an existing SLA report schedule.
# Cancel a subscription
Source: https://altostrat.io/docs/api/en/subscriptions/cancel-a-subscription
/api/en/workspaces.yaml delete /workspaces/{workspaceId}/billing-accounts/{billingAccountId}/subscriptions/{subscriptionId}
Cancels a subscription at the end of the current billing period. This operation cannot be performed if it would leave the workspace or billing account with insufficient capacity for its current resource usage.
# Check trial eligibility
Source: https://altostrat.io/docs/api/en/subscriptions/check-trial-eligibility
/api/en/workspaces.yaml get /workspaces/{workspaceId}/billing-accounts/{billingAccountId}/trial-eligibility
Checks if a workspace is eligible for a 14-day free trial. A workspace is eligible if it has only one billing account and no existing subscriptions.
# Create a subscription
Source: https://altostrat.io/docs/api/en/subscriptions/create-a-subscription
/api/en/workspaces.yaml post /workspaces/{workspaceId}/billing-accounts/{billingAccountId}/subscriptions
Creates a new Stripe subscription for a billing account. If the workspace is eligible for a trial, a 14-day trial subscription is created without requiring a payment method. Otherwise, a default payment method must be present on the billing account.
# List subscriptions
Source: https://altostrat.io/docs/api/en/subscriptions/list-subscriptions
/api/en/workspaces.yaml get /workspaces/{workspaceId}/billing-accounts/{billingAccountId}/subscriptions
Returns a list of subscriptions associated with a billing account.
# Retrieve a subscription
Source: https://altostrat.io/docs/api/en/subscriptions/retrieve-a-subscription
/api/en/workspaces.yaml get /workspaces/{workspaceId}/billing-accounts/{billingAccountId}/subscriptions/{subscriptionId}
Retrieves the details of a specific subscription.
# Update a subscription
Source: https://altostrat.io/docs/api/en/subscriptions/update-a-subscription
/api/en/workspaces.yaml patch /workspaces/{workspaceId}/billing-accounts/{billingAccountId}/subscriptions/{subscriptionId}
Updates a subscription. This endpoint supports multiple distinct operations. You can change product quantities, add or remove products, update metadata, or perform an action like `pause`, `resume`, or `sync`. Only one type of operation (e.g., `product_quantities`, `add_products`, `action`) is allowed per request.
# Apply a tag to a resource
Source: https://altostrat.io/docs/api/en/tag-values/apply-a-tag-to-a-resource
/api/en/metadata.yaml post /tags/{tagId}/values
Applies a tag with a specific value to a resource, identified by its `correlation_id` and `correlation_type`. If a tag with the same value (case-insensitive) already exists for this tag definition, the existing canonical value will be used.
# Find resources by tag value
Source: https://altostrat.io/docs/api/en/tag-values/find-resources-by-tag-value
/api/en/metadata.yaml get /tags/{tagId}/resources
Retrieves a list of all resources that have a specific tag applied with a specific value. This is a powerful query for filtering resources based on their classifications.
# List tags for a resource
Source: https://altostrat.io/docs/api/en/tag-values/list-tags-for-a-resource
/api/en/metadata.yaml get /resources/{correlationId}/tags
Retrieves all tags that have been applied to a specific resource.
# List unique values for a tag
Source: https://altostrat.io/docs/api/en/tag-values/list-unique-values-for-a-tag
/api/en/metadata.yaml get /tags/{tagId}/values
Retrieves a list of unique values that have been applied to resources using a specific tag definition. This is useful for populating dropdowns or autocomplete fields in a UI.
# Remove a tag from a resource
Source: https://altostrat.io/docs/api/en/tag-values/remove-a-tag-from-a-resource
/api/en/metadata.yaml delete /tags/{tagId}/values/{correlationId}
Removes a specific tag from a resource. This does not delete the tag definition itself.
# Update a tag on a resource
Source: https://altostrat.io/docs/api/en/tag-values/update-a-tag-on-a-resource
/api/en/metadata.yaml put /tags/{tagId}/values/{correlationId}
Updates the value of a tag on a specific resource. This is effectively the same as creating a new tag value, as it will overwrite any existing value for that tag on the resource.
# Create a tag definition
Source: https://altostrat.io/docs/api/en/tags/create-a-tag-definition
/api/en/metadata.yaml post /tags
Creates a new tag definition. A tag definition acts as a template or category (e.g., "Site Type", "Priority") that can then be applied to various resources.
# Create Tag
Source: https://altostrat.io/docs/api/en/tags/create-tag
/api/en/radius.yaml post /radius/tags
# Delete a tag definition
Source: https://altostrat.io/docs/api/en/tags/delete-a-tag-definition
/api/en/metadata.yaml delete /tags/{tagId}
Permanently deletes a tag definition and all of its associated values from all resources. This action cannot be undone.
# Delete Tag
Source: https://altostrat.io/docs/api/en/tags/delete-tag
/api/en/radius.yaml delete /radius/tags/{id}
# Get Tag
Source: https://altostrat.io/docs/api/en/tags/get-tag
/api/en/radius.yaml get /radius/tags/{id}
# List Accounts by Tag
Source: https://altostrat.io/docs/api/en/tags/list-accounts-by-tag
/api/en/radius.yaml get /radius/tags/{tagId}/accounts
# List all tag definitions
Source: https://altostrat.io/docs/api/en/tags/list-all-tag-definitions
/api/en/metadata.yaml get /tags
Retrieves a list of all tag definitions for your workspace. Each tag definition includes its key, color, and a list of all values currently applied to resources. This is useful for understanding the available classification schemes in your environment.
# List Containers by Tag
Source: https://altostrat.io/docs/api/en/tags/list-containers-by-tag
/api/en/radius.yaml get /radius/tags/{tagId}/containers
# List Groups by Tag
Source: https://altostrat.io/docs/api/en/tags/list-groups-by-tag
/api/en/radius.yaml get /radius/tags/{tagId}/groups
# List Tags
Source: https://altostrat.io/docs/api/en/tags/list-tags
/api/en/radius.yaml get /radius/tags
# Retrieve a tag definition
Source: https://altostrat.io/docs/api/en/tags/retrieve-a-tag-definition
/api/en/metadata.yaml get /tags/{tagId}
Retrieves the details of a specific tag definition by its unique ID. This includes all the values that have been applied to resources using this tag.
# Update a tag definition
Source: https://altostrat.io/docs/api/en/tags/update-a-tag-definition
/api/en/metadata.yaml put /tags/{tagId}
Updates the properties of an existing tag definition, such as its key or color.
# Update Tag
Source: https://altostrat.io/docs/api/en/tags/update-tag
/api/en/radius.yaml patch /radius/tags/{id}
# List Available Topics
Source: https://altostrat.io/docs/api/en/topics/list-available-topics
/api/en/notifications.yaml get /notifications/topics
Retrieves a list of all available notification topics. These are the event categories that notification groups can subscribe to.
# Create a transient access session
Source: https://altostrat.io/docs/api/en/transient-access/create-a-transient-access-session
/api/en/control-plane.yaml post /control-plane/{siteId}/transient-accesses
Creates a temporary, secure session for accessing a site via Winbox or SSH. The session is automatically revoked after the specified duration.
# List transient accesses for a site
Source: https://altostrat.io/docs/api/en/transient-access/list-transient-accesses-for-a-site
/api/en/control-plane.yaml get /control-plane/{siteId}/transient-accesses
Retrieves a list of all active and expired transient access sessions for a specific site.
# Retrieve a transient access session
Source: https://altostrat.io/docs/api/en/transient-access/retrieve-a-transient-access-session
/api/en/control-plane.yaml get /control-plane/{siteId}/transient-accesses/{accessId}
Retrieves the details of a single transient access session.
# Revoke a transient access session
Source: https://altostrat.io/docs/api/en/transient-access/revoke-a-transient-access-session
/api/en/control-plane.yaml delete /control-plane/{siteId}/transient-accesses/{accessId}
Immediately revokes an active transient access session, terminating the connection and preventing further access.
# Create a transient port forward
Source: https://altostrat.io/docs/api/en/transient-port-forwarding/create-a-transient-port-forward
/api/en/control-plane.yaml post /control-plane/{siteId}/transient-forward
Creates a temporary, secure port forwarding rule. This allows you to access a device (e.g., a server or camera) on the LAN behind your MikroTik site from a specific public IP address.
# List transient port forwards for a site
Source: https://altostrat.io/docs/api/en/transient-port-forwarding/list-transient-port-forwards-for-a-site
/api/en/control-plane.yaml get /control-plane/{siteId}/transient-forward
Retrieves a list of all active and expired transient port forwarding rules for a specific site.
# Retrieve a transient port forward
Source: https://altostrat.io/docs/api/en/transient-port-forwarding/retrieve-a-transient-port-forward
/api/en/control-plane.yaml get /control-plane/{siteId}/transient-forward/{forwardId}
Retrieves the details of a single transient port forwarding rule.
# Revoke a transient port forward
Source: https://altostrat.io/docs/api/en/transient-port-forwarding/revoke-a-transient-port-forward
/api/en/control-plane.yaml delete /control-plane/{siteId}/transient-forward/{forwardId}
Immediately revokes an active port forwarding rule, closing the connection.
# List available node types
Source: https://altostrat.io/docs/api/en/utilities/list-available-node-types
/api/en/workflows.yaml get /workflows/node-types
Retrieves a list of all available node types (triggers, actions, and conditions) that can be used to build workflows, along with their configuration schemas.
# List available server regions
Source: https://altostrat.io/docs/api/en/utilities/list-available-server-regions
/api/en/managed-vpn.yaml get /vpn/servers/regions
Retrieves a structured list of all available geographical regions where a VPN instance can be deployed.
# List subnets for a site
Source: https://altostrat.io/docs/api/en/utilities/list-subnets-for-a-site
/api/en/managed-vpn.yaml get /vpn/site/{siteId}/subnets
Retrieves a list of available subnets for a specific site, which is useful when configuring site-to-site peers.
# Test a single node
Source: https://altostrat.io/docs/api/en/utilities/test-a-single-node
/api/en/workflows.yaml post /workflows/test-node
Executes a single workflow node in isolation with a provided context. This is a powerful debugging tool to test a node's logic without running an entire workflow.
# Create a vault item
Source: https://altostrat.io/docs/api/en/vault/create-a-vault-item
/api/en/workflows.yaml post /workflows/vault
Creates a new item in the vault for storing sensitive information like API keys or passwords. The secret value is encrypted at rest and can only be used by workflows.
# Delete a vault item
Source: https://altostrat.io/docs/api/en/vault/delete-a-vault-item
/api/en/workflows.yaml delete /workflows/vault/{vaultId}
Permanently deletes a vault item. This action cannot be undone. Any workflows using this item will fail.
# List vault items
Source: https://altostrat.io/docs/api/en/vault/list-vault-items
/api/en/workflows.yaml get /workflows/vault
Retrieves a list of all secret items stored in your organization's vault. The secret values themselves are never returned.
# Retrieve a vault item
Source: https://altostrat.io/docs/api/en/vault/retrieve-a-vault-item
/api/en/workflows.yaml get /workflows/vault/{vaultId}
Retrieves the details of a single vault item by its prefixed ID. The secret value is never returned.
# Update a vault item
Source: https://altostrat.io/docs/api/en/vault/update-a-vault-item
/api/en/workflows.yaml put /workflows/vault/{vaultId}
Updates an existing vault item, such as its name, secret value, or expiration date.
# Get CVEs by MAC Address
Source: https://altostrat.io/docs/api/en/vulnerability-intelligence/get-cves-by-mac-address
/api/en/cve-scans.yaml post /scans/cve/mac-address/cves
Retrieves all discovered vulnerabilities (CVEs) associated with a specific list of MAC addresses across all historical scans. This is the primary endpoint for tracking a device's vulnerability history.
Note: This endpoint uses POST to allow for querying multiple MAC addresses in the request body, which is more robust and secure than a lengthy GET URL.
# Get Mitigation Steps
Source: https://altostrat.io/docs/api/en/vulnerability-intelligence/get-mitigation-steps
/api/en/cve-scans.yaml get /scans/cve/mitigation/{cve_id}
Provides AI-generated, actionable mitigation steps for a specific CVE identifier. The response is formatted in Markdown for easy rendering.
# List All Scanned MAC Addresses
Source: https://altostrat.io/docs/api/en/vulnerability-intelligence/list-all-scanned-mac-addresses
/api/en/cve-scans.yaml get /scans/cve/mac-address/cve/list
Retrieves a list of all unique MAC addresses that have been discovered across all scans for your account. This can be used to populate a device inventory or to discover which devices to query for CVEs.
# List CVE Statuses
Source: https://altostrat.io/docs/api/en/vulnerability-management/list-cve-statuses
/api/en/cve-scans.yaml get /scans/cve/mac-address/cve/status
Retrieves a list of all managed CVE statuses. You can filter the results by MAC address, CVE ID, or status to find specific records.
# Update CVE Status
Source: https://altostrat.io/docs/api/en/vulnerability-management/update-cve-status
/api/en/cve-scans.yaml post /scans/cve/mac-address/cve/status
Updates the status of a specific CVE for a given MAC address. Use this to mark a vulnerability as 'accepted' (e.g., a false positive or acceptable risk) or 'mitigated' (e.g., a patch has been applied or a workaround is in place). Each update creates a new historical record.
# Create a walled garden entry
Source: https://altostrat.io/docs/api/en/walled-garden/create-a-walled-garden-entry
/api/en/captive-portal.yaml post /captive/walled-garden/{siteId}
Adds a new IP address or subnet to the walled garden for a specific site, allowing users to access it before authenticating.
# Delete a walled garden entry
Source: https://altostrat.io/docs/api/en/walled-garden/delete-a-walled-garden-entry
/api/en/captive-portal.yaml delete /captive/walled-garden/{siteId}/{walledGardenEntryId}
Removes an entry from the walled garden, blocking pre-authentication access to the specified IP address or subnet.
# List walled garden entries for a site
Source: https://altostrat.io/docs/api/en/walled-garden/list-walled-garden-entries-for-a-site
/api/en/captive-portal.yaml get /captive/walled-garden/{siteId}
Retrieves a list of all walled garden entries (allowed pre-authentication destinations) for a specific site.
# Retrieve a walled garden entry
Source: https://altostrat.io/docs/api/en/walled-garden/retrieve-a-walled-garden-entry
/api/en/captive-portal.yaml get /captive/walled-garden/{siteId}/{walledGardenEntryId}
Retrieves the details of a specific walled garden entry.
# Update a walled garden entry
Source: https://altostrat.io/docs/api/en/walled-garden/update-a-walled-garden-entry
/api/en/captive-portal.yaml put /captive/walled-garden/{siteId}/{walledGardenEntryId}
Updates the details of a walled garden entry, such as its name. The IP address cannot be changed.
# Get Aggregated Ping Statistics
Source: https://altostrat.io/docs/api/en/wan-tunnels-&-performance/get-aggregated-ping-statistics
/api/en/monitoring-metrics.yaml post /metrics/wan/ping-stats
Fetches aggregated time-series data for latency, jitter (mdev), and packet loss for one or more WAN tunnels over a specified time period. If no tunnels are specified, it returns an aggregated average across all tunnels. This endpoint is optimized for creating performance charts with a specified number of data points.
# Get WAN tunnel ping statistics
Source: https://altostrat.io/docs/api/en/wan-tunnels-&-performance/get-wan-tunnel-ping-statistics
/api/en/monitoring-metrics.yaml post /metrics/wan-tunnels/{tunnelId}/ping-stats
Fetches aggregated time-series data for latency, jitter (mdev), and packet loss for one or more WAN tunnels over a specified time period. If no tunnels are specified, it returns an aggregated average across all tunnels. This endpoint is optimized for creating performance charts with a specified number of data points.
# List Site WAN Tunnels
Source: https://altostrat.io/docs/api/en/wan-tunnels-&-performance/list-site-wan-tunnels
/api/en/monitoring-metrics.yaml get /metrics/wan-tunnels/{siteId}
Retrieves a list of all configured SD-WAN tunnels for a specific site.
# Add a new WAN Tunnel
Source: https://altostrat.io/docs/api/en/wan-tunnels/add-a-new-wan-tunnel
/api/en/wan-failover.yaml post /failover/{site_id}/tunnels
Creates a new, unconfigured WAN tunnel for the site, up to the maximum allowed by the subscription. After creation, use `PUT /failover/{site_id}/tunnels/{tunnel_id}` to configure properties like interface and gateway.
# Add a new WAN Tunnel
Source: https://altostrat.io/docs/api/en/wan-tunnels/add-a-new-wan-tunnel-1
/api/en/wan-failover.yaml post /wan/{site_id}/tunnel
Creates a new, unconfigured WAN tunnel for the site, up to the maximum allowed by the subscription. After creation, use `PUT /failover/{site_id}/tunnels/{tunnel_id}` to configure properties like interface and gateway.
# Configure a WAN Tunnel
Source: https://altostrat.io/docs/api/en/wan-tunnels/configure-a-wan-tunnel
/api/en/wan-failover.yaml put /failover/{site_id}/tunnels/{tunnel_id}
Updates the configuration of a specific WAN tunnel. This is the primary endpoint for defining how a WAN connection operates, including its router interface, gateway, and connection type.
# Delete a WAN Tunnel
Source: https://altostrat.io/docs/api/en/wan-tunnels/delete-a-wan-tunnel
/api/en/wan-failover.yaml delete /failover/{site_id}/tunnels/{tunnel_id}
Permanently deletes a WAN tunnel from the failover configuration. The system will automatically re-prioritize the remaining tunnels.
# Get a Specific Tunnel
Source: https://altostrat.io/docs/api/en/wan-tunnels/get-a-specific-tunnel
/api/en/wan-failover.yaml get /failover/{site_id}/tunnels/{tunnel_id}
Retrieves the detailed configuration and status of a single WAN tunnel.
# List Tunnels for a Site
Source: https://altostrat.io/docs/api/en/wan-tunnels/list-tunnels-for-a-site
/api/en/wan-failover.yaml get /failover/{site_id}/tunnels
Retrieves a detailed list of all WAN tunnels configured for a specific site.
# List Tunnels for a Site
Source: https://altostrat.io/docs/api/en/wan-tunnels/list-tunnels-for-a-site-1
/api/en/wan-failover.yaml get /wan/{site_id}/tunnel
Retrieves a detailed list of all WAN tunnels configured for a specific site.
# List WAN tunnels across accessible sites
Source: https://altostrat.io/docs/api/en/wan-tunnels/list-wan-tunnels-across-accessible-sites
/api/en/wan-failover.yaml get /wan/tunnels
Returns WAN tunnels across the sites available to the authenticated user. The portal uses this for live WAN health views.
# List WAN tunnels across accessible sites
Source: https://altostrat.io/docs/api/en/wan-tunnels/list-wan-tunnels-across-accessible-sites-1
/api/en/wan-failover.yaml get /failover/tunnels
Returns WAN tunnels across the sites available to the authenticated user. The portal uses this endpoint for live WAN health views.
# Update Tunnel Priorities
Source: https://altostrat.io/docs/api/en/wan-tunnels/update-tunnel-priorities
/api/en/wan-failover.yaml post /wan/{site_id}/failover/priorities
Re-orders the failover priority for all tunnels associated with a site. This is an atomic operation; you must provide a complete list of all tunnels and their desired new priorities. The lowest number represents the highest priority.
# Trigger a workflow via webhook
Source: https://altostrat.io/docs/api/en/webhooks/trigger-a-workflow-via-webhook
/api/en/workflows.yaml post /workflows/webhooks/{webhookToken}
A public endpoint to trigger a workflow that has a `webhook_trigger`. Authentication is handled by the unique, secret token in the URL path. The entire request body will be available in the workflow's context.
# Get workflow log statistics
Source: https://altostrat.io/docs/api/en/workflow-logs/get-workflow-log-statistics
/api/en/workflows.yaml get /workflows/{workflowId}/logs/stats
Returns aggregate counts for a workflow log stream.
# List recent workflow logs
Source: https://altostrat.io/docs/api/en/workflow-logs/list-recent-workflow-logs
/api/en/workflows.yaml get /workflows/logs/recent
Returns recent workflow log entries across workflows available to the authenticated user.
# List workflow logs
Source: https://altostrat.io/docs/api/en/workflow-logs/list-workflow-logs
/api/en/workflows.yaml get /workflows/{workflowId}/logs
Returns logs for workflow executions. You can filter by level, node, run, or date range.
# Execute a workflow
Source: https://altostrat.io/docs/api/en/workflow-runs/execute-a-workflow
/api/en/workflows.yaml post /workflows/{workflowId}/execute
Manually triggers the execution of a workflow. The workflow will run asynchronously in the background. The response acknowledges that the execution has been accepted and provides the ID of the new workflow run.
# List workflow runs
Source: https://altostrat.io/docs/api/en/workflow-runs/list-workflow-runs
/api/en/workflows.yaml get /workflows/{workflowId}/executions
Retrieves a paginated list of all past and current executions (runs) for a specific workflow, ordered by the most recent.
# Re-run a workflow
Source: https://altostrat.io/docs/api/en/workflow-runs/re-run-a-workflow
/api/en/workflows.yaml post /workflows/runs/{runId}/rerun
Creates a new workflow run using the same initial trigger payload as a previous run. This is useful for re-trying a failed or completed execution with the original input data.
# Resume a failed workflow
Source: https://altostrat.io/docs/api/en/workflow-runs/resume-a-failed-workflow
/api/en/workflows.yaml post /workflows/runs/{runId}/resume-from/{nodeId}
Resumes a failed workflow run from a specific, successfully completed node. A new workflow run is created, inheriting the context from the original run up to the specified node, and execution continues from there.
# Retrieve a workflow run
Source: https://altostrat.io/docs/api/en/workflow-runs/retrieve-a-workflow-run
/api/en/workflows.yaml get /workflows/runs/{runId}
Retrieves the details of a single workflow run, including its status, trigger payload, error message (if any), and a complete, ordered log of every step that was executed.
# Create a new workflow
Source: https://altostrat.io/docs/api/en/workflows/create-a-new-workflow
/api/en/workflows.yaml post /workflows
Creates a new workflow definition, including its nodes and edges that define the automation graph. A valid workflow must have exactly one trigger node.
# Delete a workflow
Source: https://altostrat.io/docs/api/en/workflows/delete-a-workflow
/api/en/workflows.yaml delete /workflows/{workflowId}
Permanently deletes a workflow and all of its associated runs and logs. This action cannot be undone. A workflow cannot be deleted if it is being called by another workflow.
# Execute a synchronous workflow
Source: https://altostrat.io/docs/api/en/workflows/execute-a-synchronous-workflow
/api/en/workflows.yaml post /workflows/sync/{workflowId}
Executes a workflow that contains a `sync_request_trigger` and immediately returns the result. The workflow must be designed for synchronous execution, meaning it cannot contain long-running tasks like delays or iterators. The final node must be a `text_transform` node configured as the response.
# List all workflows
Source: https://altostrat.io/docs/api/en/workflows/list-all-workflows
/api/en/workflows.yaml get /workflows
Retrieves a list of all workflows belonging to your organization. This endpoint is useful for dashboard displays or for selecting a workflow to execute or edit.
# List triggerable workflows
Source: https://altostrat.io/docs/api/en/workflows/list-triggerable-workflows
/api/en/workflows.yaml get /workflows/triggerable-workflows
Returns active workflows that can be triggered by another workflow or selected as a subflow target.
# Retrieve a workflow
Source: https://altostrat.io/docs/api/en/workflows/retrieve-a-workflow
/api/en/workflows.yaml get /workflows/{workflowId}
Retrieves the complete details of a single workflow by its prefixed ID, including its full node and edge configuration.
# Update a workflow
Source: https://altostrat.io/docs/api/en/workflows/update-a-workflow
/api/en/workflows.yaml put /workflows/{workflowId}
Updates an existing workflow. You can update any property, including the name, description, active status, schedule, or the entire graph of nodes and edges.
# Validate a workflow definition
Source: https://altostrat.io/docs/api/en/workflows/validate-a-workflow-definition
/api/en/workflows.yaml post /workflows/validate
Validates a workflow graph before you create or update it. Use this to catch missing triggers, invalid node configuration, and graph errors.
# Add a member to a workspace
Source: https://altostrat.io/docs/api/en/workspace-members/add-a-member-to-a-workspace
/api/en/workspaces.yaml post /workspaces/{workspaceId}/members
Adds a new user to a workspace with a specified role. Only workspace owners and admins can add new members. A workspace cannot have more than 100 members.
# List workspace members
Source: https://altostrat.io/docs/api/en/workspace-members/list-workspace-members
/api/en/workspaces.yaml get /workspaces/{workspaceId}/members
Returns a list of users who are members of the specified workspace, including their roles.
# Remove a member from a workspace
Source: https://altostrat.io/docs/api/en/workspace-members/remove-a-member-from-a-workspace
/api/en/workspaces.yaml delete /workspaces/{workspaceId}/members/{memberId}
Removes a member from a workspace. A user can remove themselves, or an owner/admin can remove other members. The last owner of a workspace cannot be removed.
# Update a member's role
Source: https://altostrat.io/docs/api/en/workspace-members/update-a-members-role
/api/en/workspaces.yaml patch /workspaces/{workspaceId}/members/{memberId}
Updates the role of an existing member in a workspace. Role changes are subject to hierarchy rules; for example, an admin cannot promote another member to an owner.
# Archive a workspace
Source: https://altostrat.io/docs/api/en/workspaces/archive-a-workspace
/api/en/workspaces.yaml delete /workspaces/{workspaceId}
Archives a workspace, preventing any further modifications. A workspace cannot be archived if it contains organizations with active resource usage or billing accounts with active subscriptions. This is a soft-delete operation. Only workspace owners can perform this action.
# Create a workspace
Source: https://altostrat.io/docs/api/en/workspaces/create-a-workspace
/api/en/workspaces.yaml post /workspaces
Creates a new workspace, which acts as a top-level container for your resources, users, and billing configurations. The user creating the workspace is automatically assigned the 'owner' role.
# List workspaces
Source: https://altostrat.io/docs/api/en/workspaces/list-workspaces
/api/en/workspaces.yaml get /workspaces
Returns a list of workspaces the authenticated user is a member of.
# Retrieve a workspace
Source: https://altostrat.io/docs/api/en/workspaces/retrieve-a-workspace
/api/en/workspaces.yaml get /workspaces/{workspaceId}
Retrieves the details of an existing workspace. You must be a member of the workspace to retrieve it.
# Update a workspace
Source: https://altostrat.io/docs/api/en/workspaces/update-a-workspace
/api/en/workspaces.yaml patch /workspaces/{workspaceId}
Updates the specified workspace by setting the values of the parameters passed. Any parameters not provided will be left unchanged. Only workspace owners and admins can perform this action.
# Architecture and Scale
Source: https://altostrat.io/docs/radius/en/architecture
Understand how ArcRadius uses a global RadSec data plane, management control plane, analytics plane, multi-region data stores, deterministic sharding, and streaming imports.
ArcRadius is the distributed RADIUS service behind Altostrat Radius. It is built as three separate planes: a data plane for live RADIUS traffic, a control plane for management and configuration, and an analytics plane for accounting, logs, triggers, and insights.
This matters operationally because authentication needs to stay fast while the rest of the platform can scale independently for logs, metrics, imports, quota checks, API calls, workflows, and dashboards.
```mermaid theme={null}
flowchart LR
NAS["NAS device"] -->|"RadSec mTLS"| GA["Global anycast ingress"]
GA --> NLB["Regional Network Load Balancer"]
NLB --> Proxy["RadSec proxy on ECS"]
Proxy -->|"Access-Request"| Core["RADIUS server tasks on ECS"]
Core -->|"Internal REST"| API["Region-local API on Lambda"]
API -->|"PrivateLink"| Data["DynamoDB Global Tables"]
Proxy -->|"Accounting and post-auth events"| Stream["Kinesis stream"]
Stream --> Analytics["Timestream analytics"]
API --> Logs["Logs and auth outcomes"]
Logs --> UI["Live View and dashboards"]
UI -->|"Manual disconnect / quota action"| Control["Dynamic authorization sender"]
Control -->|"PoD / CoA"| NAS
```
## Platform Planes
| Plane | What it handles |
| --------------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
| Data plane | RadSec ingress, TLS termination, NAS identity, Access-Request handling, Accounting-Request handling, and dynamic authorization packet flow. |
| Control plane | Web UI, REST API, users, folders, groups, realms, NAS devices, certificates, quotas, metadata, workflows, and configuration changes. |
| Analytics plane | Authentication logs, accounting data, usage metrics, accounting triggers, search, dashboards, and insight queries. |
## Request Flow
A NAS device starts a RadSec connection to the global service endpoint. Global routing sends the connection to the nearest healthy regional deployment rather than waiting on DNS propagation.
The connection reaches a regional Network Load Balancer, which forwards the TCP flow to the RadSec proxy layer running on containerized infrastructure.
The RadSec edge uses mutual TLS and validates the NAS certificate against the client CA issued for the workspace.
The certificate identifies the workspace, organization, and NAS. The edge rewrites the `NAS-Identifier` to the registered NAS identity, so authorization and logs rely on the trusted certificate identity instead of a mutable packet field.
Access requests are handled by horizontally scalable RADIUS server tasks and translated into secure, region-local API calls for policy evaluation, password handling, check attributes, realm logic, quota state, and reply attributes.
Accounting and post-authentication data are streamed into the analytics plane so accounting load does not block authentication throughput.
Authentication results, accounting usage, session markers, quota state, and admin requests are processed by background workers and metrics pipelines.
## Authentication Behavior
The policy service supports common access patterns used by broadband, Wi-Fi, VPN, and network-access devices:
* PAP-style password authentication.
* CHAP authentication when the NAS sends CHAP attributes.
* MS-CHAP and MS-CHAPv2, including NT password material needed by FreeRADIUS.
* EAP challenge handling where the upstream RADIUS flow needs to continue the exchange.
* MAC-based lookup using Calling-Station-Id or MAC-like usernames.
* Optional auto-registration for unknown MAC-based users when the NAS allows it.
Access still depends on the user, NAS, customer boundary, account status, realm, check attributes, password, and quota state. A device cannot bypass policy just by sending a different `NAS-Identifier`; RadSec traffic is normalized to the NAS identity from the client certificate.
## Why The Architecture Scales
| Layer | Scaling behavior |
| ---------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Global ingress | Routes RadSec traffic to the nearest healthy regional deployment and can fail over across regions without waiting for DNS changes. |
| Network load balancing | Uses high-performance Layer 4 regional load balancing for TCP/RadSec traffic. |
| RadSec edge | Uses a concurrent Go runtime with a goroutine per NAS connection and per-client UDP backend handling to avoid contention between devices. |
| RADIUS core | Runs as horizontally scalable container tasks so authentication capacity can grow with live traffic. |
| Internal API | Uses serverless regional API workers for elastic policy evaluation and management operations. |
| Device identity | Uses mTLS certificate validation so the platform can trust which workspace, organization, and NAS produced the traffic. |
| Policy lookup | Caches NAS devices, authentication profiles, and group profiles for short windows to reduce repeated database reads during busy authentication periods. |
| Data storage | Uses DynamoDB-backed records, global replication, write sharding, sharded counters, and deterministic username sharding for fast lookups and hot-partition protection. |
| Logs | Uses sharded log access patterns so recent operational views can page through high-volume NAS logs without loading broad time ranges into memory. |
| Analytics | Streams accounting and post-auth events independently of the authentication path, then stores time-series data for dashboards, triggers, and insight queries. |
| Quotas | Reads quota status from a DynamoDB quota table during authorization, while scheduled workers refresh quota state from accounting usage data. |
| Imports | Large migration jobs stream CSV rows in chunks instead of loading entire files into memory, with lookup data prefetched once for the batch. |
The current migration worker design is validated for large imports of 300,000 or more records with flat memory usage and O(1) lookup query growth for shared group and tag data. In the reviewed architecture notes, the 300,000-record path moved from multi-gigabyte memory pressure and thousands of repeated lookups to chunked processing, roughly 50 MB memory use, and two shared lookup queries for group and tag data.
## Data Plane Responsibilities
The RadSec edge handles:
* Global and regional ingress for RadSec traffic.
* TLS termination for RadSec.
* Client certificate authentication.
* Registered NAS identity extraction.
* RADIUS packet framing and forwarding.
* `NAS-Identifier` normalization.
* Accounting response generation.
* Accounting metric extraction.
* Session start, stop, usage, and last-IP metric publishing.
* Dynamic authorization metric extraction for Disconnect and CoA packets when observed.
## Control Plane Responsibilities
The RADIUS service handles:
* NAS registration and certificate material.
* User, folder, group, realm, tag, and metadata management.
* Check and reply attribute validation.
* Password storage and reset flows.
* PAP, CHAP, MS-CHAP, and MS-CHAPv2 handling.
* EAP challenge pass-through behavior where applicable.
* Realm matching and optional NAS-to-realm locking.
* MAC-based lookup and optional auto-registration.
* Quota status checks and top-ups.
* Manual session disconnects.
* Authentication metrics and NAS logs.
## Control Plane
The control plane is the management surface used by operators and integrations. The web UI and REST API manage configuration changes through authenticated and authorized API calls.
Use the control plane for:
* Creating and updating users, folders, groups, realms, and NAS devices.
* Managing certificate material and RadSec device configuration.
* Updating check attributes, reply attributes, metadata, tags, quotas, and account status.
* Connecting provisioning, billing, identity management, and workflow systems through the API.
* Searching operational records and reviewing logs.
The control plane scales independently from live RADIUS packet handling. That separation keeps authentication traffic isolated from operator activity, bulk imports, and integration traffic.
## Analytics Plane
The analytics plane receives accounting and post-authentication events from the data plane. It is designed for high-throughput ingestion and fast time-series queries across historical RADIUS events.
Use the analytics plane for:
* Authentication logs and 12-month log retention.
* Accounting data and 12-month accounting retention.
* Usage charts, sessions, quotas, and top-ups.
* Accounting triggers, such as usage-threshold automation.
* Dashboards, Live View, and insight queries.
* Full-text operational search.
Because analytics is decoupled from the authentication path, accounting bursts should not slow down Access-Request processing.
## Quota And Session Control Path
Quota enforcement is deliberately split:
1. Groups define quota attributes such as `X-Octet-Quota` and reset behavior.
2. Accounting packets update usage metrics.
3. Scheduled quota workers calculate current usage, apply active top-ups, and write quota state.
4. Authorization reads the current quota state during login.
5. When a user first crosses quota, the platform can dispatch a disconnect workflow for the active session.
This keeps the authentication path short while still supporting quota-aware replies, top-ups, and Packet of Disconnect workflows for devices that support dynamic authorization.
## Multi-Tenant Isolation
The platform uses several layers of isolation:
* NAS traffic is tied to a certificate identity.
* Authorization rejects unknown NAS devices.
* Users must belong to the same customer as the NAS.
* Realms can limit which group attributes apply for a matching username suffix.
* NAS devices can be locked to a realm when that behavior is configured.
If a request cannot be tied to a known NAS or the user belongs to a different customer, it is rejected.
## Metrics And Observability
RADIUS operations feed the monitoring views with:
* Access-Accept, Access-Reject, and Access-Challenge counters.
* Reject reasons when available.
* Accounting packets by status type.
* Input and output bytes, including 64-bit Gigawords accounting.
* Input and output packets.
* Session time.
* Session start and stop timestamps.
* Last observed framed IP address.
* Admin request events for Disconnect and CoA.
Accounting and post-authentication events are streamed independently from live authentication. Authentication outcomes and logs are published by the RADIUS service and background metrics pipeline. Together they power Live View, user dashboards, device dashboards, quota checks, top-ups, disconnect workflows, accounting triggers, search, and troubleshooting.
## Operational Implications
* Use RadSec certificates from the NAS detail page rather than sharing credentials between devices.
* Keep accounting enabled when you rely on usage, sessions, quotas, top-ups, or disconnect workflows.
* Use groups for policy because group profiles are cache-friendly and reusable.
* Use realms when username suffixes should constrain policy.
* Use CoA and PoD only on devices that support dynamic authorization and allow the configured source address.
* Review [Limits and Availability](./limits-and-availability) before large migrations, high-rate authentication deployments, or multi-region planning.
# CoA and PoD
Source: https://altostrat.io/docs/radius/en/coa-and-pod
Configure Change of Authorization and Packet of Disconnect for RADIUS NAS devices, manual session disconnects, and quota-triggered disconnects.
CoA and PoD are dynamic authorization controls for active RADIUS sessions. Use them when Altostrat needs to change or terminate a user's current session after authentication has already succeeded.
* **CoA** means Change of Authorization. It asks the NAS to update an active session's authorization.
* **PoD** means Packet of Disconnect. It sends a Disconnect-Request to terminate an active session.
In the RADIUS UI, both are configured on the NAS device as **CoA and PoD Replies**.
Dynamic authorization uses a different path from ordinary authentication. Access requests come from the NAS to Altostrat. CoA and PoD requests are sent from Altostrat toward the NAS, so the NAS must expose an inbound dynamic-authorization listener and accept the configured source, port, and secret.
## Prerequisites
Before you enable CoA or PoD, confirm that:
* The NAS supports dynamic authorization.
* The NAS can receive dynamic authorization traffic on the configured inbound port.
* The NAS firewall allows the message source address shown on the device page.
* The CoA and PoD shared secret matches between Altostrat and the NAS.
* Accounting is enabled so active sessions include the identifiers needed for disconnect workflows.
## Configure CoA And PoD On A NAS
Go to **Settings**, select **Devices**, and open the NAS device.
Select **Edit** and enable **CoA and PoD Replies**.
Use the address where the NAS accepts dynamic authorization requests.
Use the port configured on the NAS. The UI defaults to `3799`.
Enter or generate the shared secret used for CoA and PoD messages.
Configure the NAS firewall to accept messages from the source address shown in the device page.
The current UI shows `18.214.81.214` as the message source address for CoA and PoD. Use the value in the live device page if it differs.
## Manual Disconnect
The user detail page can show **Disconnect Session** when a user has an active or recent session. When you disconnect a user, Altostrat:
1. Finds the user.
2. Looks up the user's most recent NAS log.
3. Resolves the NAS device and its CoA/PoD reply settings.
4. Builds a Disconnect-Request using available session attributes such as `User-Name`, `NAS-IP-Address`, and `Acct-Session-Id`.
5. Sends the request to the NAS using the configured NAS IP, port, and secret.
6. Writes the disconnect attempt to NAS logs.
If recent session attributes are missing, the disconnect request may fail even when CoA and PoD are enabled.
## CoA Versus PoD
| Control | RADIUS packet | What you use it for |
| ----------------------- | -------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- |
| Packet of Disconnect | `Disconnect-Request` | Terminate a user's active session so the NAS forces the client off or requires a new login. |
| Change of Authorization | `CoA-Request` | Ask the NAS to change authorization for an active session, such as applying a different role, filter, or rate limit when the NAS supports it. |
The NAS answers dynamic authorization requests with an acknowledgement or a negative acknowledgement. Use the NAS dashboard, user dashboard, and device-side logs together when you need to tell whether the packet was sent, accepted, rejected, or ignored by the device.
## Quota-Triggered Disconnects
When quota attributes are configured on groups, the quota worker checks usage against accounting data. If a user crosses the effective quota, Altostrat can dispatch a disconnect job for that user.
Top-ups increase the user's effective allowance. If a top-up brings the user back within allowance, the quota marker is recalculated.
Use quota-triggered disconnects only when:
* Accounting is reliable.
* The NAS sends interim updates often enough for your enforcement window.
* CoA and PoD settings are configured on the NAS.
* Operators understand how top-ups affect the allowance.
If the user has multiple quota-enabled groups, the lowest group quota is the effective quota. Top-ups add allowance on top of that effective quota and recalculate whether the user is still exceeded.
## Monitoring Dynamic Authorization
Dynamic authorization activity appears in logs and metrics as admin request activity. Where packet details are available, the platform records Disconnect and CoA request type, username, workspace, organization, and NAS context.
Use:
* The NAS dashboard to review device-scoped logs.
* The user dashboard to confirm the session state.
* Live View to inspect nearby authentication and accounting events.
## Troubleshooting
If manual disconnect or quota disconnect does not work:
* Confirm the NAS IP address is reachable from the message source address.
* Confirm the inbound port is open. The default is `3799`.
* Confirm the secret matches exactly.
* Confirm accounting is sending `Acct-Session-Id`.
* Confirm accounting Start, Stop, and Interim-Update packets are enabled if you rely on session and quota enforcement.
* Confirm the user has a recent NAS log.
* Confirm the NAS supports Disconnect-Request for the access technology in use.
* Confirm the NAS supports CoA-Request before expecting an in-place authorization change.
* Confirm the NAS firewall allows the source address shown in the UI.
CoA and PoD are live session controls. Test on one device and one user before enabling them broadly.
# Folders and Users
Source: https://altostrat.io/docs/radius/en/containers-and-users
Organize RADIUS users with folders, bulk actions, user profiles, credentials, status controls, sessions, logs, and metadata.
The main RADIUS workspace combines folders and users in one operational view. You can add users directly at the root, build nested folders for hierarchy, and open detail dashboards for a user or folder as your deployment grows.
## Prerequisites
Before you manage users, confirm that:
* At least one NAS device is registered if you want to test authentication immediately.
* Groups exist for any reusable access policy you want to assign.
* Realms exist if usernames should use suffixes such as `tim@example.com`.
* You know whether users should live at the root or inside folders.
## Folders
Folders are containers for users and nested folders. They are useful when you need to organize users by customer, site, region, department, plan, tenant, or operational ownership.
Each folder can have:
* A name.
* A description.
* A priority from 1 to 5, where 1 is highest and 5 is lowest.
* A pinned state for quick access.
* Nested folders and users.
The workspace shows folder and user counts, supports pagination, and preserves list state such as page size, page cursor, sort field, sort direction, group filters, and tag filters in the URL.
## Create Folders
Go to `/radius` in the RADIUS app.
Use the add menu to create one folder or add multiple folders at once.
Enter a clear name and optional description.
Choose a priority and pin the folder if it should stay prominent.
The folder appears alongside users in the current workspace location.
## Folder Actions
From the folder list, you can:
* Open a folder to work inside it.
* Edit the folder name, description, priority, or pinned state.
* Pin or unpin one or more folders.
* Change priority for selected folders.
* Move selected folders to another folder.
* Merge selected folders.
* Delete a folder when it is no longer needed.
Deleting or merging folders changes the organizational structure for nested folders and users. Confirm the destination before performing bulk moves or destructive actions.
## Users
Users are individual RADIUS identities. A user can live at the root or in a folder, belong to one or more groups, inherit attributes from groups and realms, and carry user-specific attributes and metadata.
When creating a user, the form supports:
* Username.
* Optional realm suffix through the realm picker.
* Password or generated password.
* Display name.
* Folder assignment.
* Group membership.
* Custom check attributes.
* Custom reply attributes.
* Metadata.
## Create Users
Go to the root workspace or the folder where the user should live.
Use the add menu to create one user or add multiple users.
Enter a username and password. Use the password generator when you want the UI to create a credential.
Use the `@` selector for realm-backed usernames, or paste a username that already includes a realm.
Add groups so the user inherits the intended check and reply attributes.
Authenticate from a NAS device, then review the user detail page or Live View.
## Bulk User Creation
The bulk user workflow lets you add multiple users in one pass. Each row can include a username, password, display name, folder, group assignment, and advanced fields. Use this for first imports, customer onboarding, or batches of temporary accounts.
Recommended checks before saving a bulk set:
* Usernames are unique.
* Passwords are present or generated.
* Display names are readable for operators.
* The folder is correct.
* The selected groups match the intended policy.
For very large migrations, use the migration workflow instead of building a massive manual batch. The RADIUS backend is designed for streaming, chunked imports so large onboarding jobs can validate shared group and tag data once and process records without loading an entire file into memory.
## MAC-Based Users And Auto Registration
Some NAS devices authenticate by MAC address rather than by a human-entered username and password. When the NAS sends a Calling-Station-Id or a MAC-like username, Altostrat can resolve the user by normalized MAC identity.
If auto registration is enabled on the NAS, an unknown MAC-based user can be created automatically and assigned to the NAS device's configured auto-registration group. Use this only for networks where unknown device onboarding is intentional, such as controlled MAC-auth deployments.
## User Detail Page
Open a user to review and operate the account. The dashboard includes:
* Display name and username.
* Folder link and move-to-folder action.
* Group membership and group management.
* Realm link when the username matches a configured realm.
* Credentials popover for copying username and password.
* Status controls for active, disabled, suspended, and re-enabled states shown by the UI.
* Edit, delete, and suspend/enable actions.
* Time range selection for user metrics.
* Latest session, active sessions, usage, and monthly activity where data is available.
* Effective check and reply attributes, including inherited group attributes.
* User logs with links back to devices.
* Metadata fields and shortcuts.
If quota features are used in your environment, user dashboards can also show top-up and usage context from the RADIUS data model.
## Move Users
You can move a user from the user detail page or select users in the workspace and choose a destination folder. Use moves when operational ownership changes, a customer migrates, or a user was created in the wrong folder.
## Status And Access Controls
Use status controls carefully:
* **Active** users can authenticate if their credentials and policy are valid.
* **Disabled** users are marked inactive in the user form.
* **Suspended** users are blocked until re-enabled through the user action menu.
* **Disconnect Session** terminates the current active session when session control is available for that user and NAS.
## Metadata
Metadata is custom key-value context on the user. The UI treats `display_name` specially by showing it as the user's friendly name. The `site_id` key uses the Altostrat site picker where available.
Use metadata for operator context such as customer identifiers, billing references, help desk IDs, or ownership fields. Do not store shared secrets or passwords in metadata.
# Getting Started with RADIUS
Source: https://altostrat.io/docs/radius/en/getting-started
Configure your first RADIUS device, group, user, and test authentication from the Altostrat Radius UI.
Use this guide when you are setting up a RADIUS workspace for the first time. It follows the same order shown by the empty-state workflow in the app: add a device, create a group, add users, then organize and monitor.
## Prerequisites
Before you begin, confirm that:
* You can sign in to the Altostrat Radius UI at [radius.altostrat.app](https://radius.altostrat.app).
* You have permission to create NAS devices, groups, users, and realms in the workspace.
* Your network device supports RADIUS or RadSec and can be configured with the values shown in the device detail page.
* You know the first policy attributes you need to return or check, or you have an existing RADIUS configuration to translate into groups.
* If you plan to use CoA or PoD, the NAS can accept control messages from the source address shown in the UI.
## First Setup
Go to [radius.altostrat.app](https://radius.altostrat.app) and select the workspace you want to configure.
Open **Settings** and select **Devices**. Create a NAS device with a device name, type, and optional description.
After the device is created, open its detail page. Use the RadSec configuration values and certificate downloads shown there when configuring the network device.
Open **Settings** and select **Groups**. Create a group for the first reusable access policy, then add check or reply attributes as needed.
Return to the main RADIUS workspace and add a user. Enter the username, generate or set a password, add an optional display name, choose a folder, and assign groups.
Authenticate from the configured NAS device. Open **Live View** or the relevant user/device dashboard to confirm whether the request was accepted or rejected.
## Device Setup Notes
When you add a NAS device, the form supports:
* Device name or NAS identifier.
* Device description.
* Device type: router, switch, access point, VPN gateway, firewall, wireless controller, or other.
* Auto user registration, optionally tied to a default group.
* CoA and PoD replies, including NAS IP address, inbound port, and shared secret.
* Metadata fields for local context.
After saving the device, the detail page exposes RadSec configuration values and downloads for the NAS certificate, client CA certificate, and private key.
Use the values shown in the current device page as the source of truth. The UI currently shows RadSec service values for `aaa.altostrat.io`, port `2083`, and IP addresses `75.2.67.221` and `166.117.188.111`.
Use RadSec where the device supports it. RadSec gives each NAS its own mutual-TLS identity, and Altostrat normalizes requests to that registered NAS identity before policy is evaluated.
## Group Setup Notes
Groups are where you define reusable RADIUS policy. Add:
* Check attributes for values evaluated during authentication.
* Reply attributes for values returned after successful authentication.
* Metadata when your team needs operational context.
Users can inherit attributes from multiple groups. When you edit a user, the UI shows inherited attributes by group so you can see where an effective policy came from.
If you are migrating from an existing FreeRADIUS deployment, start with one group per reusable plan, role, VLAN, rate limit, or access tier. Then recreate attributes through the picker so the operator, input type, and vendor dictionary are validated before you test on a live NAS.
## User Setup Notes
When you create a user, the form supports:
* Username.
* Optional realm suffix selected through the `@` realm picker.
* Password entry or generated password.
* Optional display name.
* Folder selection.
* Group membership.
* Custom check and reply attributes.
* Metadata fields.
The credentials popover on an existing user lets you copy the username and password. The user detail page also lets you edit the user, reset credentials, suspend or enable access, delete the user, and review sessions and logs.
## Confirm The First Authentication
Open **Live View** after the NAS sends a request. Use the filters to narrow the view by status type, user, device, folder, timeframe, or failures only.
Healthy first-run signs:
* The NAS device appears in logs.
* The username matches the expected user.
* The status is success or an intentional policy rejection.
* The user detail page shows the latest session and recent logs.
* The device dashboard shows requests, success rate, active sessions, and rejects.
If the first request is rejected, start with [Troubleshooting](./troubleshooting) before changing multiple objects at once.
## What To Read Next
Learn how RadSec, policy lookup, metrics, quotas, logs, and imports are designed to scale.
Review the supported attributes, operators, input types, and validation limits before building broad policy.
Configure dynamic authorization when active sessions need manual or quota-triggered disconnects.
# Groups and Attributes
Source: https://altostrat.io/docs/radius/en/groups-and-attributes
Use RADIUS groups to manage reusable check attributes, reply attributes, inherited policy, members, metadata, and quota-aware presence modes.
Groups are the main policy layer in the RADIUS UI. You attach attributes to a group, then assign users to that group directly or through a realm. This keeps user records simple while giving you a consistent place to manage shared access behavior.
## Prerequisites
Before you build groups, confirm that:
* You know the RADIUS attributes your NAS devices expect.
* The required attributes are available in the attribute picker.
* You understand whether an attribute belongs in the authentication check or the successful authentication reply.
* You have at least one user or realm ready for testing.
## What A Group Contains
A group includes:
* Group name.
* Check attributes.
* Reply attributes.
* Member users.
* Metadata.
The group dashboard lets you rename the group inline, edit check and reply attributes, add or remove members, update metadata, and delete the group.
## Check Attributes
Check attributes are used during authentication. Use them for conditions or values that must be evaluated before the RADIUS server accepts the request.
The group dashboard describes check attributes as attributes sent to the RADIUS server during authentication.
## Reply Attributes
Reply attributes are returned after successful authentication. Use them for values the NAS needs after access is granted, such as session behavior, authorization hints, network policy, or vendor-specific values.
The group dashboard describes reply attributes as attributes sent back from the RADIUS server upon successful authentication.
## Attribute Rows
Each attribute row has:
* **Attribute**: selected from the RADIUS attribute dictionary.
* **Operator**: limited to the operators allowed for that selected attribute.
* **Value**: rendered with the correct input style for the attribute, such as text, number, password, IP address, select option, duration, bandwidth, storage, or URL.
* **Presence**: shown when quota-aware behavior is available.
The UI fetches the attribute dictionary and uses it to show descriptions, allowed operators, validation hints, vendor grouping, and value input types. Use the picker rather than typing attribute names from memory.
The current dictionary includes 51 attributes across Standard, MikroTik, WISPr, Ubiquiti, Cisco, Aruba, Ruckus, Juniper, Microsoft, and Altostrat System attributes. See [Supported Dictionaries](./supported-dictionaries) for the full vendor breakdown.
## Presence Modes
Presence controls when an attribute is sent. The UI supports these modes:
| Mode | When the attribute is sent |
| --------------------- | ------------------------------------------------------------------------------------------------------------------------------------- |
| Always | Sent regardless of usage or status. |
| Normal (within quota) | Sent only if the user has not reached quota and is not suspended. |
| Quota exceeded | Sent only when quota has been reached or exceeded. |
| Suspended | Available for policy modeling in the UI. Suspended users are normally rejected before ordinary success reply attributes are returned. |
Presence modes are especially useful when you need different reply behavior for normal access and quota exhaustion. For manual suspension, expect the account status to block access rather than grant a normal success reply.
## Quota Attributes
Quota behavior is configured with System attributes on groups:
* `X-Octet-Quota`
* `X-Quota-TTL`
* `X-Quota-Reset-After`
* `X-Quota-Carry-Over-Cycles`
* `X-Quota-Expire-TTL`
Quota attributes are group policy, not user-specific policy. During authorization, Altostrat checks whether the user belongs to quota-enabled groups and reads the current quota state. Scheduled quota workers refresh usage from accounting metrics, factor in active top-ups, and can trigger disconnect workflows when a user first exceeds quota.
When multiple assigned groups define quota, the lowest quota is used as the effective limit. If no reset schedule is configured, quota calculations default to a monthly period. Top-ups add temporary allowance and cause the exceeded flag to be recalculated.
## Create A Group
Go to **Settings**, then select **Groups**.
Add a group and enter a clear group name.
Add only the authentication-time attributes required for the policy.
Add the values the NAS should receive after successful authentication.
Add operational context when it helps operators understand the group.
Add users from the group dashboard, from a user detail page, or through a realm.
## Inheritance
Users inherit attributes from their groups. When you open a user, inherited attributes are displayed with their source group so you can trace policy back to the object that defined it.
Realms can also apply groups automatically. If a user authenticates with a username that matches a realm, the selected realm groups are applied in addition to directly assigned user groups.
Group reply attributes are merged first, then user-specific reply attributes are applied. User-specific attributes are best for exceptions because they override group values unless the operator is `+=`, which appends another value for multi-value attributes such as routes.
When a user has multiple groups, review the effective attribute display on the user detail page before assuming the final policy. The UI is the best place to confirm what will be applied for that user.
## Recommended Practices
* Keep common policy on groups instead of repeating user-specific attributes.
* Give groups operational names that describe intent, not only implementation details.
* Use user-specific attributes for exceptions and short-lived overrides.
* Review inherited attributes on a test user before assigning a group broadly.
* Use metadata to connect groups to billing, CRM, support, or customer records.
* Keep quota-exceeded behavior explicit when those users should receive different reply attributes, and document suspension behavior as an access block.
* Use [CoA and PoD](./coa-and-pod) when quota exhaustion should disconnect active sessions instead of only changing future reply attributes.
# RADIUS Overview
Source: https://altostrat.io/docs/radius/en/introduction
Learn how the Altostrat Radius web UI organizes devices, users, groups, realms, attributes, live logs, and operational settings.
Altostrat Radius is the managed access-control workspace for networks that authenticate users through RADIUS or RadSec. You use it to register the network devices that send authentication requests, create the users who sign in, apply policy through groups and attributes, and monitor authentication outcomes in real time.
Open the RADIUS UI at [radius.altostrat.app](https://radius.altostrat.app). The UI is organized around the same operational objects you manage day to day: folders, users, groups, devices, realms, live logs, and settings.
## What You Manage
Create RADIUS identities, reset credentials, assign groups, place users in folders, suspend access, and review per-user sessions and usage.
Organize users into nested containers, pin important folders, set priority, move users, merge folders, and manage bulk onboarding.
Define reusable check and reply attributes, then assign those policy sets directly to users or automatically through realms.
Pick from the Standard, MikroTik, WISPr, Ubiquiti, Cisco, Aruba, Ruckus, Juniper, Microsoft, and System attributes surfaced by the UI.
Register routers, switches, access points, VPN gateways, firewalls, wireless controllers, and other RADIUS clients.
Configure dynamic authorization for manual disconnects, quota-triggered disconnects, and supported session control workflows.
Understand the global RadSec data plane, mTLS device identity, control plane, analytics plane, multi-region storage, and streaming imports.
Review feature coverage, retention, availability targets, throughput limits, migration limits, and default account limits.
Match usernames such as `tim@example.com` and automatically apply group attributes to users in that realm.
Watch authentication volume, failures, active sessions, device logs, and per-user behavior from the Live View and entity dashboards.
## App Map
| Area | Route in the RADIUS UI | What it is for |
| -------------- | ----------------------- | -------------------------------------------------------------------------------------------------------- |
| Main workspace | `/radius` | Browse folders and users, create identities, create folders, move users, and perform bulk actions. |
| Folder detail | `/radius/container/...` | Work inside a nested folder while preserving the same folder and user controls. |
| User detail | `/radius/users/{id}` | Review credentials, status, group membership, inherited attributes, sessions, usage, logs, and metadata. |
| Devices | `/radius/nas` | Register and manage NAS/RADIUS clients and open per-device dashboards. |
| Groups | `/radius/groups` | Create policy groups, edit attributes, and manage group members. |
| Realms | `/radius/realms` | Create realm suffixes and apply groups automatically to matching usernames. |
| Live View | `/radius/live` | Filter live authentication data by status, user, device, folder, timeframe, and failures. |
| Settings | `/radius/settings` | Customize labels and manage metadata shortcuts. |
## Platform Architecture
Altostrat Radius separates live packet handling from policy management and analytics. The ArcRadius data plane uses global ingress, regional load balancing, RadSec mutual TLS, and horizontally scalable RADIUS workers to process authentication close to the nearest healthy regional deployment.
The control plane stores and evaluates users, folders, groups, realms, NAS devices, quotas, metadata, and logs. The analytics plane streams accounting and post-authentication events into time-series storage for dashboards, triggers, search, quotas, and reporting. This separation keeps authentication traffic isolated from operator activity, imports, accounting bursts, and long-running queries.
See how RadSec, mTLS identity, caching, sharding, quotas, metrics, and imports fit together.
Review the current Standard, MikroTik, WISPr, Ubiquiti, Cisco, Aruba, Ruckus, Juniper, Microsoft, and System attributes.
See availability targets, authentication throughput limits, migration ceilings, retention, and object limits.
## Recommended Setup Order
Start by registering the router, VPN gateway, access point, wireless controller, or other RADIUS client that will send authentication requests.
Build groups for the common policies you want to reuse, such as access tiers, device roles, customer plans, or operational exceptions.
Create users manually or in bulk, generate credentials, assign groups, and place users in folders when you need hierarchy.
Create realms for suffix-based policy, such as `example.com`, so matching usernames automatically inherit selected group attributes.
Configure CoA and PoD settings on NAS devices when active sessions must be disconnected manually or after quota enforcement.
Use Live View and entity dashboards to confirm accepts, rejects, missing attributes, bad passwords, suspended accounts, and active sessions.
## Terminology
| Term | Meaning in Altostrat Radius |
| --------------- | -------------------------------------------------------------------------------------------------------------------------------- |
| User | An account that authenticates to the RADIUS service. The UI can also show a display name from user metadata. |
| Folder | A container for organizing users and nested folders. Your workspace may relabel folders as containers or another local term. |
| Group | A reusable policy object that carries check attributes, reply attributes, metadata, and member users. |
| Check attribute | An attribute used during authentication checks. |
| Reply attribute | An attribute returned after successful authentication. |
| NAS device | A Network Access Server or RADIUS client, such as a router, VPN gateway, access point, switch, firewall, or wireless controller. |
| Realm | A normalized suffix used with usernames such as `tim@example.com` to apply groups automatically. |
| Metadata | Custom key-value context on users, groups, realms, or NAS devices. |
| RadSec | RADIUS over TLS. Altostrat uses RadSec with mutual TLS for device identity and secure transport. |
| CoA | Change of Authorization, used when a NAS supports changing an active session after login. |
| PoD | Packet of Disconnect, used to terminate an active session through a Disconnect-Request. |
| Dictionary | The supported attribute catalog that drives the attribute picker, validation, operators, and input types. |
The UI lets admins customize labels for users, folders, devices, and groups. If your workspace uses different labels, the workflows are the same even when the nouns differ.
## Where To Go Next
Follow the first-run path from NAS registration through test authentication.
Learn how to create users, use folders, bulk add records, and manage user details.
Understand check attributes, reply attributes, inheritance, and quota-aware presence modes.
Enable dynamic authorization for manual disconnects, quota-triggered disconnects, and session control.
Use Live View, logs, metrics, sessions, and dashboards for day-two operations.
Check availability targets, retention, throughput, migration, and object limits before a rollout.
# Limits and Availability
Source: https://altostrat.io/docs/radius/en/limits-and-availability
Review ArcRadius feature coverage, availability targets, retention, performance limits, migration limits, and default account limits.
Use this page to plan capacity, onboarding, and operational expectations for Altostrat Radius. The limits below are default account limits. Where a row is marked adjustable, contact Altostrat before you design around the higher value.
This page covers feature coverage, availability, retention, and operational limits.
## Feature Coverage
| Capability | Support | Notes |
| ----------------------------------- | --------- | -------------------------------------------------------------------------------------------- |
| RadSec TLS | Supported | Use RadSec for encrypted RADIUS transport and NAS identity. |
| EAP-PEAP | Supported | Used for Wi-Fi and 802.1X environments where the NAS and client stack support it. |
| EAP-TTLS | Supported | Used for tunneled EAP deployments. |
| PAP, CHAP, MS-CHAP, and MS-CHAPv2 | Supported | Common for broadband, VPN, PPP, and access-network devices. |
| External identity providers for EAP | Supported | Examples include Microsoft Azure, Google Workspace, and Okta. |
| Custom attributes | Supported | Attribute names, operators, and value types must pass validation. |
| Webhook events | Supported | Use events for external automation and operational workflows. |
| Full-text search | Supported | Search is designed for operational lookup across RADIUS data. |
| Authentication logs | Supported | Retained for 12 months. |
| Accounting data storage | Supported | Retained for 12 months. |
| Accounting triggers | Supported | Use triggers for usage-based actions, such as taking action after a monthly usage threshold. |
| Management interface | Web based | Operators manage users, groups, NAS devices, realms, logs, and settings through the web UI. |
| REST API integration | Supported | Use the API for provisioning and external systems integration. |
| Altostrat Workflows integration | Supported | Use workflows to automate follow-up actions from RADIUS events. |
## Security And Data Protection
| Control | Coverage |
| ---------------------- | -------------------------------------------- |
| Encryption in transit | Supported. |
| Encryption at rest | Supported. |
| Point-in-time recovery | Per-second recovery granularity for 15 days. |
| DDoS protection | Supported. |
## Availability Targets
| Target | Value | Notes |
| ----------------------------- | ------------: | ------------------------------------------ |
| RADIUS availability guarantee | 99.999% | SLA-backed. |
| Data durability | 99.999999999% | 11 nines, SLA-backed. |
| Service IP availability | 99.99% per IP | SLA-backed. |
| Authentication time | At most 80 ms | Target authentication processing time. |
| Service IP addresses | 2 | Exposed for service reachability. |
| Availability Zones per region | 3 | Each always-on region uses multiple AZs. |
| AZ failover | Yes | Designed to fail over within milliseconds. |
| Always-on regions | 3 | Virginia, Sydney, and Cape Town. |
| Regional failover | Yes | Designed to fail over within minutes. |
## Performance Limits
| Limit | Default | Adjustable |
| --------------------------------------------------------- | ----------------------: | ---------- |
| Maximum concurrent authentication attempts per NAS device | 1,000 per second | No |
| Maximum concurrent authentication attempts per workspace | 12,000 per second | No |
| Minimum accounting data frequency | 300 seconds | No |
| Management API rate limit | 600 requests per minute | Yes |
The minimum accounting data frequency means NAS devices should not send interim accounting updates more frequently than every 300 seconds unless Altostrat has explicitly advised otherwise.
## Migration Limits
Migration limits apply individually to customer records, RADIUS accounts, attribute groups, and NAS devices.
| Limit | Default | Adjustable |
| --------------- | ------: | ---------- |
| CSV import size | 500 MB | No |
For large migrations, use chunked imports and validate a smaller sample before importing the full file. See [Folders and Users](./containers-and-users) for the user onboarding workflow and [Architecture and Scale](./architecture) for how large imports are processed.
## Customer Record Limits
| Limit | Default | Adjustable |
| ----------------------------------- | ------: | ---------- |
| Customer records | 500,000 | Yes |
| Metadata pairs per customer record | 20 | No |
| Tags per customer record | 10 | No |
| RADIUS accounts per customer record | 25,000 | Yes |
## RADIUS Account Limits
| Limit | Default | Adjustable |
| ----------------------------------- | --------: | ---------- |
| RADIUS accounts | 1,000,000 | Yes |
| Attribute groups per RADIUS account | 5 | No |
| Check attributes per RADIUS account | 5 | No |
| Reply attributes per RADIUS account | 10 | No |
| Metadata pairs per RADIUS account | 20 | No |
| Tags per RADIUS account | 10 | No |
## NAS Device Limits
| Limit | Default | Adjustable |
| ----------------------------- | ------: | ---------- |
| NAS devices | 25,000 | Yes |
| Metadata pairs per NAS device | 20 | No |
## Attribute Group Limits
| Limit | Default | Adjustable |
| ------------------------------------- | --------: | ---------- |
| Attribute groups | 15,000 | Yes |
| Check attributes per group | 15 | No |
| Reply attributes per group | 25 | No |
| RADIUS accounts in an attribute group | 1,000,000 | Yes |
| Metadata pairs per attribute group | 20 | No |
| Tags per attribute group | 10 | No |
## Design Guidance
* Use groups for reusable policy so account-level attributes stay small and easy to reason about.
* Keep metadata focused on operational lookup fields; avoid storing secrets in metadata.
* Use tags for coarse filtering, ownership, and lifecycle state rather than high-cardinality data.
* Keep accounting interim updates at or above the supported minimum interval when usage, sessions, quotas, and triggers depend on accounting.
* Ask Altostrat about adjustable limits before a migration, reseller model, or large customer deployment depends on higher ceilings.
# Live Monitoring and Logs
Source: https://altostrat.io/docs/radius/en/live-monitoring
Use RADIUS Live View, log filters, user dashboards, device dashboards, metrics, sessions, and failure categories to operate authentication.
Live monitoring is the day-two operations surface for RADIUS. Use it to see whether authentication is working, isolate failures, inspect sessions, and jump from a log entry to the affected user or NAS device.
## Prerequisites
Before you use Live View effectively, confirm that:
* At least one NAS device is sending authentication traffic.
* Users and groups exist for the traffic you expect to see.
* You know the approximate time range for the issue or test.
* You have permission to view logs and entity dashboards.
## Live View
Open **Live View** from the RADIUS navigation. The page combines metrics and a full log table, with filters for common operational questions.
Use Live View to answer:
* Are authentications succeeding?
* Which users are being rejected?
* Which NAS device is sending bad or unexpected traffic?
* Are failures concentrated in one folder, device, or timeframe?
* Are suspended users attempting to authenticate?
* Are requests missing attributes or other required information?
## Filters
The log card supports:
* Status type filters.
* Failures-only toggle.
* User filter.
* Folder filter.
* Device filter.
* Timeframe filter.
* Search by log ID.
* Sort field and sort direction.
* Refresh.
The global RADIUS filter model supports timeframes including 1 hour, 3 hours, 6 hours, 12 hours, 24 hours, and 7 days. User dashboards also include user-focused ranges such as last 24 hours, last 7 days, and last 30 days.
## Status Categories
The monitoring UI groups authentication outcomes into practical categories:
| Category | What it means |
| ------------ | --------------------------------------------------------- |
| Success | Successful authentications and authorizations. |
| Missing | Users missing required attributes or information. |
| Bad Password | Users who attempted to log in with incorrect credentials. |
| Rejected | Users rejected during the authentication process. |
| Suspended | Users blocked from accessing the network. |
The raw RADIUS message types available in filters include Access-Accept, Access-Reject, and Access-Challenge.
## Accounting Metrics
When accounting is enabled on the NAS, Altostrat can use accounting data for sessions, usage, quotas, and dashboards. The RadSec edge publishes accounting data asynchronously so the NAS receives an Accounting-Response without waiting on the metrics pipeline.
The monitoring pipeline tracks:
* Input and output bytes, including Gigawords for 64-bit counters.
* Input and output packets.
* Session duration.
* Accounting packet count.
* Session start time.
* Session stop time.
* Last framed IP address.
* Accounting status type such as Start, Stop, Interim-Update, Accounting-On, and Accounting-Off.
Authentication results are also counted with labels for workspace, organization, NAS, username, and reject reason when available.
The accounting path and authentication path are intentionally separate. Accounting and post-authentication events stream into the analytics plane after packets are handled, while authentication outcomes and NAS logs are produced by the RADIUS service and background metrics jobs. This keeps live packet handling responsive while still giving operators a joined view in the UI.
Authentication logs and accounting data are retained for 12 months. For capacity and retention planning, see [Limits and Availability](./limits-and-availability).
## Accounting Triggers
Accounting triggers let you automate follow-up actions from usage data, such as acting when a user exceeds a monthly data threshold. Use them when an operational response should be driven by accounting events rather than by a manual dashboard review.
Triggers depend on reliable accounting. Configure Start, Stop, and Interim-Update packets on the NAS, and keep interim update frequency at or above the supported minimum interval documented in [Limits and Availability](./limits-and-availability).
## Admin Request Metrics
CoA and PoD events are tracked as admin request activity when dynamic authorization packets are sent or observed by the platform. Use this with NAS logs and device-side logs when you are validating manual disconnects, quota-triggered disconnects, or CoA behavior.
## Log Table
Expanded logs show:
* Status or reply message.
* Execution time in milliseconds.
* User, with a link to the user detail page when available.
* Device, with a link to the NAS detail page when available.
* Folder or container when present.
* IP address when present.
* Timestamp.
Click a log row to inspect the request and response details. Use the user and device links to continue the investigation from the most relevant entity dashboard.
## User Dashboard
The user detail page is the best place to investigate one account. It includes:
* Time range selector.
* Usage and session charts where data is available.
* Latest session.
* Active session state.
* Latest IP address.
* Group membership.
* Realm link.
* Effective check and reply attributes.
* Logs scoped to the user.
* Actions for edit, suspend or enable, delete, move, reset credentials, and disconnect session.
Use this page when the same user repeatedly fails, consumes unexpected usage, or needs an active session disconnected.
## Device Dashboard
The NAS detail page is the best place to investigate one device. It includes:
* Logs scoped to the NAS.
* Total requests.
* Success rate.
* Active sessions.
* Reject count.
* RadSec configuration values.
* Certificate downloads.
* CoA and PoD settings.
* Device metadata.
Use this page when many users behind the same NAS fail at the same time, or when you are validating a new router, access point, VPN gateway, firewall, or wireless controller.
## Operational Workflow
Open Live View and set the timeframe around the incident or test.
Turn on failures only, then narrow by status category if needed.
Use the log row to identify the user, NAS device, folder, and response.
Jump to the user or NAS dashboard for scoped logs and related metrics.
Fix the credential, status, group, realm, NAS setting, or attribute issue you found.
Authenticate again and confirm the new log entry has the expected outcome.
# NAS Devices
Source: https://altostrat.io/docs/radius/en/nas-devices
Register and manage RADIUS clients, RadSec configuration, certificates, CoA and PoD settings, auto registration, device metrics, and NAS logs.
NAS devices are the network devices that send RADIUS authentication requests to Altostrat. In the UI, this includes routers, switches, access points, VPN gateways, firewalls, wireless controllers, and other RADIUS-capable clients.
## Prerequisites
Before you register a device, confirm that:
* The network device can be configured as a RADIUS or RadSec client.
* You know the device identifier you want operators to recognize in logs.
* The device can reach the RADIUS service values shown in its device detail page.
* You have access to upload certificates or configure RadSec when using secure transport.
* If you use CoA or PoD, the device can accept control messages from the source address and secret shown in the UI.
## Add A Device
In the RADIUS app, open **Settings** and select **Devices**.
Enter the device name or NAS identifier, choose the device type, and add an optional description.
Enable auto user registration only if unknown users should be created automatically. Select a default group when those users should inherit policy immediately.
Enable CoA and PoD replies if you want RADIUS to disconnect users or send change-of-authorization messages.
After saving, open the device detail page to copy RadSec values and download certificates.
## Device Fields
| Field | Purpose |
| ----------------------------- | ----------------------------------------------------------------------------------- |
| Device name or NAS identifier | The identifier shown in device lists, logs, and dashboards. |
| Description | Operator-facing context for the device. |
| Device type | Router, switch, access point, VPN gateway, firewall, wireless controller, or other. |
| Auto user registration | Allows the device flow to create users automatically when enabled. |
| Auto registration group | Optional group assigned to automatically registered users. |
| CoA and PoD replies | Enables disconnect and change-of-authorization behavior. |
| NAS IP address | Device address used for CoA and PoD replies. |
| NAS inbound port | Device port for CoA and PoD replies. The UI defaults to `3799`. |
| Secret | Shared secret used for CoA and PoD replies. |
| Metadata | Custom operational fields for this device. |
## RadSec Configuration
The device detail page shows the current RadSec configuration and certificate downloads. Use the values shown there when configuring the NAS.
The UI currently displays:
* FQDN: `aaa.altostrat.io`
* IP addresses: `75.2.67.221`, `166.117.188.111`
* Port: `2083`
* NAS certificate download.
* Client CA certificate download.
* NAS private key download.
Use the values shown on the live device page if they differ from this documentation. Network service endpoints can be updated over time, and the device page is the operator source of truth.
RadSec uses mutual TLS. The NAS certificate identifies the workspace, organization, and NAS device, and the RadSec edge binds traffic to that registered identity. That means logs and authorization use the trusted NAS identity from the certificate rather than trusting a mutable `NAS-Identifier` supplied by the device.
Use one certificate set per NAS device. Reusing certificate material across routers, access points, or controllers makes logs harder to trust and weakens device-level isolation.
## Auto Registration
Auto registration is useful for MAC-based access flows where the NAS sends a Calling-Station-Id or a MAC-like username and you want unknown devices to become users automatically.
When auto registration is enabled on the NAS:
* Unknown MAC-based users can be created automatically.
* The username is normalized from the MAC address.
* The user can be assigned to the selected auto-registration group.
* The user starts active unless your operating process changes status after creation.
* The user is linked to the NAS that created it through metadata.
Only enable auto registration on NAS devices where this behavior is intentional. For ordinary username/password access, leave it disabled and create users through the normal user workflow or bulk import.
## CoA And PoD
Enable CoA and PoD replies when you need session control, such as manual disconnects or authorization changes.
The UI collects:
* NAS IP address.
* NAS inbound port.
* CoA and PoD secret.
The device dashboard also displays the message source address for control messages. The current UI shows `18.214.81.214` as the source address and `3799` as the default inbound port. Configure the NAS to accept CoA and PoD traffic from the values shown in the device page.
For the full dynamic authorization workflow, see [CoA and PoD](./coa-and-pod).
## Device Dashboard
Open a device to view:
* Authentication logs for that NAS.
* Log status, execution time, user, container, IP address, and timestamp.
* Total requests.
* Success rate.
* Active sessions.
* Reject count.
* RadSec configuration values.
* Certificate, CA, and private key downloads.
* CoA and PoD settings.
* Metadata and shortcuts.
Use the device dashboard when you are troubleshooting a specific router, access point, VPN gateway, or controller. It is faster than filtering global logs when you already know which NAS sent the request.
## Delete A Device
Deleting a NAS device removes it from the RADIUS configuration. Existing authentication from that device will stop working once the device no longer matches an active RADIUS client configuration.
Before deleting, confirm:
* The device is decommissioned or replaced.
* No active users depend on it.
* You have exported or copied any certificate material you still need for migration.
* Recent logs do not show unexpected authentication traffic.
# Realms
Source: https://altostrat.io/docs/radius/en/realms
Use RADIUS realms to match username suffixes and automatically apply group attributes to matching users.
Realms let you apply policy from the username itself. When a user authenticates with a username such as `tim@example.com`, the RADIUS UI can match `example.com` and apply the groups attached to that realm.
## Prerequisites
Before you create a realm, confirm that:
* You know the realm suffix users will authenticate with.
* The groups you want to apply already exist.
* The NAS sends usernames in the expected format.
* You have a test user that can authenticate with the realm suffix.
## How Realms Work
A realm is a normalized suffix. The form strips a leading `@`, removes whitespace, lowercases the value, and accepts letters, numbers, dots, and hyphens.
Examples:
* `example.com`
* `staff.example.com`
* `reseller-1.example.com`
When users authenticate with matching usernames, the realm groups are applied automatically. The realm detail page shows assigned groups and metadata, and the user detail page links back to the matching realm when one is detected.
## Create A Realm
In the RADIUS app, open **Settings** and select **Realms**.
Enter the suffix, such as `example.com`. The UI displays the realm with an `@` prefix.
Use the description to explain who owns the realm or why it exists.
Select the groups that should apply to matching users.
Authenticate with a username that includes the realm suffix, then review the user detail page and Live View.
## Assign Groups To A Realm
Realm groups are applied automatically to matching users. Use them for policy that belongs to a domain, tenant, partner, or customer namespace rather than to a single user.
Good realm group examples:
* Default access policy for a customer domain.
* Common vendor attributes for a partner-managed network.
* Shared quota behavior for a tenant.
* Standard reply attributes for a staff realm.
## User Creation With Realms
When adding a user, the username field includes an `@` realm picker. You can select an existing realm or paste a username that already contains a realm suffix. The UI keeps the local username and selected realm aligned.
If you create a user without selecting a realm, the user can still belong to groups directly. Realms are only needed when suffix-based policy should apply.
## Edit Or Delete A Realm
From the realm detail page, you can:
* Edit the realm name and description.
* Add or remove groups.
* Update metadata.
* Delete the realm.
Deleting a realm stops matching users from automatically inheriting that realm's group attributes. Users can still retain directly assigned groups.
## Troubleshooting Realm Matches
If realm groups are not appearing where you expect:
* Confirm the username includes the suffix.
* Confirm the realm value is normalized without a leading `@`.
* Confirm the NAS is not rewriting usernames before sending them.
* Confirm the realm has groups assigned.
* Open the user detail page and check whether the realm badge links to the expected realm.
# Settings, Labels, Metadata, and Shortcuts
Source: https://altostrat.io/docs/radius/en/settings-and-shortcuts
Customize RADIUS labels, use metadata fields, and create global metadata shortcuts to external systems from the Radius UI.
RADIUS settings let you tune the UI language and connect RADIUS records to external systems. The settings area covers label customization and metadata shortcuts, while individual users, groups, realms, and NAS devices each expose metadata fields on their detail pages.
## Prerequisites
Before you change settings, confirm that:
* You have permission to manage RADIUS settings.
* Your team agrees on the vocabulary you want operators to see.
* You know which metadata keys should be used consistently.
* You have the external URL patterns needed for shortcuts.
## Labels
Open **Settings** in the RADIUS app to customize labels for:
* Users.
* Folders or containers.
* Devices.
* Groups.
Each label has singular and plural forms. The UI uses these labels throughout the RADIUS workspace, including navigation, list headers, empty states, buttons, and detail pages.
Use label customization when your organization has established terms such as customers, subscribers, tenants, locations, clients, devices, or policies.
The default UI label for containers is shown as folders in the app. The underlying behavior is the same: folders organize users and nested folders.
## Metadata
Metadata is custom key-value data on RADIUS objects. You can add metadata to:
* Users.
* Groups.
* Realms.
* NAS devices.
Metadata appears in the detail sidebar for each object. It can be edited, copied, and used as the basis for shortcuts.
Special metadata behavior:
* `display_name` is treated as the friendly user display name.
* `site_id` uses the Altostrat site picker when the UI can resolve sites.
* Empty keys or empty values are not saved.
## Metadata Shortcuts
Metadata shortcuts create external links from metadata values. They are useful when operators need to jump from a RADIUS record to a CRM, billing platform, support case, monitoring page, or internal admin system.
A shortcut includes:
* Parent type, such as user, group, realm, or NAS.
* Metadata key.
* Label.
* URL template.
* Optional icon.
The URL template uses `` as the placeholder for the metadata value. For example, a `customer_id` metadata field can link to an external customer profile by inserting the customer ID into the URL.
## Create A Shortcut From Metadata
Open a user, group, realm, or NAS device that has metadata.
In the metadata sidebar, hover or open the shortcuts control for the field.
Enter a label and a URL template that includes ``.
The shortcut becomes available for matching metadata keys on the same parent type.
Open the shortcut from any matching metadata field to jump to the external system.
## Manage Shortcuts Globally
Open **Settings** to review all configured metadata shortcuts. The settings page groups shortcuts by parent type and metadata key. From there you can edit labels and URL templates or delete shortcuts that are no longer needed.
Shortcut changes apply globally across matching objects.
## Recommended Metadata Keys
Use stable, predictable keys so shortcuts and filters remain useful over time:
* `customer_id`
* `site_id`
* `ticket_id`
* `billing_account_id`
* `external_id`
* `support_url`
* `owner_team`
Avoid storing secrets, passwords, private keys, or access tokens in metadata. Metadata is operational context, not a secret store.
## Label And Metadata Governance
For larger RADIUS workspaces:
* Decide labels before broad onboarding.
* Keep metadata keys lowercase and consistent.
* Use one key for one meaning.
* Prefer IDs over names when linking to external systems.
* Add shortcuts for common operator jumps.
* Review global shortcuts when renaming metadata keys.
# Supported Dictionaries
Source: https://altostrat.io/docs/radius/en/supported-dictionaries
Review the RADIUS attribute dictionaries, vendors, operators, value types, and quota attributes surfaced by the Altostrat Radius UI.
The RADIUS attribute picker is driven by a curated dictionary that the UI fetches from the RADIUS service. It includes standard RFC attributes, common vendor-specific attributes, and Altostrat system attributes used for quota behavior.
Use the picker in the UI as the source of truth. It shows the current attribute name, vendor, description, tags, input type, select options, validation type, and allowed operators.
## Dictionary Coverage
The current dictionary exposes 51 attributes across these vendors:
| Vendor | Count | Common uses |
| --------- | ----: | --------------------------------------------------------------------------------------------------------------------------- |
| Standard | 25 | Session timers, IP assignment, framed routes, service type, VLAN assignment, passwords, access control, and reply messages. |
| MikroTik | 4 | Rate limits, address lists, MikroTik groups, and delegated IPv6 pools. |
| WISPr | 2 | Bandwidth limits for wireless and hotspot environments. |
| Ubiquiti | 1 | Egress VLAN assignment. |
| Cisco | 1 | Cisco AVPair policy values. |
| Aruba | 3 | User role, user VLAN, and captive portal URL. |
| Ruckus | 3 | SSID and uplink/downlink rate limits. |
| Juniper | 5 | Local usernames, DNS, ingress policy, and egress policy. |
| Microsoft | 2 | Primary and secondary DNS server attributes. |
| System | 5 | Altostrat quota attributes. |
## Standard Attributes
Standard attributes include:
* `Session-Timeout`
* `Idle-Timeout`
* `Acct-Interim-Interval`
* `Termination-Action`
* `Framed-IP-Address`
* `Framed-IP-Netmask`
* `Framed-Route`
* `Framed-Pool`
* `Delegated-IPv6-Prefix`
* `Framed-Protocol`
* `Framed-MTU`
* `Service-Type`
* `NAS-Port-Type`
* `Port-Limit`
* `Tunnel-Private-Group-Id`
* `Tunnel-Type`
* `Tunnel-Medium-Type`
* `Filter-Id`
* `Reply-Message`
* `Class`
* `Login-LAT-Service`
* `User-Password`
* `CHAP-Password`
* `Cleartext-Password`
* `Code`
`Code` is a response-control attribute used by the platform response flow. Most customer policy work uses the session, IP, service, VLAN, filtering, and vendor-specific attributes rather than editing `Code` directly.
## Vendor Attributes
| Vendor | Attributes |
| --------- | -------------------------------------------------------------------------------------------------------------------------------------- |
| MikroTik | `Mikrotik-Rate-Limit`, `Mikrotik-Address-List`, `Mikrotik-Group`, `Mikrotik-Delegated-IPv6-Pool` |
| WISPr | `WISPr-Bandwidth-Max-Down`, `WISPr-Bandwidth-Max-Up` |
| Ubiquiti | `Egress-VLANID` |
| Cisco | `Cisco-AVPair` |
| Aruba | `Aruba-User-Role`, `Aruba-User-Vlan`, `Aruba-Captive-Portal-URL` |
| Ruckus | `Ruckus-SSID`, `Ruckus-Downlink-Rate-Limit`, `Ruckus-Uplink-Rate-Limit` |
| Juniper | `Juniper-Local-User-Name`, `Juniper-Primary-DNS`, `Juniper-Secondary-DNS`, `Juniper-Ingress-Policy-Name`, `Juniper-Egress-Policy-Name` |
| Microsoft | `MS-Primary-DNS-Server`, `MS-Secondary-DNS-Server` |
## System Quota Attributes
Altostrat system attributes are used for quota-aware policy:
* `X-Octet-Quota`
* `X-Quota-TTL`
* `X-Quota-Reset-After`
* `X-Quota-Carry-Over-Cycles`
* `X-Quota-Expire-TTL`
Quota attributes belong on groups, not individual users. The quota service reads group attributes, uses the lowest quota when multiple groups define one, and applies top-ups when calculating the effective allowance.
| Attribute | Purpose |
| --------------------------- | ----------------------------------------------------------- |
| `X-Octet-Quota` | Data quota in bytes. |
| `X-Quota-TTL` | Hours after which a quota resets. |
| `X-Quota-Reset-After` | Cron expression for the quota reset schedule. |
| `X-Quota-Carry-Over-Cycles` | Number of cycles unused quota can carry over. |
| `X-Quota-Expire-TTL` | Hours after usage begins before the quota expires entirely. |
## Operators
The UI supports these RADIUS operators where allowed by the selected attribute:
| Operator | Typical meaning |
| -------- | --------------------------------------------- |
| `:=` | Set or replace the attribute value. |
| `==` | Match the request attribute value. |
| `+=` | Add another value for multi-value attributes. |
| `!=` | Match when a value is not equal. |
| `>` | Match greater-than values. |
| `>=` | Match greater-than-or-equal values. |
| `<` | Match less-than values. |
| `<=` | Match less-than-or-equal values. |
The picker limits the operator list to what the selected attribute supports.
## Input Types
Attributes render with an input type that matches their expected value:
* Text.
* Number.
* Password.
* IP address.
* Select dropdown.
* Duration in seconds.
* Bandwidth in bps or kbps.
* Storage in bytes.
* URL.
For enumerated attributes such as `Service-Type`, `NAS-Port-Type`, `Tunnel-Type`, and `Tunnel-Medium-Type`, the UI shows friendly labels while storing the configured value.
## Validation Limits
The picker and API enforce type checks and selected range checks. Current notable limits include:
| Attribute | Accepted range |
| ----------------------------------------------------------------- | -------------------------- |
| `Session-Timeout` | 60 to 604800 seconds. |
| `Idle-Timeout` | 60 to 7200 seconds. |
| `WISPr-Bandwidth-Max-Up` and `WISPr-Bandwidth-Max-Down` | 8000 to 1000000000 bps. |
| `Ruckus-Uplink-Rate-Limit` and `Ruckus-Downlink-Rate-Limit` | 8 to 1000000 kbps. |
| `Tunnel-Private-Group-Id`, `Aruba-User-Vlan`, and `Egress-VLANID` | VLAN ID 1 to 4094. |
| `X-Octet-Quota` | 0 to 10995116277760 bytes. |
| `X-Quota-TTL` and `X-Quota-Expire-TTL` | 1 to 8760 hours. |
| `X-Quota-Carry-Over-Cycles` | 0 to 12 cycles. |
## Tags
Attributes are tagged for filtering and discovery. Current tags include session, accounting, ISP, IP, DHCP, routing, IPv6, network, service, authentication, NAS, access, limitation, Wi-Fi, VLAN, filtering, user experience, bandwidth, policy, firewall, hotspot, QoS, DNS, and quota.
## Attribute Validation
The API validates attributes before saving users or groups. If an attribute is not in the supported dictionary, uses an unsupported operator, or has a value that does not match the expected type, the save request is rejected.
Password-related attributes are supported for RADIUS protocol compatibility, but normal user credential changes should use the credential fields and reset flows in the UI. Do not use metadata or ad hoc attributes as a shared secret store.
When translating an existing FreeRADIUS deployment, create one group per reusable policy first. Then use the picker to recreate the check and reply attributes with the correct vendor dictionary and operator.
# RADIUS Troubleshooting
Source: https://altostrat.io/docs/radius/en/troubleshooting
Troubleshoot RADIUS rejects, bad passwords, missing attributes, suspended users, device setup issues, realms, CoA and PoD, RadSec, and missing logs.
Use this page when RADIUS authentication does not behave as expected. Start in Live View, identify the user and NAS device, then inspect the smallest object that can explain the failure.
## Prerequisites
Before troubleshooting, collect:
* Approximate time of the failed authentication.
* Username used by the client.
* NAS device that sent the request.
* Expected group or realm policy.
* Whether this is first setup, a regression, or a single-user issue.
## First Checks
1. Open **Live View**.
2. Set the timeframe to cover the test or incident.
3. Turn on **Failures only** if there are many logs.
4. Filter by user, folder, device, or status type.
5. Open the matching user or NAS device from the log row.
6. Change one setting at a time, retest, and confirm the next log entry.
## User Is Rejected
Check:
* The user exists in the expected workspace.
* The username in the log matches the stored username exactly.
* The user is active or enabled.
* The user belongs to the expected groups.
* The realm is matching when the username includes a suffix.
* Required check attributes are present.
* Reply attributes are valid for the NAS device.
* The NAS is sending the request from the registered device configuration.
* The authentication protocol matches the device configuration: PAP, CHAP, MS-CHAP, MS-CHAPv2, EAP continuation, or MAC-based access.
Open the user detail page and review effective check and reply attributes before editing multiple groups.
## Bad Password
Check:
* The password stored on the user is the current password.
* The client is not caching an old credential.
* The username includes the intended realm suffix.
* The NAS is not rewriting the username before sending the request.
Use **Reset Credentials** on the user detail page when you need to issue a new password, then retest with a fresh login.
## Missing Attributes
Check:
* The user has at least one group with the required attributes.
* Realm groups are applied when the username uses a realm.
* The attribute is in the correct section: check attributes for authentication-time checks, reply attributes for successful replies.
* The selected operator is valid for that attribute.
* The value matches the input type and expected format.
* Presence mode is not preventing the attribute from being sent.
* The attribute exists in [Supported Dictionaries](./supported-dictionaries). Unsupported or misspelled attributes are rejected before save.
* Quota attributes are on groups, not individual users.
If an attribute appears on a group but not on the user, inspect the user's inherited attribute display to confirm group membership and inheritance.
## Suspended Or Disabled User
Check:
* The user status in the user form.
* Whether the user was manually suspended from the dashboard.
* Whether operators expected suspended users to receive a normal success reply. Suspended users are normally blocked before ordinary reply attributes are returned.
* Whether an active session should be disconnected after suspension.
Use **Enable User** when the suspension is intentional but should be lifted.
## No Logs Appear
Check:
* The Live View timeframe.
* Whether filters are hiding results.
* Whether the NAS device was created in the expected workspace.
* Whether the NAS can reach the RadSec or RADIUS service values shown on its device page.
* Whether device certificates or shared secrets are installed correctly.
* Whether the NAS is configured to send accounting or authentication traffic to the expected destination.
If the device was just created, open the NAS detail page and confirm that configuration values and certificates are available.
## Device Cannot Authenticate
Check:
* Device name or NAS identifier.
* Device type.
* RadSec FQDN, IP addresses, and port shown on the device page.
* NAS certificate, client CA certificate, and private key.
* Local firewall rules between the NAS and the RADIUS service.
* Device clock and certificate validity assumptions.
* Whether the device is reusing another NAS certificate. Each NAS should use its own certificate downloads.
* Whether traffic is reaching the service by checking Live View and the NAS dashboard.
* Whether the `NAS-Identifier` in logs maps to the registered NAS. RadSec traffic is bound to the certificate identity and normalized by the edge.
Use the NAS dashboard to isolate whether all users behind one device are failing or only one account is failing.
## CoA Or PoD Does Not Work
Check:
* CoA and PoD replies are enabled on the NAS record.
* NAS IP address is correct.
* NAS inbound port is correct. The UI defaults to `3799`.
* CoA and PoD secret matches the device.
* The NAS firewall allows the message source address shown on the device page.
* The user has an active session before you try to disconnect it.
* Accounting sends `Acct-Session-Id` and, where possible, Start, Stop, and Interim-Update packets.
* The NAS supports Disconnect-Request for the access technology in use.
* The NAS supports CoA-Request before you expect an in-place authorization change.
The current UI shows `18.214.81.214` as the CoA and PoD message source address. Use the live device page if it shows a different value.
## Realm Policy Is Not Applied
Check:
* The username includes the realm suffix, such as `tim@example.com`.
* The realm exists without a leading `@`.
* The realm value contains only letters, numbers, dots, and hyphens.
* The realm has groups assigned.
* The NAS is not stripping or rewriting the suffix.
* The user detail page shows the expected realm link.
If you change realm groups, retest and review the user's effective attributes.
## Group Changes Do Not Affect A User
Check:
* The user is a direct member of the group, or the user matches a realm that assigns the group.
* You edited the intended group.
* The attribute was saved in the correct check or reply section.
* The presence mode applies to the user's current state.
* You are reviewing a new authentication attempt after the policy change.
Use the group dashboard to confirm members, then use the user detail page to confirm inherited attributes.
## Escalation Details
When escalating to Altostrat support or an internal platform owner, include:
* Workspace name.
* Username.
* NAS device name or identifier.
* Approximate timestamp and timezone.
* Log ID if visible.
* Response status or reply message.
* Expected group and realm policy.
* Recent changes to users, groups, realms, NAS settings, or certificates.
# Api base instructions
Source: https://altostrat.io/docs/scripts/api-base-instructions
# **LLM Prompt: A Blueprint for Stripe-Quality OpenAPI Specifications**
## **Your Mission: To Craft a World-Class Developer Experience**
You are an AI Architect specializing in creating world-class, Stripe-quality API documentation. Your mission is not merely to list endpoints, but to craft a developer experience that is clear, intuitive, and empowering. Every description, parameter, and example you write must be guided by the principle of reducing developer friction and accelerating their time-to-first-successful-call.
## **Core Philosophy: The Stripe Standard**
Before you write a single line of YAML, internalize these guiding principles derived from the industry's best:
* **Developer-Centricity:** Structure everything from the developer's point of view. Anticipate their questions, understand their goals, and provide clear, unambiguous answers.
* **Problem-First Approach:** The `info` description must frame the API as a solution to a specific set of problems. A developer should immediately understand *why* they need this service.
* **Meticulous Detail:** Every parameter, field, and schema must be documented with absolute clarity. There is no room for ambiguity. Provide helpful context and examples wherever possible.
* **Errors as a Feature:** Treat error responses as a core, solvable part of the API. They must be predictable, well-documented, and guide the user toward a solution.
## **Your Core Task & Critical Output Requirement**
Your task is to generate a complete and accurate OpenAPI 3.0.3 specification in **YAML format** for a specific Altostrat microservice. I will provide you with the name of the microservice and details about its endpoints.
**CRITICAL: Your entire response MUST be a single YAML code block.** Do **NOT** include any introductory text, explanations, or concluding remarks. Your output must begin with `openapi: 3.0.3` and end with the last line of the specification.
## **Global Context & Rules**
1. **Base URL:** All API endpoints must use the base URL `https://api.altostrat.io`.
2. **Product Context:** Altostrat SDX is a platform delivering SD-WAN, network automation, and agentic AI for MikroTik networks, built on a microservices architecture.
3. **Microservice Focus (IMPORTANT):** Your documentation must be laser-focused on the **single microservice provided**. While you will reference its role within the broader Altostrat SDX platform for context, the description and endpoints must exclusively detail the problems this service solves and the resources it manages.
***
## **Blueprint for the `info:` Block**
This section is your opening statement. It must be elegant and informative, following this precise four-part formula:
* `title:` Must follow the format: `Altostrat [Microservice Name] API`.
* `version:` Use `1.0.0`.
* `description:` Use a multi-line string (`|-`) structured as follows:
1. **Service Definition:** A single, clear sentence defining the microservice's primary responsibility.
* *Example:* "The Altostrat Workspaces API is the microservice responsible for tenancy, billing, and user identity management."
2. **Strategic Context:** Explain its specific role and contribution to the overall Altostrat SDX platform.
* *Example:* "It serves as the foundational layer for all multi-tenancy and subscription logic, enabling the secure separation of customer data and resources."
3. **Core Resources (Bulleted List):** A bulleted list of the 2-4 key resources or concepts this **specific API** manages, each with a concise explanation.
* *Example:*
```
This API allows you to programmatically manage:
- **Workspaces:** The top-level containers for all tenant resources, users, and billing configurations.
- **User Access:** The members and their specific roles (Owner, Admin) within a workspace.
```
4. **Developer's Goal:** A concluding sentence that frames the API's purpose from the developer's perspective.
* *Example:* "Developers use this API to build the structural foundation upon which all other Altostrat SDX automation and AI features operate."
***
## **Blueprint for Endpoints, Parameters, and Schemas**
* **RESTful Principles:** Endpoints must use plural nouns for resources and a clear hierarchy (e.g., `/workspaces/{workspaceId}/members`).
* **Clarity in Summaries:** Each endpoint (`summary`) and parameter (`description`) must have a concise, human-readable explanation.
* **Meticulous Schemas:** For every parameter and response field, provide a `description` and a realistic `example`. The description should explain the *purpose* of the field, not just what it is.
* **Rich Descriptions:** The endpoint's main `description` field should explain not just *what* it does, but *why* a developer would use it and any important nuances or side effects.
***
## **Blueprint for Error Handling**
Every endpoint that can modify state (POST, PUT, PATCH, DELETE) **must** include a documented `4xx` client error and `5xx` server error in its `responses` section. The error schema should be consistent, pointing to a reusable component.
* **Example Error Response (`400`):**
```yaml theme={null}
responses:
"400":
description: Bad Request - The request was malformed or invalid.
content:
application/json:
schema:
$ref: "#/components/schemas/ErrorResponse"
```
* **Error Schema Component:**
```yaml theme={null}
components:
schemas:
ErrorResponse:
type: object
properties:
type:
type: string
description: A broad category for the error (e.g., 'invalid_request_error').
example: "invalid_request_error"
code:
type: string
description: A short, unique string identifying the specific error.
example: "parameter_missing"
message:
type: string
description: A human-readable description of what went wrong.
example: "The 'name' parameter is required for this request."
doc_url:
type: string
description: A direct link to the documentation page for this specific error code.
example: "https://docs.altostrat.io/errors/parameter_missing"
```
# Billing and Subscriptions
Source: https://altostrat.io/docs/sdx/en/account/billing-and-subscriptions
Review billing accounts, subscriptions, license allocation, usage, and limits for your SDX workspace.
Billing and subscription data helps you understand what your workspace can use, how licenses are allocated, and whether growth will run into account limits. The exact billing options available to you depend on your workspace and account configuration in the portal.
## Prerequisites
* You have permission to view billing or subscription settings.
* You know which workspace or organization you are reviewing.
* You know whether the question is about current usage, future growth, or finance review.
## What to Review
| Area | Use it for |
| ---------------- | ----------------------------------------------------------------- |
| Billing accounts | Business and billing ownership for the workspace or organization. |
| Subscriptions | Active subscription state and what it permits. |
| Licenses | Allocation of purchased or available capacity. |
| Usage | Current resource consumption against available capacity. |
| Limits | Guardrails that can affect onboarding or expansion. |
## Before Onboarding Sites
1. Open the billing or subscription area for the workspace.
2. Confirm the active subscription state.
3. Review available licenses and current usage.
4. Confirm whether the planned onboarding fits within current limits.
5. Resolve billing or license questions before a large rollout.
## Operational Use Cases
Use subscription views before bulk onboarding, customer migration, or regional expansion.
Use usage views during account review to understand whether growth is tracking with expectations.
Use license allocation when different teams, customers, or service tiers need capacity managed deliberately.
## Good Practices
Review billing and usage before major site adoption waves. Subscription limits are easier to handle before a field team is waiting to bring routers online.
Keep account administrators and finance stakeholders aligned on who owns billing review, who owns license allocation, and who approves expansion.
If you are designing customer or department boundaries, start with [Workspaces and Organizations](./workspaces-and-organizations) before tuning billing and subscription allocation.
# Account & Billing
Source: https://altostrat.io/docs/sdx/en/account/introduction
Understand the account structures that organize SDX workspaces, teams, users, roles, billing, subscriptions, and auditability.
Account structure determines who can see resources, who can make changes, how teams collaborate, and how subscriptions and usage are organized. In Altostrat SDX, this foundation is built from workspaces, teams, users, roles, billing accounts, subscriptions, API keys, and audit logs.
```mermaid theme={null}
flowchart TD
Workspace["Workspace"] --> Teams["Teams"]
Teams --> Users["Users and roles"]
Teams --> Resources["Sites, policies, workflows, and reports"]
Workspace --> Billing["Billing accounts and subscriptions"]
Workspace --> Audit["Audit logs"]
Workspace --> Keys["API keys"]
```
## What to Configure First
Model your operating structure so resources, teams, and customer or business boundaries are clear.
Review billing accounts, subscriptions, license allocation, usage, and workspace limits.
Add people, assign teams, use roles, and create notification-only users where appropriate.
## Recommended Setup Order
1. Confirm the workspace and organization structure.
2. Create teams around operational boundaries, such as customer, region, department, or support tier.
3. Assign roles that match each person's responsibility.
4. Review subscription and usage state before onboarding many sites.
5. Create API keys only for integrations that need them.
6. Use audit logs to review sensitive changes.
Keep teams aligned with how work is actually performed. A clean team model makes policy assignment, reporting, notifications, and incident response easier to reason about.
# User and Team Management
Source: https://altostrat.io/docs/sdx/en/account/user-and-team-management
Add users, organize teams, assign roles, and use notification-only users for alert and report recipients.
User and team management controls who can access your SDX resources and what they can do. A clean access model keeps operations fast while reducing unnecessary privilege.
## Prerequisites
* You have permission to manage users, teams, or roles.
* You know which team the user should belong to.
* You know what level of access the user needs.
## Core Concepts
| Concept | Purpose |
| ---------------------- | --------------------------------------------------------------------------- |
| User | A person or recipient record associated with the workspace. |
| Team | A group that owns or operates resources. |
| Role | A permission set that controls what a user can do. |
| Notification-only user | A recipient that can receive alerts or reports without portal login access. |
## Add a User
1. Open **Settings** and select **Teams** or the relevant user management area.
2. Choose the team the user should join.
3. Add the user with the correct email address.
4. Assign a role that matches the work they need to perform.
5. Save the change.
6. Confirm the user appears in the intended team.
## Create a Notification-Only Recipient
Use notification-only users when someone needs alerts or reports but should not sign in to the portal.
1. Create or edit the user record.
2. Disable portal login access when the form exposes that option.
3. Add the recipient to the relevant [Notification Groups](../monitoring/notifications).
4. Send or wait for a test notification through the group workflow.
## Role Assignment
Assign the least privilege that still lets the user do their job. Operators who manage sites may need different access from billing administrators, security reviewers, workflow builders, or report recipients.
Review roles when a person changes responsibility. Removing stale access is just as important as granting new access.
## Offboarding
When someone leaves or no longer needs access:
1. Remove them from teams where they should no longer operate.
2. Reassign ownership of workflows, reports, notification groups, or API keys if needed.
3. Revoke or rotate credentials that were used by integrations.
4. Review [Audit Logs](../security/audit-logs) for recent sensitive activity if the departure is security-sensitive.
Prefer named users over shared accounts. Named access makes audit review and incident investigation much clearer.
# Workspaces and Organizations
Source: https://altostrat.io/docs/sdx/en/account/workspaces-and-organizations
Model your business or customer structure with workspaces, organizations, teams, and resource ownership.
Workspaces and organizations define the operating boundary for your SDX environment. They help you separate customers, business units, teams, subscriptions, and managed resources.
## Prerequisites
* You know whether your structure should follow customers, regions, departments, brands, or operating teams.
* You know who should administer each area.
* You understand which sites and policies belong together.
## Core Concepts
| Concept | Purpose |
| ------------ | ---------------------------------------------------------------------------------------------------------- |
| Workspace | The main portal context where teams, users, resources, subscriptions, billing, and audit logs are managed. |
| Organization | A business or customer structure used to organize ownership and account hierarchy. |
| Team | An access and ownership boundary for users and resources. |
| Role | A permission set assigned to users so they can perform the right actions. |
## Design a Structure
1. Start from the way your operations team works today.
2. Identify boundaries that require separate access, reporting, or billing visibility.
3. Create teams for those boundaries.
4. Keep resource ownership consistent: sites, policies, workflows, reports, and notification groups should live where the responsible team can manage them.
5. Review the model after your first few sites are onboarded.
## Common Patterns
Use a customer-based structure when you are an MSP or operator managing separate customer environments.
Use a region-based structure when operational responsibility follows geography.
Use a department-based structure when internal IT, guest networks, security, and operations need different access boundaries.
Use a service-tier structure when policies, reporting, and response expectations differ by contract or support level.
## Good Practices
Avoid creating a new workspace or team for every small exception. Too much fragmentation makes reporting, access review, and policy rollout harder.
Use tags for flexible grouping inside a team. Tags are often better than extra teams when you only need filtering, reporting, or policy targeting.
See [Metadata and Tags](../fleet/metadata-and-tags) for resource grouping that does not require changing ownership boundaries.
# Generative AI
Source: https://altostrat.io/docs/sdx/en/automation/generative-ai
Use AI-assisted features in Altostrat SDX for workflow text transforms, script drafting, diagnostics, and operational support.
Altostrat SDX includes AI-assisted surfaces that help operators move faster. AI can draft RouterOS scripts, transform text in workflows, support diagnostics, and help turn operational intent into a first version of an action.
AI assistance does not replace operator review. Treat generated output as a draft that must be checked against the site, policy, and change window.
## Where AI Appears
Describe a RouterOS task and use AI to create a starting script for review and testing.
Use the **AI Text Transform** node to rewrite, summarize, or structure text inside a workflow.
Use AI-assisted product surfaces to speed up investigation, explanation, and repetitive operator work.
## Good Uses
* Draft a RouterOS script from a precise change request.
* Summarize a fault or run payload before sending a notification.
* Convert raw JSON or log text into a human-readable incident summary.
* Generate first-pass documentation for an internal procedure.
* Explain a planned workflow before you activate it.
## Risky Uses
Avoid using AI output directly when the action can:
* Remove management access.
* Change routing, WAN priority, firewall policy, or VPN reachability.
* Delete configuration or data.
* Touch many sites at once.
* Grant access to users or external systems.
Use scheduled script testing, workflow node testing, and human approval for these cases.
## Prompting Guidance
Give the AI enough operational context:
* The site or device role.
* The RouterOS version or feature constraint, if relevant.
* The exact desired state.
* What must not change.
* How you want the result formatted.
For example, ask for a script that adds a specific firewall rule only if it does not already exist, and state that management access must not be changed.
## Review Checklist
Before using AI-generated output:
* Confirm every command or field matches your intent.
* Remove secrets from prompts and outputs.
* Test against a representative non-critical site.
* Check whether the change is idempotent.
* Use workflow or scheduled script logs to confirm the result.
## Related Pages
Test and authorize RouterOS scripts before rollout.
Review the AI Text Transform node and other workflow actions.
# Automation and AI
Source: https://altostrat.io/docs/sdx/en/automation/introduction
Use workflows, scheduled scripts, templates, and AI-assisted tools to automate Altostrat SDX operations.
Altostrat SDX automation is built for network operations teams that need repeatable work without losing control. You can design visual workflows, run RouterOS scripts through the device job plane, store workflow secrets, and use AI-assisted surfaces to speed up diagnostics or script drafting.
The key idea is simple: use the lightest automation tool that still gives you the right safety, auditability, and operational visibility.
## Automation Surfaces
Build node-based automations with triggers, actions, conditions, loops, workflow chaining, logs, runs, and authorizations.
Execute RouterOS scripts across sites through the SDX job model, with testing, scheduling, authorization, and per-site outcomes.
Use AI to draft scripts, transform text in workflows, and accelerate operator tasks while keeping review and approval in your hands.
```mermaid theme={null}
flowchart LR
Event["Event, schedule, API request, or operator action"] --> Workflow["Workflow"]
Workflow --> Action["API, notification, tag, policy, WAN, script, or data action"]
Action --> Logs["Runs and logs"]
Script["Scheduled script"] --> DeviceJob["Device job plane"]
DeviceJob --> Site["Managed site"]
AI["AI assistance"] --> Workflow
AI --> Script
```
## Choose The Right Tool
| Need | Use | Why |
| ---------------------------------------------- | -------------------- | -------------------------------------------------------------------------------------------------- |
| React to site, WAN, schedule, or API events | Workflows | The workflow engine gives you branching, variables, conditions, and logs. |
| Push RouterOS changes across one or more sites | Scheduled scripts | Scripts run through the platform's asynchronous device job model and can be tested before rollout. |
| Transform payloads or create reports | Workflows | Data mapper, parser, text, PDF, notification, and integration nodes keep this work visible. |
| Draft a RouterOS script faster | AI script generation | AI can create a starting point, but you still review and test before execution. |
| Store tokens, passwords, or signing material | Workflow vault | Vault secrets are not exposed again after creation and can be referenced by workflow nodes. |
## Safety Model
Automation in SDX should stay observable:
* Give workflows clear names and descriptions.
* Keep destructive or network-changing actions behind deliberate authorizations.
* Test workflow nodes with representative context before activating the workflow.
* Use vault secrets instead of hardcoding credentials in node inputs.
* Use scheduled script test runs before multi-site execution.
* Review runs, logs, and per-site outcomes after every meaningful automation change.
## Start Here
Learn the workflow canvas, node types, context, testing, and logs.
Choose between manual, scheduled, API, lifecycle, health, and workflow triggers.
Store and reference sensitive values safely.
Test, authorize, schedule, and monitor RouterOS scripts.
# Script Management
Source: https://altostrat.io/docs/sdx/en/automation/script-management
Create, test, authorize, schedule, and monitor RouterOS scripts across Altostrat SDX managed sites.
Script management is the right tool when you need direct RouterOS control across one or more sites. SDX wraps scripts in an operational lifecycle so changes can be tested, scheduled, authorized, delivered through the device job plane, and audited afterward.
Use scripts for device configuration tasks that are easier or more precise in RouterOS than in a workflow node.
## Prerequisites
Before you schedule a script, make sure you have:
* Permission to create and manage scheduled scripts.
* At least one adopted site that can receive jobs.
* A script that has been reviewed for RouterOS version compatibility.
* A test site for validation.
* An authorization path for production execution.
## Script Lifecycle
```mermaid theme={null}
stateDiagram-v2
[*] --> Draft
Draft --> Test: Run test
Draft --> Unauthorized: Save scheduled script
Unauthorized --> Scheduled: Authorized
Scheduled --> Launched: Launch time reached
Launched --> Completed: Site outcomes complete
Launched --> Failed: One or more outcomes fail
Scheduled --> Canceled: Canceled before launch
```
## Create And Run A Scheduled Script
Go to **Scripts**, open **Scheduled Scripts**, then create a scheduled script. Give it a description that will still make sense in an audit trail later.
Choose the sites that should receive the script. Keep the first rollout small unless the script is already proven.
Write the RouterOS script directly or start from a template. Keep scripts idempotent so retries or partial rollout recovery do not create duplicate configuration.
Set the launch time. For production changes, align it with your maintenance window.
Run the script against a test site before scheduling the wider rollout.
Move the script through the authorization flow before production execution.
Watch each site outcome after launch. Investigate failed outcomes through site logs and orchestration history.
## Templates
Templates help you standardize repeatable scripts. Use templates for tasks your team performs more than once, such as:
* Adding common firewall rules.
* Updating service settings.
* Capturing diagnostic state.
* Applying a known workaround.
* Building version-aware script fragments.
Treat templates like production code. Name them clearly, review changes, and test before broad deployment.
## AI-Assisted Script Drafting
AI can help draft RouterOS scripts from a natural-language prompt. Use it to speed up first drafts, not to skip review.
Before running an AI-generated script:
1. Read every command.
2. Check whether it could remove access, disable services, delete configuration, or change routing.
3. Test it on a non-critical site.
4. Confirm the resulting device state is what you intended.
5. Use the normal authorization flow for production rollout.
Never deploy an AI-generated RouterOS script directly to production without human review and a test run.
## Best Practices
Check whether objects already exist before adding them. Avoid scripts that fail or duplicate state on a second run.
Prove behavior on one test site, then a small cohort, before a fleet-wide launch.
Templates reduce copy-paste drift and make operational procedures easier to review.
A launched script is not the same as a successful script. Review each site result.
## Related Pages
Create rollback points and compare device state before or after script changes.
Understand how SDX delivers jobs to routers.
# Workflow Authorizations
Source: https://altostrat.io/docs/sdx/en/automation/workflows/authorizations
Understand how workflow authorizations let SDX workflows perform actions on behalf of users.
Workflow authorizations let workflows and AI-assisted operations perform SDX actions on behalf of an authorized user. An authorization stores delegated access for a user in your organization, then workflows can reference it when they need to call protected SDX capabilities.
Use authorizations deliberately. They define whose access is being used when a workflow makes platform changes.
## Prerequisites
Before you create or assign an authorization, make sure you have:
* Permission to create workflows and workflow authorizations.
* A user account with the scopes needed by the workflow.
* A clear owner for the workflow.
* A review process for workflows that change network state.
## How Authorizations Work
```mermaid theme={null}
flowchart LR
User["Authorized user"] --> Auth["Workflow authorization"]
Auth --> Workflow["Workflow"]
Workflow --> API["SDX action"]
API --> Logs["Workflow runs and logs"]
```
An authorization records:
* The user identity.
* The email shown in the workflow authorizations table.
* The creation date.
* The workflows currently using the authorization.
Tokens are handled by the workflow service. If an access token expires, the service refreshes it with the stored refresh token when possible.
## Create An Authorization
Go to **Automation**, open **Workflows**, then open **Authorizations**.
Click **Add**. SDX creates an authorization URL for the login flow.
Sign in as the user whose access the workflow should use. The resulting authorization is stored for the organization.
When creating or editing a workflow, select the authorization that matches the workflow's operational owner and permissions.
## Revoke An Authorization
You can revoke authorizations that are no longer needed. If workflows are still using an authorization, SDX shows the affected workflows and blocks deletion until you remove those dependencies or assign a different authorization.
Before revoking:
* Check how many workflows use the authorization.
* Replace it on active workflows.
* Test at least one workflow run with the replacement authorization.
* Revoke the old authorization after dependent workflows are updated.
## Authorization Versus Vault
| Use | Choose |
| ---------------------------------------------------------------- | ----------------------------------------------------------------- |
| A workflow needs to call SDX as a user | Workflow authorization |
| A workflow needs an external API token, password, or signing key | Workflow vault |
| An inbound synchronous workflow needs JWT validation | Authorizer configuration backed by JWKS or vault signing material |
## Best Practices
* Create authorizations for service-owned operator accounts when possible, not personal accounts that may leave the organization.
* Keep workflow permissions as narrow as your role model allows.
* Review authorizations during offboarding.
* Watch workflow logs after changing authorizations.
* Do not reuse a powerful authorization for unrelated workflows.
# Build Workflows
Source: https://altostrat.io/docs/sdx/en/automation/workflows/building-workflows
Design Altostrat SDX workflows with triggers, actions, conditions, variables, testing, and execution logs.
Workflows are visual automation graphs. A trigger starts the run, actions perform work, conditions branch the path, and logs show what happened at each node.
Use workflows when you need repeatable operational logic that spans SDX services, external systems, notifications, scripts, policies, tags, reports, or data transformation.
## Prerequisites
Before you build a workflow, make sure you have:
* Permission to view and create workflows.
* A workflow authorization for actions that call SDX on behalf of a user.
* Vault secrets for any external API credentials, tokens, passwords, or signing keys.
* A sample payload or test context for the event you expect the workflow to handle.
## The Workflow Shape
```mermaid theme={null}
flowchart LR
Trigger["Trigger"] --> Condition{"Condition"}
Condition -->|true| ActionA["Action"]
Condition -->|false| ActionB["Action"]
ActionA --> Logs["Run logs"]
ActionB --> Logs
```
Every workflow should answer four questions:
1. What starts it?
2. What context does it receive?
3. What decisions does it make?
4. What side effects can it create?
## Build A Workflow
Go to **Automation**, open **Workflows**, then create a workflow. Give it a name and description that explain the operational intent, not just the implementation.
Choose the trigger that matches the source event. For example, use a scheduled trigger for recurring checks, a WAN trigger for failover events, or an API trigger when an external system needs a response.
Add nodes that perform the work. Common actions include Altostrat API calls, notifications, tag updates, WAN priority updates, external webhook calls, data transforms, and MikroTik script execution.
Use conditions when the workflow should branch based on status, tags, numbers, dates, booleans, arrays, or switch cases.
Test nodes with representative input. A node test is most useful when the context matches the event shape the workflow will receive in production.
Activate the workflow only after the graph, authorization, and secrets are correct. Watch the first real run and inspect logs for each node.
## Passing Data Between Nodes
Workflow nodes can use output from earlier nodes as variables in later node fields. Use this for things like:
* Passing a `site_id` from a site trigger into a **Get Site** action.
* Using a WAN tunnel ID from a WAN event in a **Get WAN Tunnel** action.
* Sending transformed text into a notification.
* Mapping an external payload into the exact shape another API expects.
Keep variable paths readable. If a payload is complex, use **JSON Parser**, **Data Mapper**, or **Text Transform** nodes to normalize the shape before later actions depend on it.
## Design Patterns
Start from a platform event, enrich it with site or WAN data, then notify the right group or create an external ticket.
Run on a schedule, fetch site state, filter by tags or conditions, and produce a notification or report artifact.
Put common logic in a workflow-triggered workflow, then call it from multiple parent workflows.
Check tags, policy state, or service status before making a network-changing call.
## Validation And Loops
SDX validates workflow structure before saving. Workflows that trigger other workflows cannot create circular dependencies, and a workflow cannot trigger itself.
For lists, use **Loop / Iterator** carefully. Keep the loop body small, constrain the item list, and make downstream actions idempotent so a retried run does not duplicate work.
## Related Pages
Compare trigger types and event sources.
Review the current trigger, action, condition, and loop node catalog.
# Workflow Node Reference
Source: https://altostrat.io/docs/sdx/en/automation/workflows/node-reference
A practical reference for the trigger, action, condition, and loop nodes available in Altostrat SDX workflows.
This reference summarizes the workflow nodes exposed by the SDX workflow builder. Use it while designing a workflow or reviewing whether a task belongs in workflows, scripts, or another SDX feature.
## Trigger Nodes
| Node | Use it for |
| --------------------------- | -------------------------------------------------------------------- |
| Manual Trigger | Start a workflow from the UI or an explicit operator action. |
| Scheduled Trigger | Run a workflow on a recurring schedule. |
| API Trigger (Synchronous) | Accept an API request and return a workflow-generated HTTP response. |
| Trigger by Another Workflow | Make a workflow callable from another workflow. |
| Subflow Trigger | Start a workflow as an internal subflow. |
| Site Added | React when a new site is added. |
| Site Removed | React when a site is removed. |
| Site Offline | React when a site stops checking in. |
| Site Online | React when a site resumes heartbeats. |
| WAN Interface Offline | React when a WAN failover interface goes offline. |
| WAN Interface Online | React when a WAN failover interface comes online. |
| WAN Packet Loss | React when WAN packet loss is detected. |
| WAN Packet Loss Resolved | React when packet loss recovers. |
## Altostrat And MikroTik Actions
| Node | Use it for |
| --------------------- | ------------------------------------------------------------- |
| Altostrat API Call | Call SDX API endpoints from a workflow. |
| Get Site | Retrieve site details and configuration. |
| Get WAN Tunnel | Retrieve WAN tunnel details and status. |
| Get Resource Tags | Read tags from a resource. |
| Set Resource Tags | Add or update tags on a resource. |
| Attach Policy | Attach a policy to a site. |
| Detach Policy | Remove a policy from a site. |
| Update WAN Priorities | Change WAN failover priority order for a site. |
| MikroTik API | Run a real-time command against a site. |
| MikroTik Script | Dispatch a RouterOS script or configuration change to a site. |
## Integration Actions
| Node | Use it for |
| ------------------------ | ---------------------------------------------------------------- |
| Webhook/API Call | Send HTTP requests to external APIs. |
| SOAP Request | Call legacy SOAP services. |
| SSH Command | Execute commands on a remote server over SSH. |
| Send Email (SMTP) | Send an email through a configured SMTP server. |
| Send Notification | Send SDX notifications through configured notification channels. |
| Trigger Another Workflow | Start another workflow from the current workflow. |
## Data And Document Actions
| Node | Use it for |
| ----------------- | ------------------------------------------------------ |
| AI Text Transform | Use an AI prompt to transform text or structured data. |
| Text Transform | Render text from workflow data using templates. |
| JSON Parser | Parse JSON input for later nodes. |
| Data Mapper | Map values into a new object or array shape. |
| Date Transform | Add, subtract, or format dates. |
| String Transform | Apply string operations to a value. |
| Validate Data | Validate data using rules before continuing. |
| Filter Array | Keep only array items that match conditions. |
| Markdown to PDF | Convert Markdown content into a PDF artifact. |
| Shorten Link | Create a shortened link from a long URL. |
| Ingest Metrics | Send custom metrics for monitoring and analysis. |
## Network And Security Tools
| Node | Use it for |
| ----------------------- | ------------------------------------------------------ |
| IPv4 Address Tool | Analyze an IPv4 address or CIDR range. |
| WireGuard Key Generator | Generate a WireGuard key pair or derive a public key. |
| CVE Scan Multiple IPs | Start an immediate CVE scan for multiple IP addresses. |
## Conditions And Flow Control
| Node | Use it for |
| ---------------------- | -------------------------------------------------------- |
| String Condition | Branch on text values. |
| Number Condition | Branch on numeric comparisons. |
| Date Condition | Branch on date or time logic. |
| Boolean Condition | Branch on true or false values. |
| Array Condition | Branch on array contents or count. |
| Resource Has Tags | Branch based on resource tags. |
| Switch | Create multiple branches from cases. |
| Logical Group (AND/OR) | Combine multiple rules into one decision. |
| Loop / Iterator | Process each item in a list. |
| Terminate | Stop the workflow and mark the path completed or failed. |
## Selection Guidance
If the workflow needs site, tag, policy, WAN, notification, or script behavior, prefer built-in Altostrat nodes over generic HTTP calls.
Normalize payloads before conditions. Clean data makes workflow paths easier to test and debug.
External APIs, SMTP, SOAP, SSH, and signing keys should read credentials from vault items rather than plain node fields.
Use loops for small, deliberate lists. For fleet-wide device changes, consider scheduled scripts or purpose-built SDX actions.
# AI Text Transform
Source: https://altostrat.io/docs/sdx/en/automation/workflows/nodes/actions/ai-text-transform
Format text and data using AI prompts.
Actions do the actual work in a workflow: API calls, transformations, notifications, flow control, and integrations. Use this action when your workflow needs to perform an operation, call an external service, or transform data for downstream nodes.
## When To Use
* Summarize raw incident notes into a concise status update.
* Normalize free-form user input into structured categories.
## Configuration Checklist
1. Provide a clear prompt and structured input data.
2. Constrain output format if downstream nodes depend on it.
3. Validate output using condition or validate action.
4. Store normalized text/object output for subsequent steps.
## Inputs
* Required `node.data` metadata: `uiId`, `componentId`, and `operation` (for actions that define an operation).
* Action-specific configuration fields from the node editor.
* Upstream context values from triggers or previous nodes (for example `trigger.*` or prior action outputs).
## Outputs
* Adds action result data to the workflow context for downstream nodes.
* May produce external side effects (API updates, notifications, scripts, SSH commands, etc.).
* Can emit structured values consumed by conditions or subsequent actions.
## Failure Modes
* Missing required configuration or invalid parameter values.
* Missing/invalid context variable references from upstream nodes.
* External dependency failures (HTTP errors, auth failures, timeouts, rate limits).
* Payload validation/parsing errors during request or response handling.
## Best Practices
* Use deterministic prompt instructions when the output feeds strict parsers.
# API Call
Source: https://altostrat.io/docs/sdx/en/automation/workflows/nodes/actions/altostrat-api-call
Make HTTP requests to Altostrat API endpoints.
Actions do the actual work in a workflow: API calls, transformations, notifications, flow control, and integrations. Use this action when your workflow needs to perform an operation, call an external service, or transform data for downstream nodes.
## When To Use
* Read/update records in Altostrat APIs during automation.
* Integrate workflow logic with existing internal API endpoints.
## Configuration Checklist
1. Configure HTTP method and endpoint.
2. Map headers, query params, or payload fields from context.
3. Parse response data and pass important fields downstream.
4. Branch on status code or response body values.
## Inputs
* Required `node.data` metadata: `uiId`, `componentId`, and `operation` (for actions that define an operation).
* Action-specific configuration fields from the node editor.
* Upstream context values from triggers or previous nodes (for example `trigger.*` or prior action outputs).
## Outputs
* Adds action result data to the workflow context for downstream nodes.
* May produce external side effects (API updates, notifications, scripts, SSH commands, etc.).
* Can emit structured values consumed by conditions or subsequent actions.
## Failure Modes
* Missing required configuration or invalid parameter values.
* Missing/invalid context variable references from upstream nodes.
* External dependency failures (HTTP errors, auth failures, timeouts, rate limits).
* Payload validation/parsing errors during request or response handling.
## Best Practices
* Treat API response schemas as contracts and version them when possible.
# Attach Policy
Source: https://altostrat.io/docs/sdx/en/automation/workflows/nodes/actions/altostrat-attach-policy
Attach a policy to a site.
Actions do the actual work in a workflow: API calls, transformations, notifications, flow control, and integrations. Use this action when your workflow needs to perform an operation, call an external service, or transform data for downstream nodes.
## When To Use
* Apply security baseline policy to new sites.
* Attach temporary lockdown policy during incident response.
## Configuration Checklist
1. Set site identifier and policy type.
2. Optionally fetch site metadata before attachment.
3. Attach policy and branch on API response status.
4. Log or notify outcomes for audit visibility.
## Inputs
* Required `node.data` metadata: `uiId`, `componentId`, and `operation` (for actions that define an operation).
* Action-specific configuration fields from the node editor.
* Upstream context values from triggers or previous nodes (for example `trigger.*` or prior action outputs).
## Outputs
* Adds action result data to the workflow context for downstream nodes.
* May produce external side effects (API updates, notifications, scripts, SSH commands, etc.).
* Can emit structured values consumed by conditions or subsequent actions.
## Failure Modes
* Missing required configuration or invalid parameter values.
* Missing/invalid context variable references from upstream nodes.
* External dependency failures (HTTP errors, auth failures, timeouts, rate limits).
* Payload validation/parsing errors during request or response handling.
## Best Practices
* Prefer small, composable actions over one large action with many responsibilities.
# Detach Policy
Source: https://altostrat.io/docs/sdx/en/automation/workflows/nodes/actions/altostrat-detach-policy
Remove a policy from a site.
Actions do the actual work in a workflow: API calls, transformations, notifications, flow control, and integrations. Use this action when your workflow needs to perform an operation, call an external service, or transform data for downstream nodes.
## When To Use
* Remove temporary emergency controls after recovery.
* Clean up old policy assignments during migration.
## Configuration Checklist
1. Set site identifier and target policy type.
2. Optionally validate policy currently exists on the site.
3. Detach policy and verify response success.
4. Notify stakeholders of policy state change.
## Inputs
* Required `node.data` metadata: `uiId`, `componentId`, and `operation` (for actions that define an operation).
* Action-specific configuration fields from the node editor.
* Upstream context values from triggers or previous nodes (for example `trigger.*` or prior action outputs).
## Outputs
* Adds action result data to the workflow context for downstream nodes.
* May produce external side effects (API updates, notifications, scripts, SSH commands, etc.).
* Can emit structured values consumed by conditions or subsequent actions.
## Failure Modes
* Missing required configuration or invalid parameter values.
* Missing/invalid context variable references from upstream nodes.
* External dependency failures (HTTP errors, auth failures, timeouts, rate limits).
* Payload validation/parsing errors during request or response handling.
## Best Practices
* Prefer small, composable actions over one large action with many responsibilities.
# Get Resource Tags
Source: https://altostrat.io/docs/sdx/en/automation/workflows/nodes/actions/altostrat-get-resource-tags
Retrieve tags associated with a resource (site).
Actions do the actual work in a workflow: API calls, transformations, notifications, flow control, and integrations. Use this action when your workflow needs to perform an operation, call an external service, or transform data for downstream nodes.
## When To Use
* Route alerts by `environment` or `region` tags.
* Check if mandatory tags exist before deployment actions.
## Configuration Checklist
1. Set resource/site ID.
2. Retrieve current tag set.
3. Use tag conditions to drive branch logic.
4. Optionally pass tags into notifications or API calls.
## Inputs
* Required `node.data` metadata: `uiId`, `componentId`, and `operation` (for actions that define an operation).
* Action-specific configuration fields from the node editor.
* Upstream context values from triggers or previous nodes (for example `trigger.*` or prior action outputs).
## Outputs
* Adds action result data to the workflow context for downstream nodes.
* May produce external side effects (API updates, notifications, scripts, SSH commands, etc.).
* Can emit structured values consumed by conditions or subsequent actions.
## Failure Modes
* Missing required configuration or invalid parameter values.
* Missing/invalid context variable references from upstream nodes.
* External dependency failures (HTTP errors, auth failures, timeouts, rate limits).
* Payload validation/parsing errors during request or response handling.
## Best Practices
* Prefer small, composable actions over one large action with many responsibilities.
# Get Site
Source: https://altostrat.io/docs/sdx/en/automation/workflows/nodes/actions/altostrat-get-site
Retrieve detailed site information and configuration.
Actions do the actual work in a workflow: API calls, transformations, notifications, flow control, and integrations. Use this action when your workflow needs to perform an operation, call an external service, or transform data for downstream nodes.
## When To Use
* Lookup site owner/team before sending alerts.
* Fetch site state before policy or WAN changes.
## Configuration Checklist
1. Set site ID from trigger payload or upstream node output.
2. Execute action to fetch full site metadata.
3. Map returned fields into conditions or notifications.
4. Use data to enrich downstream decisions.
## Inputs
* Required `node.data` metadata: `uiId`, `componentId`, and `operation` (for actions that define an operation).
* Action-specific configuration fields from the node editor.
* Upstream context values from triggers or previous nodes (for example `trigger.*` or prior action outputs).
## Outputs
* Adds action result data to the workflow context for downstream nodes.
* May produce external side effects (API updates, notifications, scripts, SSH commands, etc.).
* Can emit structured values consumed by conditions or subsequent actions.
## Failure Modes
* Missing required configuration or invalid parameter values.
* Missing/invalid context variable references from upstream nodes.
* External dependency failures (HTTP errors, auth failures, timeouts, rate limits).
* Payload validation/parsing errors during request or response handling.
## Best Practices
* Prefer small, composable actions over one large action with many responsibilities.
# Get WAN Tunnel
Source: https://altostrat.io/docs/sdx/en/automation/workflows/nodes/actions/altostrat-get-wan
Retrieve detailed WAN tunnel information and status.
Actions do the actual work in a workflow: API calls, transformations, notifications, flow control, and integrations. Use this action when your workflow needs to perform an operation, call an external service, or transform data for downstream nodes.
## When To Use
* Enrich WAN outage events with tunnel metadata.
* Validate tunnel state before rerouting traffic.
## Configuration Checklist
1. Set both site ID and WAN tunnel ID.
2. Fetch tunnel details and current health status.
3. Evaluate values via conditions for branching.
4. Use outputs for escalation, remediation, or reporting.
## Inputs
* Required `node.data` metadata: `uiId`, `componentId`, and `operation` (for actions that define an operation).
* Action-specific configuration fields from the node editor.
* Upstream context values from triggers or previous nodes (for example `trigger.*` or prior action outputs).
## Outputs
* Adds action result data to the workflow context for downstream nodes.
* May produce external side effects (API updates, notifications, scripts, SSH commands, etc.).
* Can emit structured values consumed by conditions or subsequent actions.
## Failure Modes
* Missing required configuration or invalid parameter values.
* Missing/invalid context variable references from upstream nodes.
* External dependency failures (HTTP errors, auth failures, timeouts, rate limits).
* Payload validation/parsing errors during request or response handling.
## Best Practices
* Prefer small, composable actions over one large action with many responsibilities.
# MikroTik Script
Source: https://altostrat.io/docs/sdx/en/automation/workflows/nodes/actions/altostrat-run-async-script
Run scripts or config changes on a site.
Actions do the actual work in a workflow: API calls, transformations, notifications, flow control, and integrations. Use this action when your workflow needs to perform an operation, call an external service, or transform data for downstream nodes.
## When To Use
* Apply configuration change scripts to remote sites.
* Run periodic maintenance scripts without blocking workflow runtime.
## Configuration Checklist
1. Set target site and script body or script reference.
2. Provide required script parameters from workflow context.
3. Trigger async execution and capture job metadata.
4. Add follow-up checks if script completion must be verified.
## Inputs
* Required `node.data` metadata: `uiId`, `componentId`, and `operation` (for actions that define an operation).
* Action-specific configuration fields from the node editor.
* Upstream context values from triggers or previous nodes (for example `trigger.*` or prior action outputs).
## Outputs
* Adds action result data to the workflow context for downstream nodes.
* May produce external side effects (API updates, notifications, scripts, SSH commands, etc.).
* Can emit structured values consumed by conditions or subsequent actions.
## Failure Modes
* Missing required configuration or invalid parameter values.
* Missing/invalid context variable references from upstream nodes.
* External dependency failures (HTTP errors, auth failures, timeouts, rate limits).
* Payload validation/parsing errors during request or response handling.
## Best Practices
* Prefer small, composable actions over one large action with many responsibilities.
# MikroTik API
Source: https://altostrat.io/docs/sdx/en/automation/workflows/nodes/actions/altostrat-run-sync-command
Run a real-time API command on a specific site.
Actions do the actual work in a workflow: API calls, transformations, notifications, flow control, and integrations. Use this action when your workflow needs to perform an operation, call an external service, or transform data for downstream nodes.
## When To Use
* Run read-only diagnostics on a failing edge router.
* Collect immediate interface statistics during incidents.
## Configuration Checklist
1. Set target site and command to execute.
2. Use conservative command scopes for live systems.
3. Capture command output and branch on success indicators.
4. Record outputs needed for auditing or troubleshooting.
## Inputs
* Required `node.data` metadata: `uiId`, `componentId`, and `operation` (for actions that define an operation).
* Action-specific configuration fields from the node editor.
* Upstream context values from triggers or previous nodes (for example `trigger.*` or prior action outputs).
## Outputs
* Adds action result data to the workflow context for downstream nodes.
* May produce external side effects (API updates, notifications, scripts, SSH commands, etc.).
* Can emit structured values consumed by conditions or subsequent actions.
## Failure Modes
* Missing required configuration or invalid parameter values.
* Missing/invalid context variable references from upstream nodes.
* External dependency failures (HTTP errors, auth failures, timeouts, rate limits).
* Payload validation/parsing errors during request or response handling.
## Best Practices
* Prefer read-only commands unless a clear change-control path exists.
# Set Resource Tags
Source: https://altostrat.io/docs/sdx/en/automation/workflows/nodes/actions/altostrat-set-resource-tags
Add or update tag key-value pairs for a resource.
Actions do the actual work in a workflow: API calls, transformations, notifications, flow control, and integrations. Use this action when your workflow needs to perform an operation, call an external service, or transform data for downstream nodes.
## When To Use
* Auto-tag newly discovered sites with onboarding metadata.
* Stamp incident ticket IDs onto affected resources.
## Configuration Checklist
1. Set resource/site ID and key/value tags to apply.
2. Prepare tags from mapped context values when needed.
3. Execute update and verify tag count/result.
4. Optionally re-fetch tags to confirm final state.
## Inputs
* Required `node.data` metadata: `uiId`, `componentId`, and `operation` (for actions that define an operation).
* Action-specific configuration fields from the node editor.
* Upstream context values from triggers or previous nodes (for example `trigger.*` or prior action outputs).
## Outputs
* Adds action result data to the workflow context for downstream nodes.
* May produce external side effects (API updates, notifications, scripts, SSH commands, etc.).
* Can emit structured values consumed by conditions or subsequent actions.
## Failure Modes
* Missing required configuration or invalid parameter values.
* Missing/invalid context variable references from upstream nodes.
* External dependency failures (HTTP errors, auth failures, timeouts, rate limits).
* Payload validation/parsing errors during request or response handling.
## Best Practices
* Prefer small, composable actions over one large action with many responsibilities.
# Update WAN Priorities
Source: https://altostrat.io/docs/sdx/en/automation/workflows/nodes/actions/altostrat-update-wan-priorities
Update WAN failover link priorities for a site.
Actions do the actual work in a workflow: API calls, transformations, notifications, flow control, and integrations. Use this action when your workflow needs to perform an operation, call an external service, or transform data for downstream nodes.
## When To Use
* Promote backup link during prolonged degradation.
* Revert WAN priorities after maintenance window completion.
## Configuration Checklist
1. Provide target site and WAN priority list.
2. Validate desired order before applying updates.
3. Execute update and verify resulting configuration.
4. Notify operations if changes affect critical traffic paths.
## Inputs
* Required `node.data` metadata: `uiId`, `componentId`, and `operation` (for actions that define an operation).
* Action-specific configuration fields from the node editor.
* Upstream context values from triggers or previous nodes (for example `trigger.*` or prior action outputs).
## Outputs
* Adds action result data to the workflow context for downstream nodes.
* May produce external side effects (API updates, notifications, scripts, SSH commands, etc.).
* Can emit structured values consumed by conditions or subsequent actions.
## Failure Modes
* Missing required configuration or invalid parameter values.
* Missing/invalid context variable references from upstream nodes.
* External dependency failures (HTTP errors, auth failures, timeouts, rate limits).
* Payload validation/parsing errors during request or response handling.
## Best Practices
* Prefer small, composable actions over one large action with many responsibilities.
# Filter Array
Source: https://altostrat.io/docs/sdx/en/automation/workflows/nodes/actions/array-filter
Create a new array with only the items that match your conditions.
Actions do the actual work in a workflow: API calls, transformations, notifications, flow control, and integrations. Use this action when your workflow needs to perform an operation, call an external service, or transform data for downstream nodes.
## When To Use
* Keep only critical alerts from a mixed event list.
* Filter resources by status before batch operations.
## Configuration Checklist
1. Set input array path from context.
2. Define one or more filter conditions.
3. Execute and inspect resulting subset.
4. Pass filtered data into iterator or API action nodes.
## Inputs
* Required `node.data` metadata: `uiId`, `componentId`, and `operation` (for actions that define an operation).
* Action-specific configuration fields from the node editor.
* Upstream context values from triggers or previous nodes (for example `trigger.*` or prior action outputs).
## Outputs
* Adds action result data to the workflow context for downstream nodes.
* May produce external side effects (API updates, notifications, scripts, SSH commands, etc.).
* Can emit structured values consumed by conditions or subsequent actions.
## Failure Modes
* Missing required configuration or invalid parameter values.
* Missing/invalid context variable references from upstream nodes.
* External dependency failures (HTTP errors, auth failures, timeouts, rate limits).
* Payload validation/parsing errors during request or response handling.
## Best Practices
* Prefer small, composable actions over one large action with many responsibilities.
# Shorten Link
Source: https://altostrat.io/docs/sdx/en/automation/workflows/nodes/actions/create-short-link
Create a short link from a long URL.
Actions do the actual work in a workflow: API calls, transformations, notifications, flow control, and integrations. Use this action when your workflow needs to perform an operation, call an external service, or transform data for downstream nodes.
## When To Use
* Send compact links in SMS or chat notifications.
* Share temporary runbook/report URLs in incident alerts.
## Configuration Checklist
1. Set target long URL (redirect destination).
2. Generate short link and capture returned short URL.
3. Embed short URL into notifications or reports.
4. Optionally track by attaching context metadata in message text.
## Inputs
* Required `node.data` metadata: `uiId`, `componentId`, and `operation` (for actions that define an operation).
* Action-specific configuration fields from the node editor.
* Upstream context values from triggers or previous nodes (for example `trigger.*` or prior action outputs).
## Outputs
* Adds action result data to the workflow context for downstream nodes.
* May produce external side effects (API updates, notifications, scripts, SSH commands, etc.).
* Can emit structured values consumed by conditions or subsequent actions.
## Failure Modes
* Missing required configuration or invalid parameter values.
* Missing/invalid context variable references from upstream nodes.
* External dependency failures (HTTP errors, auth failures, timeouts, rate limits).
* Payload validation/parsing errors during request or response handling.
## Best Practices
* Prefer small, composable actions over one large action with many responsibilities.
# CVE Scan Multiple IPs
Source: https://altostrat.io/docs/sdx/en/automation/workflows/nodes/actions/cve-scan-multiple-ips
Initiate an immediate CVE scan for multiple IP addresses.
Actions do the actual work in a workflow: API calls, transformations, notifications, flow control, and integrations. Use this action when your workflow needs to perform an operation, call an external service, or transform data for downstream nodes.
## When To Use
* Launch immediate scans after threat intelligence updates.
* Scan newly discovered assets in onboarding workflows.
## Configuration Checklist
1. Provide target site and list of IP addresses.
2. Optionally pre-filter IP list to keep scan scope focused.
3. Trigger scan and capture returned job/result identifiers.
4. Notify security teams with scan initiation or findings summary.
## Inputs
* Required `node.data` metadata: `uiId`, `componentId`, and `operation` (for actions that define an operation).
* Action-specific configuration fields from the node editor.
* Upstream context values from triggers or previous nodes (for example `trigger.*` or prior action outputs).
## Outputs
* Adds action result data to the workflow context for downstream nodes.
* May produce external side effects (API updates, notifications, scripts, SSH commands, etc.).
* Can emit structured values consumed by conditions or subsequent actions.
## Failure Modes
* Missing required configuration or invalid parameter values.
* Missing/invalid context variable references from upstream nodes.
* External dependency failures (HTTP errors, auth failures, timeouts, rate limits).
* Payload validation/parsing errors during request or response handling.
## Best Practices
* Prefer small, composable actions over one large action with many responsibilities.
# Data Mapper
Source: https://altostrat.io/docs/sdx/en/automation/workflows/nodes/actions/data-mapper-action
Create or modify objects and arrays by mapping data.
Actions do the actual work in a workflow: API calls, transformations, notifications, flow control, and integrations. Use this action when your workflow needs to perform an operation, call an external service, or transform data for downstream nodes.
## When To Use
* Normalize event payloads from multiple trigger sources.
* Prepare a canonical object for downstream integrations.
## Configuration Checklist
1. Define target object/array schema.
2. Map source paths from trigger/action outputs to target fields.
3. Set defaults for optional fields.
4. Use mapped object in API calls or document generation.
## Inputs
* Required `node.data` metadata: `uiId`, `componentId`, and `operation` (for actions that define an operation).
* Action-specific configuration fields from the node editor.
* Upstream context values from triggers or previous nodes (for example `trigger.*` or prior action outputs).
## Outputs
* Adds action result data to the workflow context for downstream nodes.
* May produce external side effects (API updates, notifications, scripts, SSH commands, etc.).
* Can emit structured values consumed by conditions or subsequent actions.
## Failure Modes
* Missing required configuration or invalid parameter values.
* Missing/invalid context variable references from upstream nodes.
* External dependency failures (HTTP errors, auth failures, timeouts, rate limits).
* Payload validation/parsing errors during request or response handling.
## Best Practices
* Prefer small, composable actions over one large action with many responsibilities.
# Date Transform
Source: https://altostrat.io/docs/sdx/en/automation/workflows/nodes/actions/date-transform-action
Modify dates, add/subtract time, or change formats.
Actions do the actual work in a workflow: API calls, transformations, notifications, flow control, and integrations. Use this action when your workflow needs to perform an operation, call an external service, or transform data for downstream nodes.
## When To Use
* Calculate maintenance end time from start + duration.
* Convert timestamps to human-readable local time for alerts.
## Configuration Checklist
1. Provide input date/time value and operation (format/add/subtract).
2. Set timezone/format expectations where relevant.
3. Generate transformed date output.
4. Use result for scheduling windows or message formatting.
## Inputs
* Required `node.data` metadata: `uiId`, `componentId`, and `operation` (for actions that define an operation).
* Action-specific configuration fields from the node editor.
* Upstream context values from triggers or previous nodes (for example `trigger.*` or prior action outputs).
## Outputs
* Adds action result data to the workflow context for downstream nodes.
* May produce external side effects (API updates, notifications, scripts, SSH commands, etc.).
* Can emit structured values consumed by conditions or subsequent actions.
## Failure Modes
* Missing required configuration or invalid parameter values.
* Missing/invalid context variable references from upstream nodes.
* External dependency failures (HTTP errors, auth failures, timeouts, rate limits).
* Payload validation/parsing errors during request or response handling.
## Best Practices
* Prefer small, composable actions over one large action with many responsibilities.
# Ingest Metrics
Source: https://altostrat.io/docs/sdx/en/automation/workflows/nodes/actions/ingest-metrics
Send custom metrics to Prometheus for monitoring and analysis.
Actions do the actual work in a workflow: API calls, transformations, notifications, flow control, and integrations. Use this action when your workflow needs to perform an operation, call an external service, or transform data for downstream nodes.
## When To Use
* Publish custom workflow KPIs to Prometheus.
* Emit incident-related metrics for SLO tracking.
## Configuration Checklist
1. Define metric names, values, labels, and entity context.
2. Map dynamic values from workflow payloads.
3. Send metrics and confirm ingestion response.
4. Use dashboards/alerts to validate metric usefulness.
## Inputs
* Required `node.data` metadata: `uiId`, `componentId`, and `operation` (for actions that define an operation).
* Action-specific configuration fields from the node editor.
* Upstream context values from triggers or previous nodes (for example `trigger.*` or prior action outputs).
## Outputs
* Adds action result data to the workflow context for downstream nodes.
* May produce external side effects (API updates, notifications, scripts, SSH commands, etc.).
* Can emit structured values consumed by conditions or subsequent actions.
## Failure Modes
* Missing required configuration or invalid parameter values.
* Missing/invalid context variable references from upstream nodes.
* External dependency failures (HTTP errors, auth failures, timeouts, rate limits).
* Payload validation/parsing errors during request or response handling.
## Best Practices
* Prefer small, composable actions over one large action with many responsibilities.
# IPv4 Address Tool
Source: https://altostrat.io/docs/sdx/en/automation/workflows/nodes/actions/ipv4-address
Analyze an IPv4 address or CIDR range.
Actions do the actual work in a workflow: API calls, transformations, notifications, flow control, and integrations. Use this action when your workflow needs to perform an operation, call an external service, or transform data for downstream nodes.
## When To Use
* Validate whether an IP belongs to an approved subnet.
* Compute addressing details for onboarding automation.
## Configuration Checklist
1. Set IPv4 or CIDR input value.
2. Run analysis to extract network details.
3. Branch on subnet or host-level checks.
4. Use derived network values in downstream logic.
## Inputs
* Required `node.data` metadata: `uiId`, `componentId`, and `operation` (for actions that define an operation).
* Action-specific configuration fields from the node editor.
* Upstream context values from triggers or previous nodes (for example `trigger.*` or prior action outputs).
## Outputs
* Adds action result data to the workflow context for downstream nodes.
* May produce external side effects (API updates, notifications, scripts, SSH commands, etc.).
* Can emit structured values consumed by conditions or subsequent actions.
## Failure Modes
* Missing required configuration or invalid parameter values.
* Missing/invalid context variable references from upstream nodes.
* External dependency failures (HTTP errors, auth failures, timeouts, rate limits).
* Payload validation/parsing errors during request or response handling.
## Best Practices
* Prefer small, composable actions over one large action with many responsibilities.
# JSON Parser
Source: https://altostrat.io/docs/sdx/en/automation/workflows/nodes/actions/json-parser
Parse JSON data and extract values.
Actions do the actual work in a workflow: API calls, transformations, notifications, flow control, and integrations. Use this action when your workflow needs to perform an operation, call an external service, or transform data for downstream nodes.
## When To Use
* Extract IDs and statuses from API response bodies.
* Parse webhook payloads before branching logic.
## Configuration Checklist
1. Provide raw JSON string or object payload.
2. Configure extraction paths for required fields.
3. Use extracted values in downstream nodes.
4. Add validation/condition checks when payloads are unstable.
## Inputs
* Required `node.data` metadata: `uiId`, `componentId`, and `operation` (for actions that define an operation).
* Action-specific configuration fields from the node editor.
* Upstream context values from triggers or previous nodes (for example `trigger.*` or prior action outputs).
## Outputs
* Adds action result data to the workflow context for downstream nodes.
* May produce external side effects (API updates, notifications, scripts, SSH commands, etc.).
* Can emit structured values consumed by conditions or subsequent actions.
## Failure Modes
* Missing required configuration or invalid parameter values.
* Missing/invalid context variable references from upstream nodes.
* External dependency failures (HTTP errors, auth failures, timeouts, rate limits).
* Payload validation/parsing errors during request or response handling.
## Best Practices
* Prefer small, composable actions over one large action with many responsibilities.
# Markdown to PDF
Source: https://altostrat.io/docs/sdx/en/automation/workflows/nodes/actions/markdown-pdf
Convert Markdown content to PDF format.
Actions do the actual work in a workflow: API calls, transformations, notifications, flow control, and integrations. Use this action when your workflow needs to perform an operation, call an external service, or transform data for downstream nodes.
## When To Use
* Generate post-incident summary documents.
* Create recurring compliance reports in PDF format.
## Configuration Checklist
1. Compose markdown content using workflow context variables.
2. Generate PDF output from markdown.
3. Store or forward the generated document reference.
4. Attach the result in email or ticketing workflows.
## Inputs
* Required `node.data` metadata: `uiId`, `componentId`, and `operation` (for actions that define an operation).
* Action-specific configuration fields from the node editor.
* Upstream context values from triggers or previous nodes (for example `trigger.*` or prior action outputs).
## Outputs
* Adds action result data to the workflow context for downstream nodes.
* May produce external side effects (API updates, notifications, scripts, SSH commands, etc.).
* Can emit structured values consumed by conditions or subsequent actions.
## Failure Modes
* Missing required configuration or invalid parameter values.
* Missing/invalid context variable references from upstream nodes.
* External dependency failures (HTTP errors, auth failures, timeouts, rate limits).
* Payload validation/parsing errors during request or response handling.
## Best Practices
* Prefer small, composable actions over one large action with many responsibilities.
# Overview
Source: https://altostrat.io/docs/sdx/en/automation/workflows/nodes/actions/overview
Reference for workflow action nodes, including action categories, typical use cases, and links to detailed per-action documentation.
Action nodes are the execution steps in your workflow. They transform data, call APIs, notify people, and perform platform operations after a trigger has started the run.
## How To Use Action Nodes
1. Place actions after a trigger or branch decision.
2. Map input values from workflow context (for example `trigger.*` or prior node outputs).
3. Validate response shape before dependent downstream logic.
4. Add failure handling for operations with external side effects.
## Choosing The Right Action
* Use **Advanced Actions** when orchestrating APIs and cross-workflow behavior.
* Use **Data Processing** actions to parse, map, validate, and transform payloads.
* Use **Communication** actions for human-facing notifications.
* Use **Network/Security** actions for infrastructure tasks and key generation.
* Use **Flow Control** actions to terminate or route execution intentionally.
## Action Types
Start another workflow from this one.
[View](./trigger-workflow-action)
Make HTTP requests to Altostrat API endpoints.
[View](./altostrat-api-call)
Send HTTP requests to external APIs and webhook endpoints.
[View](./webhook-api-call)
Interact with legacy SOAP web services.
[View](./soap-action)
Format text and data using AI prompts.
[View](./ai-text-transform)
Attach a policy to a site.
[View](./altostrat-attach-policy)
Remove a policy from a site.
[View](./altostrat-detach-policy)
Update WAN failover link priorities for a site.
[View](./altostrat-update-wan-priorities)
Run a real-time API command on a specific site.
[View](./altostrat-run-sync-command)
Retrieve detailed site information and configuration.
[View](./altostrat-get-site)
Retrieve detailed WAN tunnel information and status.
[View](./altostrat-get-wan)
Retrieve tags associated with a resource (site).
[View](./altostrat-get-resource-tags)
Add or update tag key-value pairs for a resource.
[View](./altostrat-set-resource-tags)
Run scripts or config changes on a site.
[View](./altostrat-run-async-script)
Format text and data using custom templates.
[View](./text-transform)
Parse JSON data and extract values.
[View](./json-parser)
Create a short link from a long URL.
[View](./create-short-link)
Convert Markdown content to PDF format.
[View](./markdown-pdf)
Send notifications via email or WhatsApp.
[View](./send-notification)
Create or modify objects and arrays by mapping data.
[View](./data-mapper-action)
Modify dates, add/subtract time, or change formats.
[View](./date-transform-action)
Perform a series of transformations on a string.
[View](./string-transform)
Validate an object or array using Laravel rules.
[View](./validate)
Analyze an IPv4 address or CIDR range.
[View](./ipv4-address)
Generate a new key pair or derive a public key.
[View](./wireguard-key-generator)
Create a new array with only the items that match your conditions.
[View](./array-filter)
Stop the workflow with a "Completed" or "Failed" status.
[View](./terminate-action)
Send an email via a custom SMTP server.
[View](./smtp-action)
Execute commands on a remote server via SSH.
[View](./ssh-action)
Initiate an immediate CVE scan for multiple IP addresses.
[View](./cve-scan-multiple-ips)
Send custom metrics to Prometheus for monitoring and analysis.
[View](./ingest-metrics)
## Action Design Best Practices
* Keep each action focused on one responsibility.
* Normalize and validate data before branching or calling external systems.
* Treat API responses as contracts and guard against missing fields.
* Use retries and fallback paths for critical notifications and integrations.
# Send Notification
Source: https://altostrat.io/docs/sdx/en/automation/workflows/nodes/actions/send-notification
Send notifications via email or WhatsApp.
Actions do the actual work in a workflow: API calls, transformations, notifications, flow control, and integrations. Use this action when your workflow needs to perform an operation, call an external service, or transform data for downstream nodes.
## When To Use
* Send outage notifications to on-call groups.
* Deliver daily success/failure summaries to operations.
## Configuration Checklist
1. Choose notification channel and recipients/user tags.
2. Build message body using context values.
3. Set priority/severity metadata if supported.
4. Use conditions to reduce noise for low-impact events.
## Inputs
* Required `node.data` metadata: `uiId`, `componentId`, and `operation` (for actions that define an operation).
* Action-specific configuration fields from the node editor.
* Upstream context values from triggers or previous nodes (for example `trigger.*` or prior action outputs).
## Outputs
* Adds action result data to the workflow context for downstream nodes.
* May produce external side effects (API updates, notifications, scripts, SSH commands, etc.).
* Can emit structured values consumed by conditions or subsequent actions.
## Failure Modes
* Missing required configuration or invalid parameter values.
* Missing/invalid context variable references from upstream nodes.
* External dependency failures (HTTP errors, auth failures, timeouts, rate limits).
* Payload validation/parsing errors during request or response handling.
## Best Practices
* Prefer small, composable actions over one large action with many responsibilities.
# Send Email (SMTP)
Source: https://altostrat.io/docs/sdx/en/automation/workflows/nodes/actions/smtp-action
Send an email via a custom SMTP server.
Actions do the actual work in a workflow: API calls, transformations, notifications, flow control, and integrations. Use this action when your workflow needs to perform an operation, call an external service, or transform data for downstream nodes.
## When To Use
* Send branded email alerts through organization SMTP.
* Deliver periodic PDF reports to distribution lists.
## Configuration Checklist
1. Configure SMTP server credentials and sender details.
2. Set recipients, subject, and body with context variables.
3. Send and inspect delivery response/errors.
4. Add retries or fallback channels for critical alerts.
## Inputs
* Required `node.data` metadata: `uiId`, `componentId`, and `operation` (for actions that define an operation).
* Action-specific configuration fields from the node editor.
* Upstream context values from triggers or previous nodes (for example `trigger.*` or prior action outputs).
## Outputs
* Adds action result data to the workflow context for downstream nodes.
* May produce external side effects (API updates, notifications, scripts, SSH commands, etc.).
* Can emit structured values consumed by conditions or subsequent actions.
## Failure Modes
* Missing required configuration or invalid parameter values.
* Missing/invalid context variable references from upstream nodes.
* External dependency failures (HTTP errors, auth failures, timeouts, rate limits).
* Payload validation/parsing errors during request or response handling.
## Best Practices
* Use secret storage for SMTP credentials.
# SOAP Request
Source: https://altostrat.io/docs/sdx/en/automation/workflows/nodes/actions/soap-action
Interact with legacy SOAP web services.
Actions do the actual work in a workflow: API calls, transformations, notifications, flow control, and integrations. Use this action when your workflow needs to perform an operation, call an external service, or transform data for downstream nodes.
## When To Use
* Integrate with legacy ticketing or ERP services.
* Submit provisioning requests to older SOAP-only systems.
## Configuration Checklist
1. Set WSDL URL and target SOAP operation.
2. Build SOAP input payload from workflow context.
3. Execute and parse result for downstream conditions/actions.
4. Handle SOAP faults explicitly with error branches.
## Inputs
* Required `node.data` metadata: `uiId`, `componentId`, and `operation` (for actions that define an operation).
* Action-specific configuration fields from the node editor.
* Upstream context values from triggers or previous nodes (for example `trigger.*` or prior action outputs).
## Outputs
* Adds action result data to the workflow context for downstream nodes.
* May produce external side effects (API updates, notifications, scripts, SSH commands, etc.).
* Can emit structured values consumed by conditions or subsequent actions.
## Failure Modes
* Missing required configuration or invalid parameter values.
* Missing/invalid context variable references from upstream nodes.
* External dependency failures (HTTP errors, auth failures, timeouts, rate limits).
* Payload validation/parsing errors during request or response handling.
## Best Practices
* Prefer small, composable actions over one large action with many responsibilities.
# SSH Command
Source: https://altostrat.io/docs/sdx/en/automation/workflows/nodes/actions/ssh-action
Execute commands on a remote server via SSH.
Actions do the actual work in a workflow: API calls, transformations, notifications, flow control, and integrations. Use this action when your workflow needs to perform an operation, call an external service, or transform data for downstream nodes.
## When To Use
* Run remote diagnostics on an external appliance.
* Execute controlled remediation commands during incidents.
## Configuration Checklist
1. Set SSH host, port, auth method, and command list.
2. Inject context values carefully into commands.
3. Capture stdout/stderr and evaluate command exit behavior.
4. Branch to rollback/escalation steps when command execution fails.
## Inputs
* Required `node.data` metadata: `uiId`, `componentId`, and `operation` (for actions that define an operation).
* Action-specific configuration fields from the node editor.
* Upstream context values from triggers or previous nodes (for example `trigger.*` or prior action outputs).
## Outputs
* Adds action result data to the workflow context for downstream nodes.
* May produce external side effects (API updates, notifications, scripts, SSH commands, etc.).
* Can emit structured values consumed by conditions or subsequent actions.
## Failure Modes
* Missing required configuration or invalid parameter values.
* Missing/invalid context variable references from upstream nodes.
* External dependency failures (HTTP errors, auth failures, timeouts, rate limits).
* Payload validation/parsing errors during request or response handling.
## Best Practices
* Treat SSH commands as high-risk side effects and test on non-prod first.
# String Transform
Source: https://altostrat.io/docs/sdx/en/automation/workflows/nodes/actions/string-transform
Perform a series of transformations on a string.
Actions do the actual work in a workflow: API calls, transformations, notifications, flow control, and integrations. Use this action when your workflow needs to perform an operation, call an external service, or transform data for downstream nodes.
## When To Use
* Normalize hostnames/labels before API updates.
* Sanitize user-provided strings for reporting output.
## Configuration Checklist
1. Set input string and define transformation pipeline.
2. Apply operations like trim/replace/case conversion.
3. Validate output before using in strict APIs.
4. Pass cleaned value to downstream actions.
## Inputs
* Required `node.data` metadata: `uiId`, `componentId`, and `operation` (for actions that define an operation).
* Action-specific configuration fields from the node editor.
* Upstream context values from triggers or previous nodes (for example `trigger.*` or prior action outputs).
## Outputs
* Adds action result data to the workflow context for downstream nodes.
* May produce external side effects (API updates, notifications, scripts, SSH commands, etc.).
* Can emit structured values consumed by conditions or subsequent actions.
## Failure Modes
* Missing required configuration or invalid parameter values.
* Missing/invalid context variable references from upstream nodes.
* External dependency failures (HTTP errors, auth failures, timeouts, rate limits).
* Payload validation/parsing errors during request or response handling.
## Best Practices
* Prefer small, composable actions over one large action with many responsibilities.
# Terminate
Source: https://altostrat.io/docs/sdx/en/automation/workflows/nodes/actions/terminate-action
Stop the workflow with a 'Completed' or 'Failed' status.
Actions do the actual work in a workflow: API calls, transformations, notifications, flow control, and integrations. Use this action when your workflow needs to perform an operation, call an external service, or transform data for downstream nodes.
## When To Use
* Fail fast when validation or prechecks do not pass.
* Mark workflow complete after final success notification.
## Configuration Checklist
1. Add Terminate where the workflow should stop explicitly.
2. Choose final status (`completed` or `failed`).
3. Optionally set context fields used by reporting/response.
4. Use in both happy and error paths for predictable endings.
## Inputs
* Required `node.data` metadata: `uiId`, `componentId`, and `operation` (for actions that define an operation).
* Action-specific configuration fields from the node editor.
* Upstream context values from triggers or previous nodes (for example `trigger.*` or prior action outputs).
## Outputs
* Adds action result data to the workflow context for downstream nodes.
* May produce external side effects (API updates, notifications, scripts, SSH commands, etc.).
* Can emit structured values consumed by conditions or subsequent actions.
## Failure Modes
* Missing required configuration or invalid parameter values.
* Missing/invalid context variable references from upstream nodes.
* External dependency failures (HTTP errors, auth failures, timeouts, rate limits).
* Payload validation/parsing errors during request or response handling.
## Best Practices
* Prefer small, composable actions over one large action with many responsibilities.
# Text Transform
Source: https://altostrat.io/docs/sdx/en/automation/workflows/nodes/actions/text-transform
Format text and data using custom templates.
Actions do the actual work in a workflow: API calls, transformations, notifications, flow control, and integrations. Use this action when your workflow needs to perform an operation, call an external service, or transform data for downstream nodes.
## When To Use
* Format alert messages consistently across channels.
* Build dynamic JSON payload fragments from context data.
## Configuration Checklist
1. Provide input text/object and transformation template.
2. Render output and validate expected format.
3. Reuse transformed values in notifications or API payloads.
4. Keep templates versioned for repeatability.
## Inputs
* Required `node.data` metadata: `uiId`, `componentId`, and `operation` (for actions that define an operation).
* Action-specific configuration fields from the node editor.
* Upstream context values from triggers or previous nodes (for example `trigger.*` or prior action outputs).
## Outputs
* Adds action result data to the workflow context for downstream nodes.
* May produce external side effects (API updates, notifications, scripts, SSH commands, etc.).
* Can emit structured values consumed by conditions or subsequent actions.
## Failure Modes
* Missing required configuration or invalid parameter values.
* Missing/invalid context variable references from upstream nodes.
* External dependency failures (HTTP errors, auth failures, timeouts, rate limits).
* Payload validation/parsing errors during request or response handling.
## Best Practices
* Prefer small, composable actions over one large action with many responsibilities.
# Trigger Another Workflow
Source: https://altostrat.io/docs/sdx/en/automation/workflows/nodes/actions/trigger-workflow-action
Start another workflow from this one.
Actions do the actual work in a workflow: API calls, transformations, notifications, flow control, and integrations. Use this action when your workflow needs to perform an operation, call an external service, or transform data for downstream nodes.
## When To Use
* Call a shared alerting workflow from many event workflows.
* Chain onboarding workflow stages across separate owners.
## Configuration Checklist
1. Select the target workflow configured with Workflow Trigger.
2. Map and pass required variables to the target workflow.
3. Define behavior for success/failure of the child workflow call.
4. Use this for reusable building-block workflows.
## Inputs
* Required `node.data` metadata: `uiId`, `componentId`, and `operation` (for actions that define an operation).
* Action-specific configuration fields from the node editor.
* Upstream context values from triggers or previous nodes (for example `trigger.*` or prior action outputs).
## Outputs
* Adds action result data to the workflow context for downstream nodes.
* May produce external side effects (API updates, notifications, scripts, SSH commands, etc.).
* Can emit structured values consumed by conditions or subsequent actions.
## Failure Modes
* Missing required configuration or invalid parameter values.
* Missing/invalid context variable references from upstream nodes.
* External dependency failures (HTTP errors, auth failures, timeouts, rate limits).
* Payload validation/parsing errors during request or response handling.
## Best Practices
* Prefer small, composable actions over one large action with many responsibilities.
# Validate Data
Source: https://altostrat.io/docs/sdx/en/automation/workflows/nodes/actions/validate
Validate an object or array using Laravel rules.
Actions do the actual work in a workflow: API calls, transformations, notifications, flow control, and integrations. Use this action when your workflow needs to perform an operation, call an external service, or transform data for downstream nodes.
## When To Use
* Reject malformed API-trigger payloads early.
* Validate mapped data before provisioning actions.
## Configuration Checklist
1. Provide input object/array to validate.
2. Define Laravel-style validation rules.
3. Branch on validation success/failure.
4. Return detailed errors through notifications or API response nodes.
## Inputs
* Required `node.data` metadata: `uiId`, `componentId`, and `operation` (for actions that define an operation).
* Action-specific configuration fields from the node editor.
* Upstream context values from triggers or previous nodes (for example `trigger.*` or prior action outputs).
## Outputs
* Adds action result data to the workflow context for downstream nodes.
* May produce external side effects (API updates, notifications, scripts, SSH commands, etc.).
* Can emit structured values consumed by conditions or subsequent actions.
## Failure Modes
* Missing required configuration or invalid parameter values.
* Missing/invalid context variable references from upstream nodes.
* External dependency failures (HTTP errors, auth failures, timeouts, rate limits).
* Payload validation/parsing errors during request or response handling.
## Best Practices
* Prefer small, composable actions over one large action with many responsibilities.
# Webhook API Call
Source: https://altostrat.io/docs/sdx/en/automation/workflows/nodes/actions/webhook-api-call
Send HTTP requests to external APIs and webhook endpoints.
Actions do the actual work in a workflow: API calls, transformations, notifications, flow control, and integrations. Use this action when your workflow needs to perform an operation, call an external service, or transform data for downstream nodes.
## When To Use
* Push event data to third-party webhook endpoints.
* Read or update records in external REST APIs.
* Trigger downstream automations in other platforms.
## Configuration Checklist
1. Select HTTP method: `GET`, `POST`, `PUT`, `PATCH`, or `DELETE`.
2. Enter a full HTTPS URL (variables supported).
3. Add required headers (static text, workflow variables, or `vlt_...` vault references).
4. For `POST`, `PUT`, or `PATCH`, define a valid JSON request body.
5. Add error handling branches for non-2xx responses and timeouts.
## Field Behavior
* **Method:** Controls request type and whether the body editor is shown.
* **Webhook URL:** Must be a full HTTPS endpoint.
* **Headers:** Dynamic key/value list. Add or remove headers as needed.
* **Request Body (JSON):** Available only for `POST`, `PUT`, and `PATCH`.
* **Body Reset Rule:** If method changes to `GET` or `DELETE`, body is cleared.
## Inputs
* Required `node.data` metadata: `uiId`, `componentId`, and `operation` (for actions that define an operation).
* Action-specific configuration fields from the node editor (`method`, `url`, `headers`, `body`).
* Upstream context values from triggers or previous nodes (for example `trigger.*` or prior action outputs).
## Outputs
* Adds HTTP response data to the workflow context for downstream nodes.
* Can produce external side effects in third-party systems.
* Can emit data used by downstream conditions and actions.
## Failure Modes
* Invalid or non-HTTPS URL.
* Missing/invalid authentication headers.
* External API failures (4xx/5xx responses, DNS/TLS issues, timeouts, rate limits).
* Invalid JSON body for write methods (`POST`, `PUT`, `PATCH`).
## Best Practices
* Store secrets in Vault and reference them via `vlt_...` in headers.
* Keep payloads minimal and validate required fields before sending.
* Use idempotency keys for retry-safe write operations where supported.
* Treat `DELETE` calls as high-risk and add explicit approval logic upstream.
# WireGuard Key Generator
Source: https://altostrat.io/docs/sdx/en/automation/workflows/nodes/actions/wireguard-key-generator
Generate a new key pair or derive a public key.
Actions do the actual work in a workflow: API calls, transformations, notifications, flow control, and integrations. Use this action when your workflow needs to perform an operation, call an external service, or transform data for downstream nodes.
## When To Use
* Generate WireGuard credentials during site onboarding.
* Derive missing public keys from pre-existing private keys.
## Configuration Checklist
1. Choose mode: generate new key pair or derive public key.
2. Provide private key when deriving only.
3. Capture output keys and route securely.
4. Store sensitive values in vault/secret management flows.
## Inputs
* Required `node.data` metadata: `uiId`, `componentId`, and `operation` (for actions that define an operation).
* Action-specific configuration fields from the node editor.
* Upstream context values from triggers or previous nodes (for example `trigger.*` or prior action outputs).
## Outputs
* Adds action result data to the workflow context for downstream nodes.
* May produce external side effects (API updates, notifications, scripts, SSH commands, etc.).
* Can emit structured values consumed by conditions or subsequent actions.
## Failure Modes
* Missing required configuration or invalid parameter values.
* Missing/invalid context variable references from upstream nodes.
* External dependency failures (HTTP errors, auth failures, timeouts, rate limits).
* Payload validation/parsing errors during request or response handling.
## Best Practices
* Do not expose private keys in plain-text notifications or logs.
# Array Condition
Source: https://altostrat.io/docs/sdx/en/automation/workflows/nodes/conditions/array-condition
Check conditions on arrays and their elements.
Conditions evaluate context data and branch execution into true/false paths. This condition evaluates runtime data and routes execution based on whether the configured logic matches.
## When To Use
* Proceed only when affected-sites list is non-empty.
* Branch when required tags are missing from an array.
## Configuration Checklist
1. Set input array path.
2. Choose array operator (contains, empty, length checks, etc.).
3. Configure operator-specific values.
4. Use branches to handle empty vs non-empty outcomes.
## Inputs
* `node.data` metadata (`uiId`, `componentId`) and condition-specific operands/operators.
* Context values from trigger/action outputs to evaluate.
* Optional array/object inputs depending on the condition type.
## Outputs
* Routes execution through `true` and `false` branches.
* Optionally emits evaluation details for debugging (implementation-dependent).
* Determines which downstream path executes next.
## Failure Modes
* Missing operand values or invalid operator selection.
* Data type mismatches (for example string vs number vs date).
* Misconfigured complex expressions (switch/logical group cases).
* Unconnected branches creating dead-end workflow paths.
## Best Practices
* Connect this where branching is required and make sure downstream edges use true/false handles.
* Always wire both branches to avoid dead ends in production runs.
# Boolean Condition
Source: https://altostrat.io/docs/sdx/en/automation/workflows/nodes/conditions/boolean-condition
Check conditions on boolean values.
Conditions evaluate context data and branch execution into true/false paths. This condition evaluates runtime data and routes execution based on whether the configured logic matches.
## When To Use
* Continue only when `is_approved` is true.
* Branch into remediation when `health_ok` is false.
## Configuration Checklist
1. Provide boolean input path.
2. Choose expected boolean state.
3. Route true/false to explicit next actions.
4. Use after validation/check actions that return boolean flags.
## Inputs
* `node.data` metadata (`uiId`, `componentId`) and condition-specific operands/operators.
* Context values from trigger/action outputs to evaluate.
* Optional array/object inputs depending on the condition type.
## Outputs
* Routes execution through `true` and `false` branches.
* Optionally emits evaluation details for debugging (implementation-dependent).
* Determines which downstream path executes next.
## Failure Modes
* Missing operand values or invalid operator selection.
* Data type mismatches (for example string vs number vs date).
* Misconfigured complex expressions (switch/logical group cases).
* Unconnected branches creating dead-end workflow paths.
## Best Practices
* Connect this where branching is required and make sure downstream edges use true/false handles.
* Always wire both branches to avoid dead ends in production runs.
# Date Condition
Source: https://altostrat.io/docs/sdx/en/automation/workflows/nodes/conditions/date-condition
Check conditions on dates and times.
Conditions evaluate context data and branch execution into true/false paths. This condition evaluates runtime data and routes execution based on whether the configured logic matches.
## When To Use
* Trigger renewal reminders before certificate expiry.
* Skip disruptive actions during business hours.
## Configuration Checklist
1. Set date/time input and date comparison operator.
2. Choose reference date (fixed or computed).
3. Branch by maintenance window or expiry logic.
4. Ensure timezone handling matches your policy.
## Inputs
* `node.data` metadata (`uiId`, `componentId`) and condition-specific operands/operators.
* Context values from trigger/action outputs to evaluate.
* Optional array/object inputs depending on the condition type.
## Outputs
* Routes execution through `true` and `false` branches.
* Optionally emits evaluation details for debugging (implementation-dependent).
* Determines which downstream path executes next.
## Failure Modes
* Missing operand values or invalid operator selection.
* Data type mismatches (for example string vs number vs date).
* Misconfigured complex expressions (switch/logical group cases).
* Unconnected branches creating dead-end workflow paths.
## Best Practices
* Connect this where branching is required and make sure downstream edges use true/false handles.
* Always wire both branches to avoid dead ends in production runs.
# Logical Group (AND/OR)
Source: https://altostrat.io/docs/sdx/en/automation/workflows/nodes/conditions/logical-group-condition
Combine multiple conditions with complex AND/OR logic.
Conditions evaluate context data and branch execution into true/false paths. This condition evaluates runtime data and routes execution based on whether the configured logic matches.
## When To Use
* Escalate only when multiple risk signals are all present.
* Allow progression when any one of several prerequisites is met.
## Configuration Checklist
1. Add multiple rules inside one logical group.
2. Choose group logic (`AND` or `OR`).
3. Nest groups if you need more complex expressions.
4. Test with representative payload combinations.
## Inputs
* `node.data` metadata (`uiId`, `componentId`) and condition-specific operands/operators.
* Context values from trigger/action outputs to evaluate.
* Optional array/object inputs depending on the condition type.
## Outputs
* Routes execution through `true` and `false` branches.
* Optionally emits evaluation details for debugging (implementation-dependent).
* Determines which downstream path executes next.
## Failure Modes
* Missing operand values or invalid operator selection.
* Data type mismatches (for example string vs number vs date).
* Misconfigured complex expressions (switch/logical group cases).
* Unconnected branches creating dead-end workflow paths.
## Best Practices
* Connect this where branching is required and make sure downstream edges use true/false handles.
* Always wire both branches to avoid dead ends in production runs.
# Number Condition
Source: https://altostrat.io/docs/sdx/en/automation/workflows/nodes/conditions/number-condition
Check conditions on numbers and numeric values.
Conditions evaluate context data and branch execution into true/false paths. This condition evaluates runtime data and routes execution based on whether the configured logic matches.
## When To Use
* Escalate when packet loss exceeds threshold.
* Branch based on retry count or risk score.
## Configuration Checklist
1. Set numeric input path and operator (`>`, `<`, `==`, etc.).
2. Provide threshold value.
3. Connect true branch for escalation, false for normal flow.
4. Test boundary values to avoid off-by-one behavior.
## Inputs
* `node.data` metadata (`uiId`, `componentId`) and condition-specific operands/operators.
* Context values from trigger/action outputs to evaluate.
* Optional array/object inputs depending on the condition type.
## Outputs
* Routes execution through `true` and `false` branches.
* Optionally emits evaluation details for debugging (implementation-dependent).
* Determines which downstream path executes next.
## Failure Modes
* Missing operand values or invalid operator selection.
* Data type mismatches (for example string vs number vs date).
* Misconfigured complex expressions (switch/logical group cases).
* Unconnected branches creating dead-end workflow paths.
## Best Practices
* Connect this where branching is required and make sure downstream edges use true/false handles.
* Always wire both branches to avoid dead ends in production runs.
# Overview
Source: https://altostrat.io/docs/sdx/en/automation/workflows/nodes/conditions/overview
Condition nodes branch workflow execution by evaluating expressions against the current context.
# Condition Nodes
Condition nodes add decision logic to your workflow. They evaluate runtime values and route execution based on whether the configured rule matches.
## How To Use Condition Nodes
1. Configure comparison inputs and operators.
2. Connect explicit branch handles (`true`/`false` or case handles for switch).
3. Keep branch outcomes intentional (for example escalate vs continue).
4. Test all branch paths before enabling in production.
## Choosing The Right Condition Type
* **String/Number/Date/Boolean** for single-value checks.
* **Array** for list membership and count-based checks.
* **Switch** for multi-path routing based on ordered case matching.
* **Logical Group** for nested AND/OR expression trees.
## Condition Types
Check conditions on strings and text.
[View](./string-condition)
Check conditions on numbers and numeric values.
[View](./number-condition)
Check conditions on dates and times.
[View](./date-condition)
Check conditions on boolean values.
[View](./boolean-condition)
Check conditions on arrays and their elements.
[View](./array-condition)
Create multiple branches based on different conditions.
[View](./switch-condition)
Combine multiple conditions with complex AND/OR logic.
[View](./logical-group-condition)
Check if a resource has specific tags or any tags at all.
[View](./resource-has-tags-condition)
## Condition Design Best Practices
* Align operand types before comparison (string vs number vs date).
* Prefer explicit thresholds and named handles for readability.
* Always connect every branch to avoid dead-end paths.
* Add observability actions on critical false/error branches.
# Resource Has Tags
Source: https://altostrat.io/docs/sdx/en/automation/workflows/nodes/conditions/resource-has-tags-condition
Check if a resource has specific tags or any tags at all.
Conditions evaluate context data and branch execution into true/false paths. This condition evaluates runtime data and routes execution based on whether the configured logic matches.
## When To Use
* Enforce that production resources carry mandatory tags.
* Route to different teams based on ownership tag presence.
## Configuration Checklist
1. Set the target resource identifier.
2. Choose check mode (any tags, key exists, key/value, tag count).
3. Configure mode-specific fields.
4. Branch based on tag policy compliance.
## Inputs
* `node.data` metadata (`uiId`, `componentId`) and condition-specific operands/operators.
* Context values from trigger/action outputs to evaluate.
* Optional array/object inputs depending on the condition type.
## Outputs
* Routes execution through `true` and `false` branches.
* Optionally emits evaluation details for debugging (implementation-dependent).
* Determines which downstream path executes next.
## Failure Modes
* Missing operand values or invalid operator selection.
* Data type mismatches (for example string vs number vs date).
* Misconfigured complex expressions (switch/logical group cases).
* Unconnected branches creating dead-end workflow paths.
## Best Practices
* Connect this where branching is required and make sure downstream edges use true/false handles.
* Always wire both branches to avoid dead ends in production runs.
# String Condition
Source: https://altostrat.io/docs/sdx/en/automation/workflows/nodes/conditions/string-condition
Check conditions on strings and text.
Conditions evaluate context data and branch execution into true/false paths. This condition evaluates runtime data and routes execution based on whether the configured logic matches.
## When To Use
* Route alerts by environment prefix in resource names.
* Skip workflow path when message contains ignore tokens.
## Configuration Checklist
1. Select input string and comparison operator.
2. Set target comparison value or pattern.
3. Wire true/false branches to different follow-up actions.
4. Test with mixed-case and edge input values.
## Inputs
* `node.data` metadata (`uiId`, `componentId`) and condition-specific operands/operators.
* Context values from trigger/action outputs to evaluate.
* Optional array/object inputs depending on the condition type.
## Outputs
* Routes execution through `true` and `false` branches.
* Optionally emits evaluation details for debugging (implementation-dependent).
* Determines which downstream path executes next.
## Failure Modes
* Missing operand values or invalid operator selection.
* Data type mismatches (for example string vs number vs date).
* Misconfigured complex expressions (switch/logical group cases).
* Unconnected branches creating dead-end workflow paths.
## Best Practices
* Connect this where branching is required and make sure downstream edges use true/false handles.
* Always wire both branches to avoid dead ends in production runs.
# Switch
Source: https://altostrat.io/docs/sdx/en/automation/workflows/nodes/conditions/switch-condition
Create multiple branches based on different conditions.
Conditions evaluate context data and branch execution into true/false paths. This condition evaluates runtime data and routes execution based on whether the configured logic matches.
## When To Use
* Route by event type to different remediation paths.
* Choose notification channel based on severity class.
## Configuration Checklist
1. Define a source value to evaluate.
2. Add cases for expected values and a default branch.
3. Connect each case to the corresponding action path.
4. Keep case values mutually exclusive when possible.
## Inputs
* `node.data` metadata (`uiId`, `componentId`) and condition-specific operands/operators.
* Context values from trigger/action outputs to evaluate.
* Optional array/object inputs depending on the condition type.
## Outputs
* Routes execution through `true` and `false` branches.
* Optionally emits evaluation details for debugging (implementation-dependent).
* Determines which downstream path executes next.
## Failure Modes
* Missing operand values or invalid operator selection.
* Data type mismatches (for example string vs number vs date).
* Misconfigured complex expressions (switch/logical group cases).
* Unconnected branches creating dead-end workflow paths.
## Best Practices
* Connect this where branching is required and make sure downstream edges use true/false handles.
* Always wire both branches to avoid dead ends in production runs.
# Loop / Iterator Node
Source: https://altostrat.io/docs/sdx/en/automation/workflows/nodes/loop-iterator/README
Reference for the Loop / Iterator node, including when to use it, how it processes arrays, and practices for reliable per-item execution.
Loop / Iterator is a flow-control node used for per-item processing. It runs a nested workflow for each element in an input array, then returns control to the main workflow path.
## When To Use Loop / Iterator
* You need to perform the same action for each item in a list.
* You need per-item branching logic before continuing the main flow.
* You need to aggregate results from repeated operations.
## Configuration Checklist
1. Map an input path that resolves to an array.
2. Define nested steps that run for each item.
3. Reference item-scoped variables inside nested nodes.
4. Validate behavior with small and large sample arrays.
## Inputs
* Node metadata (`uiId`, `componentId`) for iterator runtime.
* Input array path sourced from trigger or upstream action output.
* Nested sub-workflow steps that execute for each item.
## Outputs
* Executes nested nodes once for each array item.
* Produces per-item outputs inside iterator scope.
* Returns loop completion and resulting context to downstream nodes.
## Failure Modes
* Input path is missing or does not resolve to an array.
* Per-item node failures interrupt or fail loop execution.
* Very large arrays causing long execution time or timeout risk.
* Missing item field references in nested iterator logic.
## Best Practices
* Pre-filter arrays before iteration when possible.
* Keep nested workflows small and single-purpose.
* Capture and log per-item failures for easier troubleshooting.
* Avoid heavy nested loops; prefer pre-filtering arrays first.
# Overview
Source: https://altostrat.io/docs/sdx/en/automation/workflows/nodes/triggers/overview
Reference for workflow trigger nodes, including scheduling, event-driven triggers, and synchronous API-triggered execution.
Trigger nodes start workflow execution. Every workflow must define exactly one trigger that determines when and how a run begins.
## How To Use Trigger Nodes
1. Choose one trigger only for the workflow entry point.
2. Configure trigger-specific parameters (schedule, event source, or API mode).
3. Connect trigger output to the first processing step.
4. Test with representative payloads and verify downstream context values.
## Choosing The Right Trigger
* Use **Scheduled Trigger** for recurring maintenance and reporting.
* Use **API Trigger (Synchronous)** when another system must invoke workflow execution directly.
* Use **SNS-based lifecycle/health triggers** for event-driven automation from platform signals.
* Use **Workflow Trigger** to create reusable callable sub-workflows.
## Trigger Types
Start this workflow via an API call or the UI.
[View](./trigger)
Call this workflow from another workflow.
[View](./workflow-trigger)
Run this workflow on a recurring schedule.
[View](./scheduled-trigger)
Trigger this workflow via API call with synchronous execution.
[View](./sync-request-trigger)
Trigger this workflow when a new site is added.
[View](./site-added)
Trigger this workflow when a site is removed.
[View](./site-removed)
Trigger when a WAN interface from a WAN failover goes offline.
[View](./wan-offline)
Trigger when a WAN interface from a WAN failover experiences packet loss.
[View](./wan-packet-loss)
Trigger when a WAN interface from a WAN failover recovers from packet loss.
[View](./wan-packet-loss-resolved)
Trigger when a WAN interface from a WAN failover comes online.
[View](./wan-online)
Trigger when a site fails to check in with the management system for more than 5 minutes.
[View](./site-offline)
Trigger when a site comes back online and resumes sending heartbeats.
[View](./site-online)
## Registry-Only Trigger Entries
These exist in the automation registry but are excluded from prompt-assistant context (for example, subflow-only nodes).
This trigger is activated when a subflow is called.
[View](./workflow-trigger)
## Trigger Design Best Practices
* Keep trigger configuration minimal and deterministic.
* Validate expected input schema before downstream processing.
* Add guard conditions early when trigger payloads can vary.
* Monitor missed or delayed executions for schedules and external callbacks.
# Scheduled Trigger
Source: https://altostrat.io/docs/sdx/en/automation/workflows/nodes/triggers/scheduled-trigger
Run this workflow on a recurring schedule.
Triggers start workflow execution. A valid workflow should have exactly one trigger node. This trigger is the entry point for a workflow run and should be connected to the first downstream action or condition.
## When To Use
* Nightly inventory synchronization and reporting.
* Weekly policy compliance checks across all sites.
## Configuration Checklist
1. Select schedule type (daily, weekly, monthly, cron, or interval).
2. Set schedule value according to the selected type.
3. Connect the trigger to the workflow path and enable the workflow.
4. Confirm next run behavior from execution history after deployment.
## Inputs
* Trigger-specific configuration from the node form (for example schedule or API trigger settings).
* No upstream node input is required because this is the workflow entrypoint.
## Outputs
* Produces the initial workflow context (the `trigger` payload) for downstream nodes.
* Exposes trigger/event data that subsequent actions and conditions can reference.
* Starts execution flow for connected nodes.
## Failure Modes
* Missing or invalid trigger configuration fields.
* Workflow disabled/inactive, so the trigger does not execute.
* Event payload missing fields expected by downstream nodes.
* Permission/integration issues that prevent trigger invocation.
## Best Practices
* Place this as the first node and connect it to the first action or condition.
* Avoid overlapping schedule windows for long workflows.
# Site Added
Source: https://altostrat.io/docs/sdx/en/automation/workflows/nodes/triggers/site-added
Trigger this workflow when a new site is added.
Triggers start workflow execution. A valid workflow should have exactly one trigger node. This trigger is the entry point for a workflow run and should be connected to the first downstream action or condition.
## When To Use
* Run baseline tagging and policy attachment when a site is created.
* Post a welcome/setup notification to operations channels.
## Configuration Checklist
1. Choose Site Added as the first node.
2. Add actions for bootstrap tasks (tags, policy, initial checks).
3. Add a notification action for audit visibility.
4. Test with a recently created site record.
## Inputs
* Node metadata in `node.data`: `uiId` and `componentId`.
* Trigger-specific configuration from the node form (for example schedule or API trigger settings).
* No upstream node input is required because this is the workflow entrypoint.
## Outputs
* Produces the initial workflow context (the `trigger` payload) for downstream nodes.
* Exposes trigger/event data that subsequent actions and conditions can reference.
* Starts execution flow for connected nodes.
## Failure Modes
* Missing or invalid trigger configuration fields.
* Workflow disabled/inactive, so the trigger does not execute.
* Event payload missing fields expected by downstream nodes.
* Permission/integration issues that prevent trigger invocation.
## Best Practices
* Place this as the first node and connect it to the first action or condition.
* Keep trigger payload shape stable so downstream mappings remain reliable.
# Site Offline
Source: https://altostrat.io/docs/sdx/en/automation/workflows/nodes/triggers/site-offline
Trigger when a site fails to check in with the management system for more than 5 minutes.
Triggers start workflow execution. A valid workflow should have exactly one trigger node. This trigger is the entry point for a workflow run and should be connected to the first downstream action or condition.
## When To Use
* Open high-priority incidents for production sites.
* Send lower-priority notifications for lab/dev sites.
## Configuration Checklist
1. Use Site Offline as the trigger for heartbeat-loss events.
2. Add context enrichment actions (site details, tags, ownership).
3. Route by impact level using conditions.
4. Escalate to on-call channels when criteria are met.
## Inputs
* Node metadata in `node.data`: `uiId` and `componentId`.
* Trigger-specific configuration from the node form (for example schedule or API trigger settings).
* No upstream node input is required because this is the workflow entrypoint.
## Outputs
* Produces the initial workflow context (the `trigger` payload) for downstream nodes.
* Exposes trigger/event data that subsequent actions and conditions can reference.
* Starts execution flow for connected nodes.
## Failure Modes
* Missing or invalid trigger configuration fields.
* Workflow disabled/inactive, so the trigger does not execute.
* Event payload missing fields expected by downstream nodes.
* Permission/integration issues that prevent trigger invocation.
## Best Practices
* Place this as the first node and connect it to the first action or condition.
* Keep trigger payload shape stable so downstream mappings remain reliable.
# Site Online
Source: https://altostrat.io/docs/sdx/en/automation/workflows/nodes/triggers/site-online
Trigger when a site comes back online and resumes sending heartbeats.
Triggers start workflow execution. A valid workflow should have exactly one trigger node. This trigger is the entry point for a workflow run and should be connected to the first downstream action or condition.
## When To Use
* Auto-close outage alerts after site heartbeat recovery.
* Kick off post-recovery validation checks.
## Configuration Checklist
1. Trigger on Site Online to process recovery automation.
2. Fetch site metadata and verify post-recovery state.
3. Resolve or annotate active incidents.
4. Notify stakeholders that service is restored.
## Inputs
* Node metadata in `node.data`: `uiId` and `componentId`.
* Trigger-specific configuration from the node form (for example schedule or API trigger settings).
* No upstream node input is required because this is the workflow entrypoint.
## Outputs
* Produces the initial workflow context (the `trigger` payload) for downstream nodes.
* Exposes trigger/event data that subsequent actions and conditions can reference.
* Starts execution flow for connected nodes.
## Failure Modes
* Missing or invalid trigger configuration fields.
* Workflow disabled/inactive, so the trigger does not execute.
* Event payload missing fields expected by downstream nodes.
* Permission/integration issues that prevent trigger invocation.
## Best Practices
* Place this as the first node and connect it to the first action or condition.
* Keep trigger payload shape stable so downstream mappings remain reliable.
# Site Removed
Source: https://altostrat.io/docs/sdx/en/automation/workflows/nodes/triggers/site-removed
Trigger this workflow when a site is removed.
Triggers start workflow execution. A valid workflow should have exactly one trigger node. This trigger is the entry point for a workflow run and should be connected to the first downstream action or condition.
## When To Use
* Remove stale references in external systems after site deletion.
* Notify billing or support teams that a site was removed.
## Configuration Checklist
1. Use Site Removed as the trigger for decommissioning flows.
2. Add cleanup actions to detach policies and archive metadata.
3. Send notifications to operational stakeholders.
4. Confirm teardown is safe for partially removed resources.
## Inputs
* Node metadata in `node.data`: `uiId` and `componentId`.
* Trigger-specific configuration from the node form (for example schedule or API trigger settings).
* No upstream node input is required because this is the workflow entrypoint.
## Outputs
* Produces the initial workflow context (the `trigger` payload) for downstream nodes.
* Exposes trigger/event data that subsequent actions and conditions can reference.
* Starts execution flow for connected nodes.
## Failure Modes
* Missing or invalid trigger configuration fields.
* Workflow disabled/inactive, so the trigger does not execute.
* Event payload missing fields expected by downstream nodes.
* Permission/integration issues that prevent trigger invocation.
## Best Practices
* Place this as the first node and connect it to the first action or condition.
* Keep trigger payload shape stable so downstream mappings remain reliable.
# API Trigger (Synchronous)
Source: https://altostrat.io/docs/sdx/en/automation/workflows/nodes/triggers/sync-request-trigger
Trigger this workflow via API call with synchronous execution.
Triggers start workflow execution. A valid workflow should have exactly one trigger node. This trigger is the entry point for a workflow run and should be connected to the first downstream action or condition.
## When To Use
* Trigger validation and return immediate pass/fail results.
* Provide an internal API endpoint that wraps multi-step automation.
## Configuration Checklist
1. Use this trigger to expose a synchronous HTTP entry point.
2. Map incoming request data to downstream action inputs.
3. Set a response node or termination path for clear API outcomes.
4. Test from an API client using realistic payloads and timeouts.
## Inputs
* Node metadata in `node.data`: `uiId` and `componentId`.
* Trigger-specific configuration from the node form (for example schedule or API trigger settings).
* No upstream node input is required because this is the workflow entrypoint.
## Outputs
* Produces the initial workflow context (the `trigger` payload) for downstream nodes.
* Exposes trigger/event data that subsequent actions and conditions can reference.
* Starts execution flow for connected nodes.
## Failure Modes
* Missing or invalid trigger configuration fields.
* Workflow disabled/inactive, so the trigger does not execute.
* Event payload missing fields expected by downstream nodes.
* Permission/integration issues that prevent trigger invocation.
## Best Practices
* Place this as the first node and connect it to the first action or condition.
* Keep synchronous flows short to avoid client timeout issues.
# Manual Trigger
Source: https://altostrat.io/docs/sdx/en/automation/workflows/nodes/triggers/trigger
Start this workflow via an API call or the UI.
Triggers start workflow execution. A valid workflow should have exactly one trigger node. This trigger is the entry point for a workflow run and should be connected to the first downstream action or condition.
## When To Use
* Run a remediation workflow during an incident.
* Manually trigger a one-time migration or cleanup flow.
## Configuration Checklist
1. Use Manual Trigger as the entry node for on-demand workflows.
2. Optionally add a human-readable description so operators know when to run it.
3. Connect downstream actions and execute from the workflow Run button.
4. Review execution logs and output payload for each run.
## Inputs
* Node metadata in `node.data`: `uiId` and `componentId`.
* Trigger-specific configuration from the node form (for example schedule or API trigger settings).
* No upstream node input is required because this is the workflow entrypoint.
## Outputs
* Produces the initial workflow context (the `trigger` payload) for downstream nodes.
* Exposes trigger/event data that subsequent actions and conditions can reference.
* Starts execution flow for connected nodes.
## Failure Modes
* Missing or invalid trigger configuration fields.
* Workflow disabled/inactive, so the trigger does not execute.
* Event payload missing fields expected by downstream nodes.
* Permission/integration issues that prevent trigger invocation.
## Best Practices
* Place this as the first node and connect it to the first action or condition.
* Design manual workflows to be idempotent so safe reruns are possible.
# WAN Interface Offline
Source: https://altostrat.io/docs/sdx/en/automation/workflows/nodes/triggers/wan-offline
Trigger when a WAN interface from a WAN failover goes offline.
Triggers start workflow execution. A valid workflow should have exactly one trigger node. This trigger is the entry point for a workflow run and should be connected to the first downstream action or condition.
## When To Use
* Instantly alert NOC when a critical WAN path drops.
* Capture troubleshooting snapshot data at outage start.
## Configuration Checklist
1. Set WAN Interface Offline as the entry node.
2. Add diagnostics actions (Get WAN, API call, SSH) to capture context.
3. Branch by severity and notify the right team.
4. Optionally trigger a fallback workflow for escalation.
## Inputs
* Node metadata in `node.data`: `uiId` and `componentId`.
* Trigger-specific configuration from the node form (for example schedule or API trigger settings).
* No upstream node input is required because this is the workflow entrypoint.
## Outputs
* Produces the initial workflow context (the `trigger` payload) for downstream nodes.
* Exposes trigger/event data that subsequent actions and conditions can reference.
* Starts execution flow for connected nodes.
## Failure Modes
* Missing or invalid trigger configuration fields.
* Workflow disabled/inactive, so the trigger does not execute.
* Event payload missing fields expected by downstream nodes.
* Permission/integration issues that prevent trigger invocation.
## Best Practices
* Place this as the first node and connect it to the first action or condition.
* Keep trigger payload shape stable so downstream mappings remain reliable.
# WAN Interface Online
Source: https://altostrat.io/docs/sdx/en/automation/workflows/nodes/triggers/wan-online
Trigger when a WAN interface from a WAN failover comes online.
Triggers start workflow execution. A valid workflow should have exactly one trigger node. This trigger is the entry point for a workflow run and should be connected to the first downstream action or condition.
## When To Use
* Validate WAN performance immediately after link recovery.
* Resume paused automations after connectivity returns.
## Configuration Checklist
1. Use WAN Interface Online to react to service restoration.
2. Add verification steps (health or latency checks).
3. Branch based on whether post-recovery checks pass.
4. Send success or follow-up troubleshooting notifications.
## Inputs
* Node metadata in `node.data`: `uiId` and `componentId`.
* Trigger-specific configuration from the node form (for example schedule or API trigger settings).
* No upstream node input is required because this is the workflow entrypoint.
## Outputs
* Produces the initial workflow context (the `trigger` payload) for downstream nodes.
* Exposes trigger/event data that subsequent actions and conditions can reference.
* Starts execution flow for connected nodes.
## Failure Modes
* Missing or invalid trigger configuration fields.
* Workflow disabled/inactive, so the trigger does not execute.
* Event payload missing fields expected by downstream nodes.
* Permission/integration issues that prevent trigger invocation.
## Best Practices
* Place this as the first node and connect it to the first action or condition.
* Keep trigger payload shape stable so downstream mappings remain reliable.
# WAN Packet Loss
Source: https://altostrat.io/docs/sdx/en/automation/workflows/nodes/triggers/wan-packet-loss
Trigger when a WAN interface from a WAN failover experiences packet loss.
Triggers start workflow execution. A valid workflow should have exactly one trigger node. This trigger is the entry point for a workflow run and should be connected to the first downstream action or condition.
## When To Use
* Notify network engineers only when packet loss crosses SLA threshold.
* Create incident payloads with tunnel and site identifiers.
## Configuration Checklist
1. Use WAN Packet Loss trigger with a threshold strategy.
2. Add enrichment actions to fetch tunnel/site metadata.
3. Use conditions to suppress low-impact spikes.
4. Send targeted alerts only for sustained degradation.
## Inputs
* Node metadata in `node.data`: `uiId` and `componentId`.
* Trigger-specific configuration from the node form (for example schedule or API trigger settings).
* No upstream node input is required because this is the workflow entrypoint.
## Outputs
* Produces the initial workflow context (the `trigger` payload) for downstream nodes.
* Exposes trigger/event data that subsequent actions and conditions can reference.
* Starts execution flow for connected nodes.
## Failure Modes
* Missing or invalid trigger configuration fields.
* Workflow disabled/inactive, so the trigger does not execute.
* Event payload missing fields expected by downstream nodes.
* Permission/integration issues that prevent trigger invocation.
## Best Practices
* Place this as the first node and connect it to the first action or condition.
* Keep trigger payload shape stable so downstream mappings remain reliable.
# WAN Packet Loss Resolved
Source: https://altostrat.io/docs/sdx/en/automation/workflows/nodes/triggers/wan-packet-loss-resolved
Trigger when a WAN interface from a WAN failover recovers from packet loss.
Triggers start workflow execution. A valid workflow should have exactly one trigger node. This trigger is the entry point for a workflow run and should be connected to the first downstream action or condition.
## When To Use
* Automatically post incident recovery messages.
* Track MTTR by pairing degradation and resolution events.
## Configuration Checklist
1. Place WAN Packet Loss Resolved as the first node.
2. Correlate with active incidents via API call or tag lookup.
3. Send recovery notifications and update status dashboards.
4. Close out escalation workflows if they are still active.
## Inputs
* Node metadata in `node.data`: `uiId` and `componentId`.
* Trigger-specific configuration from the node form (for example schedule or API trigger settings).
* No upstream node input is required because this is the workflow entrypoint.
## Outputs
* Produces the initial workflow context (the `trigger` payload) for downstream nodes.
* Exposes trigger/event data that subsequent actions and conditions can reference.
* Starts execution flow for connected nodes.
## Failure Modes
* Missing or invalid trigger configuration fields.
* Workflow disabled/inactive, so the trigger does not execute.
* Event payload missing fields expected by downstream nodes.
* Permission/integration issues that prevent trigger invocation.
## Best Practices
* Place this as the first node and connect it to the first action or condition.
* Keep trigger payload shape stable so downstream mappings remain reliable.
# Trigger by Another Workflow
Source: https://altostrat.io/docs/sdx/en/automation/workflows/nodes/triggers/workflow-trigger
Call this workflow from another workflow.
Triggers start workflow execution. A valid workflow should have exactly one trigger node. This trigger is the entry point for a workflow run and should be connected to the first downstream action or condition.
## When To Use
* Centralize common notification logic into a shared sub-workflow.
* Build reusable enrichment workflows called from multiple pipelines.
## Configuration Checklist
1. Set this as the trigger for workflows intended to be called by other workflows.
2. Define expected input variables on the called workflow.
3. From another workflow, use Trigger Another Workflow action and pass required values.
4. Validate contract changes whenever either workflow is updated.
## Inputs
* Node metadata in `node.data`: `uiId` and `componentId`.
* Trigger-specific configuration from the node form (for example schedule or API trigger settings).
* No upstream node input is required because this is the workflow entrypoint.
## Outputs
* Produces the initial workflow context (the `trigger` payload) for downstream nodes.
* Exposes trigger/event data that subsequent actions and conditions can reference.
* Starts execution flow for connected nodes.
## Failure Modes
* Missing or invalid trigger configuration fields.
* Workflow disabled/inactive, so the trigger does not execute.
* Event payload missing fields expected by downstream nodes.
* Permission/integration issues that prevent trigger invocation.
## Best Practices
* Place this as the first node and connect it to the first action or condition.
* Keep trigger payload shape stable so downstream mappings remain reliable.
# Workflow Triggers
Source: https://altostrat.io/docs/sdx/en/automation/workflows/triggers-and-webhooks
Choose the right trigger for manual runs, schedules, API requests, site lifecycle events, WAN health events, and workflow chaining.
A trigger decides when a workflow starts and what context enters the graph. Choose the trigger before you design the rest of the workflow; the trigger determines the first variables your actions and conditions can use.
## Prerequisites
Before you configure triggers, make sure you have:
* Permission to create or edit workflows.
* A clear source event for the automation.
* A sample payload or site/WAN event you can test against.
* A workflow authorization if the workflow will call SDX APIs on behalf of a user.
## Trigger Categories
| Category | Triggers | Use when |
| --------------------- | -------------------------------------------------------------------------------------- | ------------------------------------------------------------------------- |
| Operator and schedule | Manual Trigger, Scheduled Trigger | A user starts the workflow, or the workflow runs on a recurring schedule. |
| Workflow composition | Trigger by Another Workflow, Subflow Trigger | You want reusable automation blocks or nested logic. |
| API | API Trigger (Synchronous) | An external request needs a workflow-generated response. |
| Site lifecycle | Site Added, Site Removed | Site onboarding or removal should trigger follow-up work. |
| Site health | Site Offline, Site Online | A site health event should notify, enrich, or remediate. |
| WAN health | WAN Interface Offline, WAN Interface Online, WAN Packet Loss, WAN Packet Loss Resolved | WAN failover or quality events should drive operations. |
## Manual Trigger
Use **Manual Trigger** for operator-controlled workflows. This is the safest starting point for diagnostics, one-off reports, and workflows that need human intent before they run.
Good uses:
* Run a site health check on demand.
* Generate a one-time operational summary.
* Trigger a controlled workflow during an incident.
## Scheduled Trigger
Use **Scheduled Trigger** for recurring work. Scheduled workflows are dispatched by the workflow service and are best for audits, cleanup, reports, and periodic synchronization.
Good uses:
* Daily inventory or metadata checks.
* Weekly report generation.
* Recurring checks for missing tags, offline sites, or policy drift.
## API Trigger (Synchronous)
Use **API Trigger (Synchronous)** when an external system calls a workflow and expects an immediate HTTP response.
Synchronous workflows:
* Must be active before they accept requests.
* Receive request payload, headers, query parameters, method, URL, user agent, and IP address in the initial context.
* Can use JWT claims when an authorizer validates a request.
* Should finish quickly enough for an HTTP caller.
Keep synchronous workflows small and predictable. Long-running device jobs, multi-site loops, or human approval steps are better handled asynchronously.
## Site And WAN Event Triggers
Use platform event triggers when the workflow should react to SDX telemetry:
* **Site Offline:** a site has stopped checking in long enough to be marked offline.
* **Site Online:** a site resumes heartbeats after being offline.
* **WAN Interface Offline:** a WAN failover interface goes offline.
* **WAN Interface Online:** a WAN failover interface comes online.
* **WAN Packet Loss:** a WAN interface experiences packet loss.
* **WAN Packet Loss Resolved:** packet loss recovers.
* **Site Added** and **Site Removed:** the site lifecycle changes.
These triggers are useful because the workflow starts with context from the event. Enrich that context with **Get Site**, **Get WAN Tunnel**, and **Get Resource Tags** before you decide what to do next.
## Workflow Chaining
Use **Trigger by Another Workflow** when one workflow should be callable by another workflow. This keeps common logic centralized.
Good uses:
* A shared notification formatter.
* A reusable tagging routine.
* A common external ticket creation flow.
SDX prevents self-triggering and circular workflow dependencies when workflows are saved.
## Webhook-Style Inbound Requests
The workflow service supports system-generated inbound endpoints for workflows that are configured for external triggering. Treat those endpoints like credentials:
* Store external caller secrets in the vault.
* Validate payloads before taking action.
* Prefer synchronous API workflows only when the caller needs an immediate response.
* Use normal workflow logs to inspect accepted requests and failed nodes.
## Next Step
Add actions, conditions, variables, and tests.
Understand user-delegated workflow access.
# Use The Workflow Vault
Source: https://altostrat.io/docs/sdx/en/automation/workflows/using-the-vault
Store workflow secrets, generated API keys, and signing material without exposing sensitive values in workflow definitions.
The workflow vault stores sensitive values for workflows. Use it for API tokens, passwords, SMTP credentials, SSH material, webhook caller keys, or signing keys used by workflow authorizers.
Vault values are returned as metadata after creation. The secret value itself is not exposed again through the API response.
## Prerequisites
Before you create vault items, make sure you have:
* Permission to manage workflow vault entries.
* A clear owner and rotation plan for each secret.
* The workflow or authorizer that will use the secret.
* An expiry date for credentials that should rotate.
## Create A Secret
Go to **Automation**, open **Workflows**, then open **Vault**.
Add a secret with a name between 3 and 50 characters. Use a name that describes the service and environment.
Paste the secret value. Regular vault secret values can be up to 2,000 characters.
Add an expiry date for credentials that should not live forever.
Save the item, then select it from workflow nodes that support vault-backed credentials.
## Generate A Workflow API Key
For workflow API keys, create a vault item whose name starts with `api-key:`. SDX generates a key with the `wfk_` prefix and shows it once.
Generated API keys cannot be retrieved again. Store the generated key in your organization's approved secret manager immediately after creation.
## Where Vault Items Are Used
Common vault-backed workflow uses include:
* Authorization headers for external HTTP calls.
* SMTP passwords.
* SSH credentials.
* SOAP authentication material.
* Static signing keys for authorizers.
* Workflow API keys for inbound requests.
## Rotation And Deletion
When rotating a credential:
1. Create or update the vault item.
2. Test the workflow node that uses it.
3. Run a controlled workflow test.
4. Watch the first production run after activation.
5. Delete stale vault items only after all workflows have moved to the new secret.
Use environment-specific names such as `prod-ticketing-api-token` or `test-smtp-password`. Generic names make incident response slower.
## Related Pages
Understand user-delegated workflow access.
Use vault-backed secrets safely inside nodes.
# Changelog
Source: https://altostrat.io/docs/sdx/en/changelog/overview
Weekly updates to Altostrat SDX — from launch in October 2024 through active maintenance.
What's shipped in SDX. Entries are dated to the week they shipped, newest first.
**Status update — May 2026.** SDX has moved into active maintenance through **March 2029**. New product work is now focused on [Altostrat Studio](/docs/studio/en/welcome). See the latest entry below for details.
## SDX moves into active maintenance until March 2029
We've stopped building new features for SDX. Roadmap focus has shifted to **[Altostrat Studio](/docs/studio/en/welcome)** — a new agentic AI experience for network operations that builds on top of the SDX platform.
**What this means for you:**
* **SDX continues to run.** All your sites, policies, workflows, dashboards, scheduled scripts, and reports keep working exactly as they are today, with full active maintenance through **March 2029**. Bug fixes, security patches, RouterOS compatibility, and operational stability work continue throughout that window.
* **No new feature work in SDX.** New capability — AI Copilot improvements, new automation primitives, fleet operations features — is now landing in [Altostrat Studio](/docs/studio/en/welcome).
* **Studio sits alongside SDX.** Your existing SDX fleet is fully usable from Studio, and you can adopt Studio at your own pace.
See the [Studio changelog](/docs/studio/en/changelog/overview) for what's shipping in the new product.
## What's new
* **AI Co-pilot diagnostic suite.** New named prompts — **Device Diagnostics**, **Fleet Health Dashboard**, **Investigate Fault**, **Security Audit**, and **Site Security Review** — guide you through systematic diagnostics, root-cause analysis, and security audits across one device or your entire fleet.
* **Conversational automation.** Use the new **Automate Task** prompt to design event-driven workflows and generate RouterOS scripts from plain language.
* **Configuration backup diffs.** Generate a diff between any two Configuration Backups for change management, troubleshooting, and audit trails.
* **Dynamic tag-based SLA report selection.** Build SLA reports with tag rules (e.g. `Location: New York` OR `Customer: Acme Corp`) so new matching sites get included automatically as your network grows.
* **Site grouping in SLA reports.** Group sites by any tag and compute aggregated uptime — Average, Minimum, Maximum, or Redundancy — invaluable for multi-tenant MSP reporting.
* **Recent workflow logs API.** A new `GET /api/workflows/logs/recent` endpoint returns the most recent log entry for each workflow in your organization.
## Improved
* **Rebuilt SLA report scheduling infrastructure.** A new cloud-native scheduler delivers scheduled reports more reliably as your reporting volume grows.
* **Faster API across the board.** Workflow run listings and filtered log queries are dramatically faster, with new database indexes accelerating frequently accessed queries throughout the platform.
* **Transient Access supports CIDR.** Grant temporary access to entire ranges (e.g. `192.168.1.0/24`) instead of single IPs — handy for whole offices or VPN subnets.
* **Smarter device product search.** The MikroTik product catalog now understands complex product codes, identifies individual products inside hardware bundles, and matches against both names and model numbers.
* **More reliable third-party integrations.** Slack, Microsoft Teams, and similar workflow integrations are more robust under load and fail faster with clearer errors when an account's authorization is revoked.
* **Less event noise.** Refined event detection eliminates spurious "device rebooted" events on normal check-ins, so genuine reboots stand out.
## Fixed
* Workflow execution logs now display in chronological order.
* PDF download links for some historical SLA reports are no longer generated incorrectly.
* MikroTik product codes containing `+` are now searchable.
* Older manually created report schedules continue to work without migration.
## What's new
* **CSV export from dashboard panels.** Export the underlying time-series for any panel for offline analysis, audit, or custom visualizations.
* **SLA reports auto-organized by year and month.** Browsing report history is dramatically faster, especially for organizations with thousands of reports.
* New API endpoints list dashboards by folder and reports filtered by year and month.
## Improved
* **AI Co-pilot upgraded to a more capable model**, with faster responses and more accurate suggestions for diagnostics, RouterOS scripts, and workflow automation.
* Dashboards adapt query resolution to the selected time window for faster, more predictable rendering.
* WAN failover priority changes now take effect more quickly and predictably.
* CSV exports use human-readable column headers and include a daily heartbeat point for each metric series.
## Fixed
* Download links for some historical reports were incorrect after the move to hierarchical storage — now resolved.
* Fixed a Managed VPN route calculation edge case that could destabilize client connections under specific topologies.
* Site metadata used in SLA report calculations is now always read from the authoritative source.
## What's new
* **Tags on RADIUS Users, Accounts, Containers, and Groups, plus Account Containers.** A new API endpoint lists every Account Container with a given tag, making fleet segmentation and dynamic policies easier to build.
* **Batched Managed VPN status reporting.** VPN clients can report the state of multiple tunnels in a single API call, cutting overhead and speeding up failover synchronization.
## Improved
* **Faster BGP Threat Mitigation.** The IP blocklist pipeline has been overhauled — threat feed updates apply substantially faster, even for very large lists, shrinking your exposure window.
* Managed VPN tunnels recover from outages faster, automatically clear related alerts on reconnect, and include `workspace_id` in auth responses for monitoring integrations.
## Fixed
* API key creation and rotation are now reliable; an intermittent failure has been resolved.
* Duplicate IPs are no longer added to BGP threat mitigation blocklists.
## What's new
* **Data quotas for user groups.** Define per-group data allowances and apply progressive enforcement (throttle, redirect to a notification portal) once a user exceeds their quota. Maximum quota raised to 10TB.
* **Conditional policy enforcement.** Apply network access policies based on real-time user state, such as whether they're within or over their quota.
* **Remote session termination.** A new API endpoint disconnects active user sessions, useful for incidents, policy violations, or troubleshooting. All admin disconnects are recorded in the Audit Log.
## Improved
* Vulnerability scans can now run as often as weekly, up from a two-week minimum.
* Network access policies from multiple groups can be combined rather than overwritten — for example, routing rules from two groups can be merged for a user in both.
* User and group attribute API responses use a more consistent structure.
## Fixed
* Restored the default upstream DNS resolvers that block malware and adult-content domains.
* Legacy SLA report schedules created before the new engine now load correctly, and the full historical report list is visible again.
## Improved
* **Customizable email notifications.** Workflow and system emails support custom headings, preview text, personalized greetings, and call-to-action buttons.
* **Per-item workflow error reporting.** When a workflow processes multiple items and one fails, you now see exactly which item failed and why, instead of a single rolled-up error.
* Authentication realms can be created and modified without an initial group assignment.
## Fixed
* Email notifications send reliably even when optional metadata fields are missing from the payload.
* Searching for an authentication realm by exact name now consistently returns a result.
## Improved
* **RADIUS authentication log retention extended from 4 to 24 hours**, giving you a full day to investigate auth issues and access patterns.
* User search now indexes RADIUS reply attributes, so you can locate users by VLAN assignment, bandwidth policy, or other configured attributes.
* Custom metric labels accept a wider range of naming conventions and special characters.
## Fixed
* System-managed labels (organization and workspace identifiers) are now always enforced on incoming metric data, keeping multi-tenant data properly isolated.
## Improved
* **Faster DNS Content Filtering deployments.** Pushing policy changes to MikroTik routers is significantly quicker and more reliable, especially for large or complex policies.
* Site health metrics (CPU, memory, uptime) are collected more frequently for fresher visibility into fleet health.
* Upstream DNS resolvers are upgraded for better filtering accuracy and lower query latency.
* Dynamic DNS handling is more tolerant of brief outages, reducing false-positive alerts.
* The platform stats endpoint reports the total number of authentication realms, user details include a structured organizational path, and device details indicate auto-registration status.
* RADIUS log device identifiers are now consistent and parseable.
## Fixed
* User account merges include additional safeguards to maintain data integrity through the cleanup process.
## Improved
* Behind-the-scenes platform stability work — no user-visible changes this week.
## Improved
* Behind-the-scenes platform stability work — no user-visible changes this week.
## Improved
* Behind-the-scenes platform stability work — no user-visible changes this week.
## Improved
* Behind-the-scenes platform stability work — no user-visible changes this week.
## What's new
* **User preferences API.** Store and retrieve per-user settings programmatically, useful for custom dashboards and saved report templates.
## Improved
* Custom metric submissions no longer require an explicit timestamp, and metric names are normalized automatically.
## Fixed
* SLA reports now complete even when a single MikroTik device returns incomplete data during collection.
* Tag-based SLA report schedules with multiple AND/OR rules now select the correct sites.
## What's new
* **Redundancy uptime calculation in SLA reports.** A group of sites counts as "online" if at least one is operational, useful for HA clusters and redundant VPN hubs.
## Improved
* Dashboard graphs render more accurately when zoomed in, with query resolution adapting to the selected time range.
* Vulnerability scans handle large networks and slow links more gracefully.
* Managed VPN tunnel API responses now include a `username` field for monitoring integrations.
* Performance metric collection (CPU, memory, uptime) is more efficient.
## Fixed
* Older SLA report schedules continue working without migration.
* Dashboard graph queries no longer fail at very tight zoom levels.
* In-progress vulnerability scans can now be stopped reliably.
## Improved
* **Dashboards now load in parallel** rather than sequentially, with substantial speed gains across all panels.
* SLA report generation is faster, especially when WAN performance metrics are included.
* Vulnerability scan API responses are noticeably faster thanks to smarter caching.
* **Automatic site geolocation.** New sites have latitude, longitude, and timezone inferred from their public IP.
* WAN throughput in SLA reports is now consistently displayed in Mbps.
* Vulnerability scan control links remain valid for six hours, up from one.
## Fixed
* Vulnerability scan schedules now respect organizational permissions and only show sites in your scope.
* WAN performance metrics (latency, jitter, packet loss) now appear reliably in SLA reports.
## What's new
* **Metrics and dashboard API.** Run custom queries against your time-series data, discover available metrics, and pull dashboard contents programmatically.
* **Documentation search.** A dedicated endpoint searches product docs and API references.
* **Detailed network interface stats.** SDX now collects per-interface traffic, error counters, link status, and uptime.
* **Automatic logo onboarding.** Your organization's logo is detected from your email domain at signup.
## Improved
* Vulnerability scan results include richer host info (manufacturer, standardized service names) and CVE entries now carry publication dates and reference links.
* AI-generated scan summaries handle very large vulnerability lists more reliably.
* Configuration deployments adapt to each device's RouterOS version.
## Fixed
* VPN configuration files and QR codes download reliably again.
* Hosts from different sites are no longer grouped together in scan results.
* Subscriptions with mixed monthly/yearly products can be edited without errors.
## What's new
* **API key management for service accounts.** Create, list, view, rotate, and delete keys for machine-to-machine integrations, with role-based permissions per key.
* **AI Co-pilot diagnostic prompts.** New guided prompts let you investigate active faults, check WAN connectivity, inspect Configuration Backups, and run safe read-only commands on MikroTik devices.
* **Metrics query API.** Run PromQL queries against your monitoring data with custom time ranges and resolution.
* **Multi-currency billing.** Organizations can now operate in their local currency.
## Improved
* The AI Co-pilot is faster and routes requests intelligently between models, distinguishing inline autocomplete from full script generation.
* Recent fault lookups are dramatically faster, speeding up dashboards and monitoring integrations.
* Notification delivery (email, webhooks, Slack/Teams) is more reliable.
## Fixed
* SLA report schedules created in older formats now load correctly.
* Workflows no longer fail when input data contains null bytes or other special characters.
* Notifications now send for sites that lack metadata tags.
* Closed an AI tool cache issue that could have leaked data between sessions.
## What's new
* **Geolocation suggestions for onboarding.** A new API returns appropriate currency and locale based on geographic location, useful for MSPs creating new customer organizations.
* **Subscription status endpoint.** Check programmatically whether an organization is on a paid plan or in trial.
## Improved
* Subscriptions now accept custom metadata for CRM and billing integrations, and can be marked read-only to prevent edits to managed or white-label accounts.
* The invoice preview endpoint handles monthly and yearly intervals more accurately.
* Security Groups and Prefix Lists now auto-recover from transient sync errors, with clearer messages when intervention is needed.
## Fixed
* AI Co-pilot conversations are more resilient to upstream model errors and recover more cleanly when issues occur.
## What's new
* **`@foreach` loops in scheduled scripts.** Generate repetitive RouterOS commands (firewall rules, BGP prefix lists, VLAN assignments) by iterating over a data list from a single template.
* **Australia service region.** Lower latency for Management VPN, API, and platform operations across Asia-Pacific.
## Improved
* API responses, dashboard load times, and serverless cold-start times are noticeably faster across the platform.
* Prefix List changes now consistently trigger updates to the Security Groups that depend on them, with better handling of concurrent admin edits.
* Site reboot detection is more accurate, reducing false positives caused by brief network blips.
* Script templates can now declare variables without using all of them.
## Fixed
* Configuration Backup downloads no longer occasionally produce invalid links.
* Concurrent Security Group edits from different sessions no longer collide.
* Generated firewall rules now produce correct `accept` actions and handle protocols without ports (ICMP, IGMP).
## What's new
* **Security Groups and Prefix Lists.** Define template-based stateful firewall rules and reusable IP/subnet collections, then apply them consistently across your MikroTik fleet. Reference endpoints help you discover supported protocols and services.
* **WAN performance breakdowns in SLA reports.** Sites that breach uptime now include a per-WAN section with uptime percentage, ISP, fault count, and downtime totals.
## Improved
* Site list loading and device check-in processing are noticeably faster.
* The SLA report engine has been rebuilt for more reliable, accurate generation.
* Dynamic DNS updates are more efficient and consistent for sites with frequently changing IPs.
* Security Group rule validation now provides clearer feedback during configuration.
## Fixed
* Tag-based SLA reports no longer show incorrect site counts in their summaries.
* Grouped-site SLA reports now generate reliably.
## What's new
* **PDF SLA reports with downtime root-cause analysis.** Multi-page reports cover uptime, performance against targets, and incident logs categorized by Power, Network, or Device cause.
* **On-demand vulnerability scans against IP lists.** Target specific addresses without scanning entire subnets, ideal for validating patches or checking new devices before rollout.
* **"Resource Has Tags" workflow condition.** Branch automation logic on whether a site or device has specific tag keys, values, or counts.
## Improved
* Breached sites now appear at the top of SLA reports, with clickable links from the executive summary down to incident details.
* Workflow synchronous timeouts increased from 15 to 30 seconds.
* Workflow test triggers now use your input schema as the sample payload.
* Recent Sites loads noticeably faster.
* Dynamic DNS updates for Managed VPN failover propagate more quickly.
## Fixed
* PDF SLA reports now show full site detail for grouped sites, the correct organization logo, and accurate WAN interface data in incident logs.
* A site's "last seen from" IP now consistently reflects the most recent device communication.
## What's new
* **Tag management API.** Create, update, and delete metadata tags programmatically, and query every resource sharing a given key:value pair (for example, all sites with `Region:Europe`).
* **Tag-based SLA reporting.** Define a report once with tag rules (like `Priority:High`); new sites matching the criteria are picked up automatically.
* **Site grouping and aggregated metrics in SLA reports.** Group sites by tag and view average, minimum, or maximum uptime for each group.
* **RADIUS authentication logs in the API.** Pull detailed auth and authorization events for NAS devices and user accounts.
## Improved
* Global search now covers Sites (name, address, IP, MikroTik model), Policies, Managed VPN instances, Notification Groups, Captive Portals, Workflows, and all schedule types, with typo tolerance and relevance scoring.
* SLA report generation is faster, especially for reports spanning many sites with long incident histories.
* Tag values are now case-normalized to prevent accidental duplicates like "new york" vs "New York".
* Workflows hitting Slack, Microsoft Teams, and webhooks now refresh tokens and retry intelligently on failure.
## Fixed
* Sites with multiple matching tags are no longer duplicated across groups in the same SLA report.
* Search indexing for MikroTik hardware details and scheduled script metadata is corrected.
## What's new
* **Custom organization branding.** New API endpoints let you set your organization's display name, logo, and brand colors for a consistent in-product experience.
* **RadSec with automated Certificate Authority.** SDX now generates and manages RadSec client certificates for new devices, simplifying secure RADIUS-over-TLS deployments.
* **EAP support for WPA2/3-Enterprise.** RADIUS now supports EAP for enterprise wireless authentication.
## Improved
* Invoices now show clearer breakdowns for subtotal, taxes, and discounts, with safer handling of payment methods.
* Schedule processing is faster and more reliable for accounts with many schedules.
* WAN tunnel offline detection is more responsive.
## Fixed
* Schedules with Sunday time slots now activate correctly.
* You can remove an organization's profile picture again, and concurrent edits to organization limits no longer overwrite each other.
* Coupon PDF generation no longer fails for very large coupon batches.
## What's new
* **Bulk CSV import for Users, Groups, and NAS devices.** Upload a CSV, preview the contents, do a dry run, and download a failure log if rows don't import. Handles files with 300,000+ rows and supports tags and custom RADIUS attributes.
* **Metered usage history API.** Pull aggregated usage for billing event types (like `sms_messages`) over any date range, grouped by day or hour.
* **MS-CHAPv2 authentication.** RADIUS now accepts MS-CHAPv2 alongside CHAP.
## Improved
* The workflow **Array Filter** node now supports nested AND/OR logic and can either include or exclude matching items.
* SSH workflow action errors are more descriptive, making connection issues easier to diagnose.
* Incident end times in PDF reports now respect the report's configured timezone.
## Fixed
* A workflow validation bug that could prevent one workflow from triggering another is resolved.
* The **Iterator** node now passes data correctly when it triggers a downstream workflow.
* NAS log timestamps are accurate again.
## What's new
* **SSH and SMTP workflow nodes.** Workflows can now run shell commands on remote servers (with key or password auth from Vault) and send email through any SMTP server, with attachments and custom headers.
* **CHAP authentication for RADIUS.** RADIUS now accepts CHAP, broadening compatibility with legacy network gear.
* **Transient Access auditing.** Each Transient Access session now records which user created it, visible in session details via the API.
* **Reseller directory API.** A new endpoint returns paginated MikroTik reseller listings with location, contact details, and country filters.
## Improved
* Notification groups now support up to 800 sites, up from 200.
* Listing Transient Access sessions now includes expired sessions for a full historical record.
* API error messages for auth and SMTP actions are more descriptive, and `401 Unauthorized` responses are standardized.
* Cursor-based pagination is now available on key list endpoints.
## Fixed
* Deleting a user now reliably removes all associated group memberships and related data.
* Group membership listings no longer return slow or incomplete results.
## What's new
* **Fault Management API.** Programmatically create, update, comment on, and delete faults for tighter integration with your monitoring and response workflows.
## Improved
* **DNS policy lists tripled.** Custom DNS allow/blocklists now hold up to 150 domains, up from 50.
* **Fewer false-positive WAN offline alerts.** A WAN tunnel must now be unreachable for 5 minutes (up from 3) before triggering an offline alert.
* **Wider device support.** Lowered the minimum RouterOS to 6.47 (ROS6) and 7.8 (ROS7).
* Faster queries for recent and unresolved faults; site `created_at` timestamps are now ISO 8601.
* Stricter permission checks on API endpoints — unauthorized calls now correctly return 403.
## Fixed
* Resolved an issue where alert notifications were not being delivered to channels like Slack.
* Fault Management API now accepts fault IDs with or without the `flt_` prefix, and always includes the `comments` field in responses.
## What's new
* **Real-time custom dashboards.** Build interactive dashboards with live widgets for your MikroTik fleet, with widgets that can trigger workflows — built for NOC displays and proactive monitoring.
* **MSP organization branding.** Customize display names, colors, and login hints, and use new public endpoints to build fully white-labeled login experiences for clients.
* **Expanded workflow actions.** New actions for filtering arrays, transforming dates, validating structures, generating random strings/passwords/UUIDs, generating WireGuard keys, and looking up IPv4 details — all directly inside a workflow.
* **Multi-button forms with conditional fields.** Approval workflows can now have multiple action buttons ("Approve", "Reject") that route down different branches, with fields that show or hide based on user input.
* **Fault data CSV export.** Export historical fault data for offline analysis, compliance reporting, and trend analysis.
## Improved
* **Fault history extended to 14 months.** Up from 90 days, with fault filtering by type (site, device, service) and faster queries.
* Better Captive Portal client connectivity detection (including Windows OS) so guests reliably see the portal.
* Hardened deletion process for sites and Managed VPN instances to prevent orphaned resources.
## Fixed
* Site-specific details and links are now included in alert notifications.
* Cached site data no longer persists after a site is deleted.
* Date range filters now apply correctly when querying site-specific faults.
## What's new
* **Workflows as serverless APIs.** Turn a workflow into a real-time HTTP endpoint that accepts requests and returns responses — ideal for ticketing system, monitoring, and external platform integrations. Secure each endpoint with API keys or a custom JWT authorizer.
* **Interactive forms and approval gates.** Build multi-step workflows with user approval steps for change management, provisioning, and onboarding.
* **Workflow run resume.** Restart a failed workflow run from any successful checkpoint instead of starting over.
* **Multi-channel Notification API.** Send email and WhatsApp notifications to addresses, phone numbers, or tagged user groups, including emails with attachments.
* **Reusable script templates.** Build a central library of MikroTik RouterOS scripts you can reuse across deployments, kept private to your organization or shared publicly.
* **SOAP request action.** Workflows can now call SOAP endpoints for legacy network management and billing integrations.
## Improved
* Liquid templating is now available across all workflow nodes for richer conditional logic and data transformation.
* Granular workflow error handling lets you treat expected errors (like a 404) differently from critical ones.
* Faster network interface graphs and device statistics queries over long time ranges.
* Backend event processing now triggers workflows nearly instantaneously.
## Fixed
* Corrected timestamp display on aggregated performance graphs.
## What's new
* **30 days of fault history and historical device stats.** Pull fault history and CPU, memory, and uptime data over arbitrary date ranges — useful for capacity planning, SLA reporting, and identifying recurring issues.
* **`wan.packet_loss_started` and `wan.packet_loss_resolved` workflow events.** Trigger custom automations on WAN quality changes, like failing over to a backup link or opening a ticket.
* **Fleet-wide tunnel inventory API.** Retrieve all configured WAN tunnels across your network in a single call for compliance audits and configuration review.
## Improved
* Dashboard charts render significantly faster, especially over longer time ranges.
* More accurate WAN tunnel status detection, with packet loss notifications now including the specific tunnel ID for faster troubleshooting.
## Fixed
* Corrected timestamps in aggregated chart data.
## What's new
* **Workflow chaining.** Trigger workflows from other workflows to build modular, reusable automations — for example, a "Provision VPN" workflow called by a higher-level onboarding flow. A new API endpoint lists triggerable workflows.
* **Real-time site and tunnel events.** Site online/offline and WAN tunnel online/offline now fire as workflow triggers, so you can automate incident response the moment status changes.
* **Proactive WAN packet loss alerts.** SDX now detects when packet loss on a WAN tunnel exceeds critical thresholds and notifies you immediately.
## Improved
* Dependency protection blocks deletion of workflows referenced by other workflows, and circular dependency detection prevents infinite loops.
* Workflow test editor now ships with sample event data for faster authoring of event-driven flows.
* Tunnel API responses now include external IP addresses for each WAN link.
## Fixed
* Resolved a critical issue that prevented event-triggered workflows from executing.
* Fixed packet loss alert delivery configuration and notification delays for newly created sites.
* Deleted sites no longer linger in site lists.
## What's new
* **Scheduled Script email notifications.** Get email alerts when a scheduled script needs authorization, starts, or finishes — important for audit trails.
* **Workflow date filters.** New `carbon_date` and `carbon_condition` Liquid filters let workflows parse, format, and compare dates with helpers like `is_today` and `within_7_days`.
* **Human-readable workflow schedules.** Scheduled workflows now show their next run in plain language ("in 5 minutes", "tomorrow").
## Improved
* Email notifications now retry on temporary failures, dramatically improving delivery reliability for alerts and compliance traffic.
* Scheduled script alerts are now sent over both email and your primary notification channel for redundancy.
* Wider date format support and more accurate next-run calculation in workflow schedule triggers.
## Fixed
* Scheduled script authorization emails now use the correct URLs and templates and deliver reliably.
* Fixed inaccurate workflow run duration reporting and resolved special-character handling in workflow JSON payloads.
## What's new
* **More email notifications.** Get notified for vulnerability scan start/completion, scheduled SLA report delivery, individual WAN interface up/down events, Captive Portal coupon generation (with PDF attached), and Managed VPN credential creation.
* **Bulk Configuration Backup API.** Retrieve the latest backup for up to 50 sites in a single `POST /api/backups/latest` call — much faster for compliance and DR validation.
## Improved
* Single IP addresses entered in Firewall Trusted Networks are now auto-converted to CIDR (`10.0.0.1` becomes `10.0.0.1/32`).
* Key metrics endpoints accept GET as well as POST for conventional retrieval.
## Fixed
* Pagination status now reports correctly on filtered API responses.
* Corrected the Captive Portal coupon notification email subject and template.
* Improved clarity of the "WAN Interface Down" alert subject line.
## What's new
* **Advanced audit log filtering.** Filter audit logs by HTTP status category, method, or individual user, and see enriched entries with display names and emails — useful for security investigations and compliance audits.
* **Proactive billing checks.** SDX now validates subscription health before service access and surfaces guidance to resolve issues before they cause interruptions.
## Improved
* **Captive Portal sessions up to 7 days.** Maximum session duration extended from 24 hours to 7 days for hotels, conferences, and long-term guest access.
* **95% faster audit searches.** Filtered audit log queries now return near-instantly.
* Dashboard throughput, data-transfer, and MAC vendor endpoints now support both GET and POST.
## Fixed
* Device re-registration no longer consumes an extra license seat.
* Corrected Managed VPN peer seat counting for accurate billing.
* Captive Portal custom assets (logos, icons) now load reliably, and portal preview URLs use the production domain.
* Fixed organization profile picture clearing and audit log date-range accuracy.
## What's new
* **Usage reporting and exports.** Export per-organization resource consumption to CSV or PDF for client billing, capacity planning, and compliance.
* **Flexible resource limits.** Set "unlimited," "deny" (zero), or a specific number per organization, with SSO now tracked as a manageable resource alongside devices, VPNs, and sites.
* **Automatic site resource accounting.** SDX now verifies seat availability before adopting a device and releases resources when a site is deleted.
## Improved
* New organizations created via the API automatically receive default user roles and authentication connections.
* More accurate user-count tracking for Managed VPN instances against subscription limits.
* Comprehensive checks prevent setting resource configurations that exceed subscription, parent, or current usage limits.
## Fixed
* Corrected user seat increment/decrement logic for accurate subscription tracking.
* Available capacity calculations now reflect organization hierarchy correctly.
## What's new
* **Expanded payment methods.** Billing now supports US ACH, AU BECS, SEPA Direct Debit, PayPal, and Link — important for international MSPs.
* **Detailed invoice previews.** Previews now show line items, taxes, and discounts so you can reconcile against client billing before charges land.
* **Organization resource usage API.** Retrieve current usage and configured limits per organization for capacity planning and quota management.
* **Organization branding.** Upload custom logos and profile pictures for white-label MSP portals.
## Improved
* Standardized JSON shape and pagination across list endpoints.
* You can no longer accidentally delete the only payment method on a billing account, or lock yourself out by demoting the sole workspace owner.
* Billing account creation auto-fills the address from IP geolocation when you don't provide one.
## Fixed
* Resource limit enforcement now correctly respects subscription, organization, and parent-org limits when adding resources.
* `trialing` and `past_due` subscriptions are now included in total quantity calculations.
* Invoice endpoints consistently return arrays for line items.
## What's new
* **Hierarchical organizations.** Build nested parent/child organization structures with per-org limits on user seats, sites, and storage — ideal for MSPs with multiple clients under one account.
* **Workspace member roles over the API.** Assign and modify Owner, Admin, and Viewer roles programmatically, backed by consistent role-based authorization across resources.
* **Bulk MAC vendor lookup.** Look up manufacturer info for up to 50 MAC addresses in a single request — handy for network discovery and inventory.
## Improved
* Stronger input validation across Workspaces, Organizations, and billing accounts gives clearer errors and more predictable behavior.
* Transient port API responses now include the management server IP.
## Fixed
* Corrected Managed VPN peer seat checks so subscription limits apply accurately.
* Fixed organization hierarchy data parsing.
## What's new
* **Reports go to notification groups.** Scheduled SLA and other reports can now be delivered to notification groups instead of individual recipients, simplifying multi-stakeholder distribution for MSPs.
## Improved
* Faster site validation when creating or updating scheduled scripts.
## What's new
* **Aggregated network performance APIs.** New endpoints return fleet-wide throughput (bps) and total data transferred (bytes) across sites or site groups, with flexible time windows — built for capacity planning, NOC dashboards, and bandwidth billing.
## Improved
* All API responses (reports, security scans, access, faults, Configuration Backups) now use ISO 8601 timestamps for easier integration.
* Site serial numbers are now included in minimal API responses.
* Configuration Backup listings now include a `created_at` field.
## Fixed
* The Faults API now correctly returns `null` for unresolved faults instead of erroring on a missing resolution timestamp.
## Improved
* **Faster interface graphs.** Network interface graphs and reports load significantly faster — useful for NOC displays and live monitoring.
* Quicker initial config for newly provisioned MikroTik devices.
* More responsive notification group create/update/detail views.
* Adjusted the daily Configuration Backup schedule for better resource use.
## Fixed
* Managed VPN client config files and QR code downloads now generate correctly.
* Corrected CORS rules so front-end apps can reach the API cleanly.
* Fixed broken deployment management links in device setup scripts.
## Improved
* **Faster device provisioning.** Initial setup for new and reset MikroTik devices is now noticeably quicker.
* Site offline/online and WAN tunnel alerts now include explicit UTC timestamps, removing timezone ambiguity for distributed teams.
* Tighter validation of subscription limits during device provisioning prevents accidental seat overages.
## Fixed
* Deployment management links after device adoption now correctly open the device overview page.
* Notification delivery no longer errors out when a recipient is invalid.
## What's new
* **WhatsApp notifications.** You can now send notification group alerts over WhatsApp — ideal for on-call engineers who need mobile-first delivery. WhatsApp replaces SMS for new and updated groups.
## Improved
* Notification group recipients are now validated in real time against the user directory, so only active users appear.
* Creating or updating a group now requires explicitly choosing the recipient and channel, preventing silent misconfigurations.
* Faster, more reliable site provisioning when checking seat availability against billing.
## Fixed
* Resolved false-positive "invalid recipient" errors when configuring notification groups.
## What's new
* **Team management.** Add, invite, and remove team members, and define custom roles with specific permissions — built for MSPs managing technician access across multiple clients.
* **Self-service MFA.** Users can enable MFA, regenerate recovery codes, or remove MFA from their own account.
* **Login with organization context.** Login now remembers your organization and supports return URLs for faster multi-tenant access.
## Improved
* Notification groups now validate recipients against the active user list, so alerts no longer fail because of stale members.
* Team listings are now paginated and include richer user details over the API.
## Fixed
* Corrected MFA status and login permission flags shown in user details.
## What's new
* **Auth0 for Captive Portals.** You can now configure Auth0 as an OAuth2 identity provider on Captive Portal instances, useful for hotels, universities, and enterprises with existing Auth0 SSO.
## Improved
* Behind-the-scenes platform updates across reporting, metrics, and admin services for better stability and performance.
## Improved
* **Faster vulnerability views by device.** Significantly quicker performance when reviewing security findings across multiple scans and the full fleet.
* **Better AI mitigation guidance.** An updated model delivers more relevant remediation steps for identified vulnerabilities.
* **Smoother API integrations.** Improved CORS handling for clients calling the API from diverse environments.
## Fixed
* Vulnerabilities are grouped correctly across multiple scans and hosts.
* API-initiated Configuration Backups no longer fail, so automated backup workflows run reliably.
## What's new
* **Bulk vulnerability scan API.** Pull vulnerability data for many MikroTik devices in a single request, streamlining security monitoring across large fleets.
## Improved
* **Faster traffic reports.** DNS Content Filtering and BGP Threat Mitigation traffic reports load noticeably faster, now showing the last 24 hours for quicker incident review.
* **Consistent timestamps in vulnerability responses** to simplify parsing in security automation.
## Fixed
* Date formatting in vulnerability API responses is now consistent.
## Improved
* **Login redirect from the root URL.** The main web URL now sends you straight to the login page.
* **Longer background task windows.** Increased execution time for background jobs prevents long-running operations from being cut short.
## Fixed
* Transient access and port forwards behave consistently under edge-case conditions.
* BGP Threat Mitigation blocklist updates apply correctly so active threats are filtered as expected.
## Improved
* **More reliable reports and notifications.** SLA report data collection retries on failure and email delivery is rate-limited for steadier throughput.
* **Foundational platform upgrades.** Core framework and language updates lay groundwork for future features and improve baseline performance.
## Fixed
* Device heartbeat processing now reports accurate online/offline status for monitoring and alerting.
## Improved
* **Cascading cleanup on deletion.** Deleting a user removes them from notification groups and Managed VPN configurations; deleting a site cleans up Captive Portal config, scan schedules, and device configuration in one pass.
* **Faster SLA report generation.** Multi-site reports build more quickly and reliably.
* **Vulnerability scan rate limits.** API-triggered scans are capped at one per 24 hours per schedule, and recurring scheduled scans require a minimum two-week interval — preventing accidental over-scanning.
## Fixed
* SLA report PDFs now show the correct site incident downtime cause.
* Site API credential retrieval no longer fails intermittently.
## What's new
* **Fleet-wide vulnerability view.** A new endpoint returns every device with vulnerabilities across recent scans, plus summary stats — useful for executive dashboards and fleet-wide risk assessment.
## Improved
* **Faster Managed VPN credential fetching** and higher API request limits to support heavier integration use.
* **Better AI mitigation formatting.** Remediation guidance is more readable and actionable.
* **More reliable DNS Content Filtering.** Category-based filtering processes more consistently.
## What's new
* **Per-device vulnerability status.** Mark individual CVEs on a device as Accepted or Mitigated to track remediation progress and document risk decisions for audits.
* **AI remediation guidance.** Pull AI-generated mitigation steps for a specific vulnerability to accelerate response.
* **Compliance framework mapping.** Vulnerability detail now lists relevant frameworks (PCI-DSS, HIPAA, GDPR, SOC2, ISO 27001, NIST) for compliance reporting.
* **Shareable Captive Portal coupon links.** Generate a unique link for a valid coupon to hand out without giving the recipient API access.
## Improved
* **Severity filtering on device vulnerabilities.** Filter by CVSS score so the most critical issues are easy to focus on.
* **Cleaner vulnerability API responses.** Findings are grouped by CVE ID, with consistent ISO 8601 timestamps across the API.
## What's new
* **Captive Portal coupon system.** Create coupon codes with custom rules, schedule recurring bulk generation, generate batches on demand for events, track usage, share secure temporary links, and print physical coupon sheets as PDFs.
* **Dynamic DNS for Managed VPN tunnels.** Each tunnel gets a stable hostname that automatically follows public IP changes, simplifying remote access.
* **Richer outage alert emails.** Network outage and coupon batch emails now include more context and direct download links.
## Improved
* **Consistent coupon sessions.** Coupon-based access honors the portal's configured session duration.
* **Reliable bulk coupon generation.** Large scheduled batches generate cleanly even at high volume.
## Fixed
* Expired coupons no longer appear in active coupon API responses.
* Coupon batches retain their schedule association and PDF download permissions.
## What's new
* **Captive Portal session API.** Programmatically list and filter active guest sessions to power custom reporting, billing integrations, and automated session management.
* **Targeted vulnerability scans.** Trigger an on-demand scan against one or more IPs inside a site, without running a full network scan.
* **Historical device vulnerability lookup.** Query past findings for a device by MAC address to track remediation progress over time.
## Improved
* **Better setup validation.** Captive Portal and Managed VPN setup return more precise feedback when configuration is invalid.
* **Smoother guest authentication flow.** Network checks and authentication redirects are more reliable.
## Fixed
* Captive Portal API no longer forces immediate site association during instance creation.
* ARP data is properly cleaned up when Managed VPN tunnels are decommissioned.
## What's new
* **ARP group API.** Create, view, update, and delete ARP groups inside a site to organize network devices by department, location, or tenant.
## Improved
* **More reliable data collection.** Better handling of timeouts and intermittent connectivity for SNMP and WAN tunnel performance stats means more complete monitoring data.
* **Vulnerability scan watchdog.** Stuck scans are now detected and terminated automatically, keeping the scanning service healthy.
* **Sorted scan history.** Vulnerability scan lists default to most-recent-first.
* **Reliable Dynamic DNS.** Hostname updates hold up better when device public IPs change.
## Fixed
* You can now remove the final site from a Captive Portal instance.
* ARP entries clean up correctly when sites are deleted.
## Improved
* **Much faster SLA report loading.** Significant performance gains on report libraries with consistent sorting and pagination.
* **Reliable firewall updates on Managed VPN.** Adding or removing tunnels now updates filtering rules correctly without manual cleanup.
* **Clearer connection errors.** Better error messages when fetching details for offline tunnels.
## Fixed
* Initial setup now completes reliably on freshly connected MikroTik devices.
* Configuration Backup uploads no longer fail intermittently.
## Improved
* **SLA reports default to newest-first.** Fresh client reports are at the top of the list, and the list itself loads faster.
* **More accurate DNS Content Filtering.** Specific domain rules inside broader categories now apply exactly as configured.
## Fixed
* SLA report generation no longer fails under specific data conditions.
## Improved
* **Faster site and report lists.** Caching improvements make site lists and SLA report schedules noticeably quicker, especially when you manage dozens of sites.
* **Accurate backup timestamps.** Configuration Backup lists now show real creation time with reliable sorting.
* **License enforcement on adoption.** Adopting sites via runbook now respects your seat limits, preventing accidental overages.
## Fixed
* Site provisioning reliably finishes critical setup steps, including network address assignment and firewall policy application.
* Recent sites list refreshes properly for all users.
* Subnet detection in Configuration Backups no longer includes internal management lines.
## Improved
* **More resilient data collection.** Background metrics keep flowing even when sites have intermittent connectivity.
* **Faster scan feedback.** Stuck vulnerability scans are detected and surfaced more quickly.
* **More reliable Managed VPN provisioning.** New tunnels come up cleanly on first attempt.
## Fixed
* Site provisioning now reliably completes the automatic setup steps for new MikroTik devices.
* WAN ping statistics use the correct timezone and render data points correctly on graphs.
* Manual vulnerability scan termination works again, and OpenVPN peer connection issues on Managed VPN are resolved.
* Configuration Backup file dates respect timezone correctly.
## Improved
* **Faster vulnerability scans.** Per-site scans start more quickly and scan results come back more reliably.
* **Cleaner email notifications.** Refreshed branding and consistent links across alert and report emails.
* **Richer site API.** Site responses now include device architecture and hardware hash for inventory work, and exclude internal management subnets from subnet lists.
## Fixed
* Shared SLA report links are accessible again for stakeholders.
* Managed VPN no longer assigns duplicate tunnel IPs during site setup.
* Vulnerability scan completion emails point to the correct report.
## Breaking change
* **SLA report schedule API.** `GET /sla/schedules/{id}` no longer returns `recipients`; use `notification_group` instead.
## Improved
* **Faster site data.** Site lists and details load noticeably quicker across the dashboard and API.
* **Smoother device adoption.** Adoption now avoids configuration conflicts on MikroTik devices that already have scheduled tasks.
* **Sorted Configuration Backups.** Backup lists default to newest-first, so the most recent recovery point is always at the top.
## Fixed
* Configuration Backup timestamps now show the actual creation time instead of the filesystem modification time.
* Real-time notifications no longer go to inactive recipients.
## What's new
* **Automated daily Configuration Backups.** Every online site now gets a daily backup, giving you regular recovery points for disaster recovery and compliance.
* **Device health monitoring.** Track online/offline status, CPU, memory, disk, and uptime in real time across your fleet.
* **Automatic site geo-location.** Sites pick up their address and timezone from the device IP, so you don't have to enter them by hand.
* **CVE notification topic.** Subscribe teams to vulnerability scan results through the standard notification groups.
* **Auto-expiring transient access.** Temporary WinBox/SSH credentials and port forwards now expire automatically, so forgotten access doesn't linger.
## Fixed
* SLA report generation no longer fails on scheduled runs and report schedules save reliably.
* Configuration Backup uploads land at the correct path, and notification group settings persist correctly.
## What's new
* **Live device status across the fleet.** Online/offline tracking for every MikroTik device is now active across SDX, giving you instant fleet visibility.
* **Performance metrics activated.** CPU, memory, uptime, and disk metrics now flow into SDX with historical trending for capacity and reliability planning.
## Improved
* **Smoother device adoption.** The bootstrap flow and initial connectivity verification are more reliable.
* Transient WinBox/SSH credentials and port forwards now apply consistently across management servers and respect their expiration.
* Configuration Backup uploads land more reliably in secure storage.
## Fixed
* Resolved metric ingestion and processing issues that were causing gaps in performance data.
* Backup retrieval no longer fails on rare site-permission edge cases.
## Improved
* Behind-the-scenes platform stability work, including more reliable Static IP / RADIUS credential synchronization — no user-visible changes this week.
## Improved
* **Faster Managed VPN provisioning.** Server provisioning and teardown are quicker and more reliable.
* **More efficient DNS and BGP filter generation.** Configuration generation for DNS Content Filtering and BGP Threat Mitigation rules is more consistent.
## What's new
* **Aggregated WAN statistics API.** A new endpoint returns latency, packet loss, and jitter aggregated across multiple WAN tunnels for consolidated network performance views.
* **BGP and DNS analytics.** Initial reporting on BGP traffic (top sources, top ports, blocklist hits) and DNS queries (top applications, categories, sources).
## Improved
* WAN graphs now visualize collection gaps clearly — periods with missing data over 5 minutes show as 100% packet loss rather than appearing as silent dropouts.
## Improved
* Behind-the-scenes platform stability work across authentication, device management, monitoring, and notifications — no user-visible changes this week.
## Improved
* **Vulnerability scan reporting.** The full lifecycle is now in production — scans process to completion and produce JSON and PDF reports with notifications on delivery.
* **SLA reports as PDF and JSON.** End-to-end report generation pulls from fault tracking, metrics, and schedules with notifications when reports are ready.
## What's new
* **Vulnerability scanning.** SDX now runs scheduled or on-demand CVE scans against your sites, generates PDF reports, and notifies you when scans complete. Findings are enriched with MAC vendor data, service names, and CVE references from Vulners and MITRE.
## What's new
* **Notification groups.** Build flexible groups linking users, sites, and event topics, with per-recipient channel preferences (email, WhatsApp).
* **Scheduled SLA reports.** Schedule daily, weekly, or monthly SLA reports delivered as PDF and JSON.
* **MikroTik product catalog.** Hardware specs and compatibility data are now exposed via API.
## Fixed
* Organization site counts correctly reflect zero when all team sites are removed.
## What's new
* **Captive Portal.** Full guest-network control with OAuth2 sign-in, coupon-based access, instance management, and Walled Garden rules.
* **DNS Content Filtering.** Apply DNS-level content filtering to a site through a managed policy.
* **BGP Threat Mitigation.** Block known-bad IPs at the routing layer with BGP blackholing.
* **Static IP Management.** Allocate static IPs to subscribers with RADIUS auth and PTR records.
* **Developer API.** Programmatic platform control with authenticated command execution and asynchronous job dispatch.
## Improved
* Stricter Walled Garden validation ensures IPs and ranges fall within their network instance subnet.
## What's new
* **Network Inventory.** SDX now tracks devices on each site's network from the router's ARP, DHCP, and CDP tables, giving you fleet-wide device visibility without extra agents.
* **Scheduled Scripts.** A scripting framework with variable injection runs RouterOS commands on a schedule for repeat maintenance and config drift correction.
* **Configuration Backup.** Daily MikroTik backups land in secure cloud storage with API access for retrieval.
* **Slack via webhooks.** Forward platform notifications to Slack to keep your team in the loop.
## What's new
* **Altostrat SDX is live.** The platform launches with end-to-end MikroTik fleet management — site adoption, heartbeat monitoring, queued device jobs, and live management access through outbound tunnels.
* **Identity, organizations, and billing.** Sign-in with users, organizations, and teams; API tokens; and a billing account, all under a single identity layer.
* **Notifications.** Multi-channel alert delivery over email, WhatsApp, and real-time websockets so on-call engineers see incidents the moment they happen.
* **Networking foundations.** Managed VPN (WireGuard and OpenVPN), WAN failover, and Static IP with RADIUS-integrated allocation.
* **Monitoring foundations.** SNMP, ping, and syslog collection with query APIs, plus centralized log search and fault tracking.
# Configure Captive Portals
Source: https://altostrat.io/docs/sdx/en/connectivity/captive-portals/configuration
Create captive portal auth integrations, instances, site assignments, and coupon workflows.
This guide covers the standard captive portal setup path: configure authentication, create an instance, apply it to a site subnet, and operate sessions or coupons.
## Prerequisites
Before you begin, make sure you have:
* Permission to manage captive portal instances.
* An adopted SDX site with the guest subnet you want to control.
* For OAuth2, an application created in your identity provider.
* For coupon access, a process for generating and distributing codes.
* A session lifetime policy for guests.
## Create An OAuth2 Auth Integration
Skip this section if your portal will use coupons only.
In the portal, go to **Captive Portal**, then open **Identity Providers** or **Auth Integrations**.
Add an integration and choose the provider type: Google, GitHub, or Azure.
Provide the OAuth2 client ID and client secret. For Azure, also provide the tenant value.
Save the integration, then test the sign-in flow before attaching it to a production portal instance.
OAuth2 portals must allow unauthenticated users to reach the identity-provider flow. If your guest subnet blocks the provider domains before login, users will not be able to complete authentication.
## Create A Portal Instance
Open **Captive Portal**, go to **Instances**, and create a new instance.
Select **OAuth2** or **Coupon**. OAuth2 instances require an auth integration.
Set the session TTL. Supported values range from 1,200 seconds to 604,800 seconds, which is 20 minutes to 7 days.
Configure theme colors, logo or icon assets where available, locale, and terms text. Keep terms concise enough that guests can make an informed decision on a phone.
Add the site and the exact subnet or subnets the portal should control.
## Generate Coupons
For coupon-based portals, you can generate access codes on demand or through schedules.
### On-Demand Coupons
1. Open the captive portal instance.
2. Go to **Coupons**.
3. Generate between 1 and 200 coupons.
4. Set how long the coupons remain valid.
5. Export or share the generated codes through your approved process.
### Scheduled Coupons
Use schedules when your team needs a repeatable batch, such as daily front-desk codes or weekly event access.
1. Open the instance and go to **Coupon Schedules**.
2. Create a schedule with the desired count and validity period.
3. Add the notification group or delivery process your operators use.
4. Use **Run now** when you need an immediate batch outside the normal schedule.
## Monitor Sessions
Use captive portal user views to check who has connected, when their session expires, and whether a session should be terminated manually.
When investigating a guest access issue, check these in order:
1. The site is online in SDX.
2. The portal instance is attached to the correct subnet.
3. The authentication strategy matches the guest's login method.
4. OAuth2 provider access is reachable before login, if applicable.
5. The user's coupon is valid, unexpired, and not already redeemed.
## Related Pages
Follow a general SDX troubleshooting path before escalating.
Route operational events to the right team.
# Captive Portals
Source: https://altostrat.io/docs/sdx/en/connectivity/captive-portals/introduction
Understand captive portal instances, OAuth2 identity providers, coupons, and guest sessions in Altostrat SDX.
Captive portals let you control guest access on selected site subnets. A user connects to the guest network, reaches the portal, authenticates with OAuth2 or a coupon, and receives temporary access according to the portal session settings.
Use captive portals for guest Wi-Fi, hospitality access, event access, shared workspaces, or any site where temporary internet access needs to be governed and auditable.
```mermaid theme={null}
flowchart LR
Guest["Guest device"] --> Site["Managed site subnet"]
Site --> Portal["Captive portal instance"]
Portal --> Auth{"Authentication strategy"}
Auth --> OAuth["OAuth2 provider"]
Auth --> Coupon["Coupon code"]
Auth --> Session["Timed user session"]
```
## Core Concepts
The portal configuration: name, strategy, session lifetime, theme, terms text, linked sites, and subnets.
A reusable OAuth2 identity provider configuration. SDX supports Google, GitHub, and Azure-style integrations, with Azure requiring a tenant value.
A generated access code for guest sessions. Coupons can be created on demand or through schedules for repeatable access operations.
## Authentication Strategies
| Strategy | Best for | Requirements |
| -------- | -------------------------------------------------------------------------- | ---------------------------------------------------------------- |
| OAuth2 | Corporate guest access, accountable visitor access, identity-backed access | Auth integration, client ID, client secret, and tenant for Azure |
| Coupon | Hospitality, events, front-desk distribution, temporary anonymous access | Coupon generation process and validity period |
OAuth2 is strongest when you need to know who authenticated. Coupon access is strongest when staff need a simple code-based workflow that can be generated, shared, and expired.
## Session Lifetimes
A portal session has a time-to-live. The service validates session TTL values from 20 minutes to 7 days.
For OAuth2 portals, the authentication window is separate from the session lifetime. Keep the auth window short enough to reduce stale login attempts while still allowing users to complete the identity-provider flow.
## Sites And Subnets
You apply a captive portal instance to specific sites and subnets. Be precise:
* Apply the portal to guest VLANs or guest-only subnets.
* Avoid applying it to infrastructure, management, or staff networks.
* Keep walled garden and identity-provider requirements aligned with your chosen strategy.
## Next Step
Create an auth integration, build a portal instance, apply it to a site, and generate coupons.
# Connectivity and SD-WAN
Source: https://altostrat.io/docs/sdx/en/connectivity/introduction
Plan and operate Altostrat SDX connectivity services, including WAN failover, managed VPN, and captive portals.
Altostrat SDX gives you a managed connectivity plane for MikroTik-based sites. You use it to keep branches online, connect sites and users privately, and control guest access without turning every router into a one-off project.
This section focuses on the operator workflow: what you configure in the portal, what SDX pushes to the device, and where you monitor the result.
```mermaid theme={null}
flowchart LR
Site["Managed site"] --> Failover["WAN failover"]
Site --> Portal["Captive portal"]
Site --> Mgmt["Management VPN"]
Site --> Vpn["Managed VPN peer"]
Failover --> Faults["Faults and workflow events"]
Portal --> Users["Guest sessions and coupons"]
Vpn --> Private["Private site and user access"]
Mgmt --> Ops["Monitoring, jobs, and transient access"]
```
## Connectivity Services
Define up to four WAN links for a site, rank them by priority, and monitor link health with latency, packet loss, jitter, and traffic data.
Provision a cloud VPN instance and attach site peers or user peers with OpenVPN or WireGuard, depending on the peer type and use case.
Create branded guest access experiences that authenticate users with OAuth2 identity providers or coupon codes.
## How The Pieces Fit
Connectivity features are built on the same SDX operating model:
* The portal stores the desired state for each service.
* SDX validates the configuration against the site, workspace, and service rules.
* Device changes are delivered through the job plane, so the router fetches work through its outbound management connection.
* Faults, telemetry, and workflow events close the loop after the change is live.
That model matters operationally. You can review state in the portal, follow job progress, and build workflows around connectivity events instead of relying on someone to notice a local router configuration drift.
## Where To Start
Add WAN links, set priority, and understand how SDX reports link faults.
Learn the instance and peer model before connecting sites or users.
Choose OAuth2 or coupon authentication for guest access.
Check the outbound destinations your firewalls must allow for SDX services.
# VPN Instances and Peers
Source: https://altostrat.io/docs/sdx/en/connectivity/managed-vpn/instances-and-peers
Create a managed VPN instance, add site and client peers, and make practical routing decisions.
This guide walks you through building a managed VPN fabric in SDX. You create an instance first, then attach site peers or client peers depending on who needs access.
## Prerequisites
Before you begin, make sure you have:
* Permission to manage VPN instances and peers.
* A region selected for the instance.
* For site peers, an adopted SDX site and the subnets you want to advertise.
* For client peers, the user account that should receive VPN access.
* A clear decision on split-tunnel versus route-all behavior for client access.
## Create An Instance
In the portal, go to **VPN**, then open **Instances**.
Click **Create Instance** and enter:
* **Name:** a short operator-friendly label.
* **Hostname:** a unique DNS-safe hostname between 3 and 20 characters.
* **Region:** the deployment region closest to your expected peers.
After you create the instance, wait for it to become available before adding production peers. The portal notes that provisioning can take approximately 10 minutes.
Do not use reserved or generic hostnames such as `www`, `api`, `vpn`, `mail`, `cdn`, `assets`, `site`, `ns`, `rsync`, or `shell`. Use a name that clearly belongs to the workspace or environment.
## Add A Site Peer
Use a site peer when a managed MikroTik site should advertise one or more local subnets to the VPN instance.
Open the VPN instance, then go to **Peers**.
Create a peer with type **Site**.
Choose the SDX-managed site and select the protocol. The supported peer protocols are OpenVPN and WireGuard.
Select only the subnets that should be reachable by other peers. Prefer specific prefixes over broad LAN-wide routing when possible.
Save the peer, then monitor its status from the instance. If the peer does not connect, check the site's online state, subnet selection, and management connectivity.
## Add A Client Peer
Use a client peer when a user needs remote access from a laptop or mobile device.
In the instance **Peers** tab, add a peer with type **Client**.
Select the user who should own the peer. Treat the peer profile as user-specific access material.
Leave **Route all traffic** disabled for split-tunnel access, or enable it when all user traffic should pass through the VPN instance.
Download or display the generated client configuration and give it to the assigned user through your approved access process.
## Operational Checks
After peers are created:
* Confirm the instance status is healthy.
* Confirm each peer shows the expected connection state.
* Verify advertised subnets from another peer before telling users the VPN is ready.
* Review route-all client peers periodically because they carry more traffic through the instance.
* Remove stale client peers when a user no longer needs access.
## Troubleshooting
| Symptom | What to check |
| -------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- |
| Site peer stays offline | Confirm the site is online in SDX, then check management connectivity and whether the selected interface can reach the VPN service. |
| Client can connect but cannot reach a subnet | Confirm the subnet is advertised by a site peer and does not overlap with the client's local network. |
| Client traffic is slower than expected | Check whether route-all is enabled and whether the instance region is far from the user. |
| Hostname is rejected | Use a 3 to 20 character DNS-safe hostname and avoid reserved names. |
## Related Pages
Use transient access when an operator needs short-lived management access to a site.
Review the management endpoint model for SDX-connected sites.
# Managed VPN
Source: https://altostrat.io/docs/sdx/en/connectivity/managed-vpn/introduction
Understand VPN instances, peers, protocols, and routing choices in Altostrat SDX.
Managed VPN gives you a cloud-hosted private connectivity hub. You create a VPN instance in a region, then connect SDX-managed sites and individual users as peers.
Use it when you need branch-to-branch connectivity, controlled access for remote users, or a simpler operational model than manually maintaining per-router VPN meshes.
## Core Concepts
A VPN instance is the cloud hub. It has a name, hostname, region, routing settings, DNS settings, and a set of connected peers.
A peer is a site or user that connects to the instance. Site peers advertise site subnets. Client peers give a user a downloadable VPN profile.
```mermaid theme={null}
flowchart TD
Instance["VPN instance"] --> SitePeer["Site peer
Managed MikroTik site"]
Instance --> ClientPeer["Client peer
Assigned user"]
SitePeer --> Subnets["Advertised subnets"]
ClientPeer --> Access["Split tunnel or route all traffic"]
```
## Peer Types
| Peer type | Use it for | Required choices |
| ----------- | --------------------------------------------- | ------------------------------------------------ |
| Site peer | Connecting an SDX-managed site to the VPN hub | Site, protocol, and subnets to advertise |
| Client peer | Giving one user a remote-access profile | User, protocol, and whether to route all traffic |
Site peers can use OpenVPN or WireGuard where available. Client peers are designed around per-user access and can be configured for split-tunnel or full-tunnel behavior.
## Region And Hostname
When you create an instance, choose a region close to the majority of peers. Region choice affects latency for both site-to-site and user access.
The hostname becomes part of the public address for the instance. Hostnames must be unique, short, and DNS-safe. Avoid generic or reserved labels such as `www`, `api`, `vpn`, `mail`, `cdn`, and `ns`.
New VPN instances are provisioned asynchronously. The portal indicates that a new instance can take approximately 10 minutes before it is available.
## Routing Choices
For site peers, advertise only the subnets that should be reachable over the VPN. Avoid broad routes unless you intentionally want the instance to carry that traffic.
For client peers, choose between:
* **Split tunnel:** route only private or advertised networks through the VPN.
* **Route all traffic:** send the user's general internet traffic through the VPN as well.
Split tunnel is usually easier to operate and uses less bandwidth. Route-all is better when you need centralized egress, inspection, or a stricter access posture.
## Next Step
Create a VPN instance, connect site peers, and issue client profiles.
# WAN Failover
Source: https://altostrat.io/docs/sdx/en/connectivity/wan-failover
Configure and monitor prioritized WAN links for an Altostrat SDX managed site.
WAN failover lets you model each internet connection at a site as a managed WAN tunnel. SDX keeps those links ordered by priority, monitors health, and records WAN events so you can operate failover as part of the wider platform.
Use WAN failover when a branch depends on multiple upstream links, such as fibre plus LTE, copper plus 5G, or a primary ISP plus a secondary circuit.
## Prerequisites
Before you configure WAN failover, make sure you have:
* A site that is adopted into SDX and currently online.
* At least two usable WAN connections on the MikroTik router.
* The physical interface name for each connection, such as `ether1` or `lte1`.
* The gateway IPv4 address for each connection.
* Permission to manage WAN failover for the site.
## Core Model
A WAN tunnel represents one internet path on one MikroTik interface. It stores the interface, gateway, link type, provider details, and enabled state.
The first tunnel in the list is the preferred path. If it becomes unhealthy, SDX can move traffic to the next available link according to the configured order.
WAN views show operational health, including latency, packet loss, jitter, receive rates, transmit rates, and related WAN faults.
```mermaid theme={null}
flowchart LR
Primary["Priority 1
Primary fibre"] --> Router["MikroTik site"]
Backup["Priority 2
LTE backup"] --> Router
Router --> SDX["Altostrat SDX"]
SDX --> Metrics["WAN health metrics"]
SDX --> Faults["Fault log and workflow events"]
```
## Configure WAN Failover
In the portal, go to **Sites**, select the site, then open **WAN Failover**.
If WAN failover is not active, enable it for the site. SDX prepares the site for managed WAN configuration.
For each link, define:
* **Name:** a label operators can recognize quickly.
* **Interface:** the MikroTik interface used by that connection.
* **Gateway:** the upstream gateway IPv4 address.
* **Type:** one of the supported link categories, such as fibre, copper, LTE, 5G, ethernet, coaxial, VSAT, microwave, or other.
* **Provider and SLA details:** optional context that helps your team interpret faults and reports.
SDX supports up to four WAN tunnels for a site.
Order the WAN tunnels from most preferred to least preferred, then save the priority order. Use the most stable and cost-effective path first, and place metered or high-latency links lower unless your design requires otherwise.
Watch the WAN failover page after the change is applied. Check that each tunnel reports the expected status and that latency, packet loss, jitter, and traffic data look believable for the circuit.
## Operate Failover
Use the WAN page for configuration and the wider monitoring surfaces for operations:
* Use the per-site **WAN Failover** page when you need to change interfaces, gateways, link types, or priority order.
* Use the global **WAN Live** view when you need to compare link health across many sites.
* Use the **Fault Log** to investigate when a link went offline, came back online, or experienced packet loss.
* Use workflows when WAN events should create tickets, notify a team, or change priority automatically.
If you use a cellular or satellite link as a backup, tag it clearly and put cost or usage expectations in the provider/SLA fields. Future operators should know why that link is lower priority before an outage starts.
## Testing
Test WAN failover during a planned window, not during the first real outage.
1. Confirm all tunnels are online.
2. Notify anyone who monitors the site.
3. Move a backup link to the top of the priority order, or disconnect the primary link if your change window allows a physical test.
4. Confirm the active path changes as expected.
5. Restore the intended priority order.
6. Review the fault log and WAN metrics to make sure the event was captured.
Changing WAN priority or physically disconnecting a link can interrupt traffic while routing converges. Test during a maintenance window for business-critical sites.
## Related Pages
Learn how SDX records site and WAN events.
See the WAN triggers and actions available in workflows.
# Configuration Backups
Source: https://altostrat.io/docs/sdx/en/fleet/configuration-backups
Request, review, compare, and use MikroTik configuration backups as the safer reference point for change planning and troubleshooting.
Configuration backups give you a stored view of router configuration over time. Use them before change windows, after policy or script rollout, and during incident review.
## Prerequisites
Before you work with backups, make sure:
* You have permission to view or request backups.
* The site is online if you need a fresh backup.
* You know which site and time window you are investigating.
## What Backups Are For
Use backups to:
* Review static router configuration.
* Compare before and after states.
* Validate what changed during a maintenance window.
* Prepare rollback or recovery steps.
* Investigate configuration drift without running live commands.
For static configuration review, backups are usually a better first stop than the synchronous API. Use live commands when you need current runtime state.
## Request a Fresh Backup
Go to **Sites**, open the target site, and select **Configuration Backups**.
Select the action to request a fresh backup.
SDX queues backup work for the router. The site must check in and complete the job before the backup appears.
Open the backup and confirm it reflects the expected router and timestamp.
## Compare Backups
Use backup comparison when you need to understand drift or validate a change.
1. Open the site's backup list.
2. Choose the earlier backup as the baseline.
3. Choose the later backup as the comparison.
4. Review additions, removals, and changed lines.
5. Record important differences in the change ticket or site notes.
## Restore Carefully
Backups are reference material for recovery. Treat any restore-like operation as a production change:
* Confirm you are using the correct site.
* Confirm the backup predates the unwanted change.
* Review site-specific values such as IPs, interfaces, credentials, and customer settings.
* Schedule a maintenance window.
* Keep out-of-band access available where possible.
Do not apply old configuration blindly. A backup can include values that are no longer safe for the current network state.
## Troubleshooting
If a requested backup does not appear:
* Confirm the site is online.
* Check whether other queued jobs are blocking progress.
* Check the site job or orchestration history for errors.
* Confirm the router has enough time and resources to export configuration.
* Retry after the site is stable.
If a backup looks incomplete:
* Confirm you opened the intended timestamp.
* Compare it with adjacent backups.
* Use a live command only if you need to confirm current runtime state.
# Control Plane Policies
Source: https://altostrat.io/docs/sdx/en/fleet/control-plane-policies
Use control plane policies to define which router management services are enabled and which source networks can reach them.
Control plane policies define the management services SDX should allow on your MikroTik routers. They centralize settings for WinBox, SSH, HTTP, HTTPS, Telnet, FTP, API, and API-SSL access, including service ports and trusted networks.
## Prerequisites
Before you change a policy, make sure you have:
* Permission to create or update control plane policies.
* A trusted-network list in CIDR format.
* A recent configuration backup for any production site you will affect.
* A maintenance window for broad rollout.
## How Policies Work
When you save a control plane policy and attach it to sites, SDX records the policy and updates the affected site assignments. Device-side enforcement is delivered through the platform's management and job model, so a site must be reachable before the router can receive and apply the change.
The policy model validates that:
* Each management service has an enabled or disabled state.
* Each service uses a valid TCP port.
* Service ports do not conflict with each other.
* Trusted networks and per-service networks use valid CIDR notation.
If your account has no policy yet, SDX creates a default policy for the customer. The default policy is protected from deletion and is used as the fallback when a custom policy is removed.
## Create a Policy
Go to **Policies > Control Plane**.
Select **Add**, enter a clear policy name, and choose whether you need custom input rules.
Add the CIDR ranges that should be allowed to reach management services.
Enable only the services you need. Confirm ports are unique across services.
Select the sites that should use the policy, then save.
## Roll Out Safely
For production changes:
1. Apply the policy to a low-risk test site.
2. Confirm WinBox or SSH access behaves as expected.
3. Review the site orchestration or job history for failures.
4. Apply the policy to a small batch.
5. Expand to the remaining sites after validation.
Control plane mistakes can lock your team out of management services. Keep at least one known-good access path and a recent backup before changing production management policy.
## Common Policy Decisions
If your team does not use Telnet, FTP, HTTP, or non-SSL API access, disable them in the policy.
Prefer narrow CIDR ranges for operations networks, bastion hosts, or trusted office networks.
Use a documented port standard so support staff know what to expect during incidents.
Attach the policy to a small number of sites before applying it fleet-wide.
## Troubleshooting
If a policy does not appear to apply:
* Confirm the site is online.
* Confirm the site is attached to the intended policy.
* Check whether the router has picked up the queued work.
* Review the orchestration or job history for the site.
* Verify the source IP you are connecting from is inside an allowed CIDR.
Use the fleet troubleshooting checklist for policy and job-delivery issues.
# Fleet Management
Source: https://altostrat.io/docs/sdx/en/fleet/introduction
Manage MikroTik sites at scale with SDX sites, policies, remote access, backups, tags, notes, and operational metadata.
Fleet management is the day-to-day operating surface for SDX. It is where you create sites, check whether routers are online, review device context, apply management policies, request backups, and use secure remote access.
## What Fleet Management Covers
Create and manage the site records that represent your MikroTik routers, then use site views to inspect status, metrics, inventory, faults, and settings.
Define the management services and trusted networks that SDX should enforce for WinBox, SSH, HTTP, HTTPS, Telnet, FTP, API, and API-SSL access.
Generate time-limited access for WinBox or SSH, or create a temporary port forward to reach a specific internal host and port.
Browse stored router backups, request fresh backups, inspect backup content, and compare versions before or after change windows.
Add structured context to sites so your team can filter, report, automate, and route ownership consistently.
Use live and synchronized device data to understand what is connected behind your managed sites.
## The Site Lifecycle
A site moves through a predictable lifecycle:
1. You create a logical site in the portal.
2. SDX generates onboarding material for that site.
3. The router runs the bootstrap command and begins sending heartbeats.
4. SDX enriches the site with device identity, tunnel details, metadata, and operational state.
5. Policies, backups, scripts, workflows, reports, and notifications use the site as their target.
If a site is deleted, feature services that maintain per-site projections can clean up related state. Treat deletion as permanent operational cleanup, not as a troubleshooting step.
## What to Standardize First
Before adding many sites, define:
* A naming convention for sites.
* Required tags, such as region, customer, environment, service tier, or owner.
* A default control plane policy.
* A backup and change-window practice.
* A notification group for critical site and WAN events.
* A support workflow for offline sites and failed jobs.
Good fleet hygiene pays off later. Tags, clean names, and backup coverage make reports, dashboards, workflows, and incident response much easier to trust.
## Related Pages
Bring a router online as a managed SDX site.
Diagnose offline sites, failed jobs, backup issues, and remote access failures.
# Managing Sites and Devices
Source: https://altostrat.io/docs/sdx/en/fleet/managing-sites-devices
Create, review, update, and retire SDX sites while understanding how heartbeats and asynchronous jobs affect site state.
A site is the operational record for a managed MikroTik router. SDX stores the site record, enriches it with metadata, and uses it as the target for policies, jobs, backups, scripts, workflows, metrics, and reports.
## Prerequisites
Before you manage sites, make sure you have:
* Permission to view or manage sites.
* A clear naming and tagging standard for your organization.
* Router access if you are onboarding a physical device.
* A control plane policy ready for new sites.
## Create a Site
In the SDX portal, go to **Sites**.
Select **Add**, enter a site name, and save the record.
Open the new site, generate the bootstrap command, run it on the MikroTik router, and wait for the first heartbeat.
Add tags, notes, and any required metadata after the site appears online.
## Understand Site Status
The router is checking in and SDX has recent heartbeat data. Live commands and remote access are more likely to succeed.
SDX has not received expected heartbeats. Queued jobs can still be accepted by SDX, but the router cannot pick them up until it reconnects.
The most recent timestamp SDX has for the site. Use this with fault history when you investigate intermittent links.
The management tunnel state. Live commands and transient access depend on the active management path for the site.
## Review a Site
Open a site to inspect:
* Overview and status
* Device identity and RouterOS details
* Metrics and live dashboard data
* Fault event log
* Inventory and discovered devices
* Remote access tools
* Configuration backups
* WAN failover settings
* API credentials and management settings
* Notes, metadata, and tags
Some views use stored data and remain useful while a site is offline. Live views require the management path to be available.
## Edit Site Details
Use the site settings or overview actions to update the site name, notes, tags, metadata, or operational settings. Keep names human-readable because they appear in dashboards, reports, notifications, workflow context, and search.
Changing metadata is usually immediate in the portal. Applying a device-level change, such as a policy update or job, may be asynchronous.
## Delete a Site
Only delete a site when you are sure the router should no longer be managed by SDX.
Deleting a site removes the operating record used by downstream features. If you are troubleshooting an offline router, keep the site and use the troubleshooting checklist instead.
Before deletion:
* Export or review any backups you need to retain.
* Check whether workflows, reports, policies, or notification rules depend on the site.
* Confirm the site is not part of a managed VPN, captive portal, WAN failover, or security rollout.
* Record the reason in your internal change or ticketing system.
## Best Practices
Use names that make sense in an alert at 2 a.m. Avoid internal abbreviations that only one person understands.
Create consistent tag keys before you onboard many sites. Retrofitting tags after reports and workflows exist is slower.
Request a fresh backup before policy, script, WAN, or security changes.
Do not rely only on the current status badge. Review recent faults and heartbeat history for intermittent issues.
# Metadata, Tags, and Site Files
Source: https://altostrat.io/docs/sdx/en/fleet/metadata-and-tags
Use tags, metadata, notes, media, and documents to make your SDX fleet searchable, reportable, and automation-ready.
Metadata turns a list of routers into an operable fleet. Tags and site files give your team enough context to filter sites, assign ownership, build reports, trigger workflows, and investigate incidents quickly.
## Prerequisites
Before you standardize metadata, decide:
* Which tag keys are required for every site.
* Which values are allowed for each tag key.
* Who owns tag definitions.
* Which notes or documents should be attached to sites.
* Whether tags should be mandatory for sites or other resource types.
## Metadata Types
Structured key-value context. Tags support filtering, reporting, workflow conditions, and resource selection.
Human-readable operational context, such as access instructions, circuit notes, or support history.
Site images or visual context that helps identify the location or installation.
Files attached to the site, such as handover notes, diagrams, maintenance records, or customer documentation.
## Design a Tag Model
Start with a small number of high-value tags. Common tag keys include:
* `region`
* `customer`
* `environment`
* `service-tier`
* `owner`
* `site-type`
* `maintenance-window`
Use predictable values. For example, choose either `production` or `prod`, not both.
Tags become inputs to reports and workflows. Keep them boring, consistent, and easy to audit.
## Create a Tag Definition
Go to **Settings > Tag Management**.
Add the tag key, choose a color, and define whether the tag should be mandatory for one or more resource types.
Add tag values to sites or other supported resources.
Review which sites are missing mandatory tags and fill gaps before using the tag in workflows or reports.
## Add Site Context
From a site, use metadata, notes, media, and documents to capture context that is not visible from RouterOS alone:
* Physical location or rack notes
* ISP and circuit references
* Customer contacts
* Internal escalation notes
* Photos of the installation
* Change or handover documents
## Use Tags in Operations
Tags are most valuable when they drive action:
* Filter sites in fleet views.
* Select sites for reports.
* Route workflow logic with resource tag conditions.
* Apply or remove tags from a workflow.
* Group operational ownership by region or customer.
## Best Practices
Rename tag keys rarely. Downstream workflows and reports may rely on them.
Use a limited set of approved values where possible.
If a tag is required, explain who owns it and what each value means.
Do not store passwords, private keys, or tokens in metadata, notes, files, or tag values.
# Secure Remote Access
Source: https://altostrat.io/docs/sdx/en/fleet/secure-remote-access
Use time-limited transient access and transient port forwarding to reach managed sites through the SDX management path.
Secure remote access lets you reach a managed site without opening permanent inbound firewall rules to the router. SDX creates temporary access through the site's management server and automatically expires it.
## Prerequisites
Before you create remote access, make sure:
* The site is online.
* The site has an active management tunnel and management server.
* Your role allows transient access or transient port forwarding.
* Your client network is allowed by the CIDR you enter.
* You know whether you need router management access or access to an internal host behind the router.
## Access Types
Creates temporary WinBox or SSH access to the managed router. You choose the access type, expiry, and allowed source CIDR.
Creates a temporary forward to a specific destination IP and port behind the site. Use this for short-lived access to an internal service.
Transient access can last from 15 minutes up to 24 hours. Use the shortest useful duration for the task.
## Create WinBox or SSH Access
Go to **Sites**, open the target site, and select **Remote Access**.
Select WinBox or SSH.
Choose an expiry between 15 minutes and 24 hours.
Enter the CIDR that should be allowed to use the temporary access.
Create the access record, copy the generated connection details, and connect before the expiry time.
For emergency work, create access for the specific engineer or jump-host CIDR instead of using a broad network range.
## Create a Temporary Port Forward
Use transient port forwarding when you need to reach a device or service behind the managed router.
From the site, open **Remote Access** and choose the port-forwarding option.
Provide the internal destination IP address and destination port.
Add the allowed source CIDR and select the shortest duration that supports the task.
Use the generated entry point while the forward is active.
## Revoke Access
Revoke active access as soon as the task is complete. Expiry is a safety net, not a substitute for closing unused sessions.
## Troubleshooting
If remote access fails:
* Confirm the site is online.
* Confirm the management server is available for the site.
* Confirm your current public IP is inside the allowed CIDR.
* Confirm you are connecting before the expiry time.
* For port forwarding, confirm the internal destination IP and port are reachable from the router.
* Try a shorter, newly generated access record if the first one expired or was copied incorrectly.
Do not use transient access as permanent remote access. It is designed for time-bounded operations, support, and incident response.
# Core Concepts
Source: https://altostrat.io/docs/sdx/en/getting-started/core-concepts
Learn the SDX terms you need before managing sites, policies, workflows, and monitoring.
Altostrat SDX is easier to use when you separate the things you manage from the systems that carry out the work. A site is the object you see in the portal. The device job plane, management tunnel, metadata store, and workflow engine are the systems that keep that site useful.
## Organization Model
The top-level account boundary. Organizations contain workspaces, users, teams, billing settings, and governance configuration.
The tenancy and billing container. Workspaces hold the SDX resources your team operates.
The collaboration boundary for day-to-day access. Teams collect users and apply roles to the resources they can work with.
A permission set. Portal navigation and actions are scope-gated, so users only see what their role allows.
## Network Objects
A site represents a managed MikroTik router and its operational context: status, tunnel information, metadata, tags, notes, backups, metrics, faults, and feature assignments.
The outbound management path between a site and Altostrat regional infrastructure. It supports remote access, synchronous commands, and management-side operations.
A reusable configuration object that can be attached to one or more sites. Examples include control plane, content filtering, BGP threat, security group, and prefix list policies.
Structured context you attach to sites and other resources. Tags support filtering, reporting, workflow conditions, and operational ownership.
## Execution Concepts
A regular check-in from the router. Heartbeats feed online status, last-seen data, device inventory, and availability reporting.
A queued unit of work for a router. Scripts, backup requests, policy pushes, ARP syncs, VPN updates, and selected feature actions all use the same job pattern.
A live command sent through the management server when the site is reachable. Use this for current state, not for reading static configuration you can get from backups.
One execution of a workflow. Runs have triggers, node results, logs, and context passed between actions and conditions.
## Operational Concepts
A normalized operational incident, such as a site outage or WAN state change. Faults feed dashboards, notifications, workflows, and SLA reporting.
A reusable time window. Schedules can control when automations, reports, scripts, and notifications should run or deliver.
A routing rule for who gets told about operational events, and through which channels or integrations.
A generated operational artifact, such as an SLA report or vulnerability report, built from stored platform data.
## Next Step
Learn how heartbeats, jobs, live commands, faults, notifications, and reports behave in real operations.
# Introduction to Altostrat SDX
Source: https://altostrat.io/docs/sdx/en/getting-started/introduction
Understand what Altostrat SDX does, how it fits around your MikroTik fleet, and where to start in the documentation.
Altostrat SDX is the control and data platform behind Altostrat's managed networks. It manages MikroTik fleets across thousands of deployed sites — from MSPs to ISPs to enterprises — and provides the fleet foundation that [Altostrat Studio](/docs/studio/en/welcome) operates on top of. You use SDX to onboard routers as managed sites, keep a live view of fleet health, push controlled changes, run automation, and deliver operational alerts without managing each router by hand.
The platform is built around a simple idea: routers keep an outbound management relationship with Altostrat, and SDX uses that relationship to coordinate jobs, policies, monitoring, reporting, and secure remote access.
**Where Studio fits**: SDX is the platform that manages fleet state; [Altostrat Studio](/docs/studio/en/welcome) is the IDE engineers work in day to day. Studio handles active troubleshooting, AI-assisted operations, and team procedures — against devices SDX manages and devices it doesn't. The two complement each other and neither requires the other.
## What You Can Manage
Track managed routers as sites, review online status, inspect inventory, attach tags, and organize operational metadata.
Reach devices through the management tunnel using time-limited WinBox, SSH, or port-forwarding access instead of opening permanent inbound rules.
Build workflows, schedule scripts, require authorizations, call internal or external APIs, and respond to platform events.
Configure WAN failover, managed VPN instances, captive portal instances, DNS filtering, BGP threat feeds, and firewall policy objects.
## How SDX Operates
Most SDX changes are asynchronous. When you create a policy, run a script, request a backup, or trigger a feature deployment, SDX records the intent, delivers work to the router through the device job plane, and tracks the result. This makes changes resilient across NAT, intermittent links, and distributed sites.
For live reads, such as checking current routes or using transient remote access, SDX uses the management server connected to that site. If a site is offline or its management tunnel is not available, live operations wait or fail, while stored data such as backups and historical faults remain available.
Start with the operating model before rolling out advanced automation. It explains which actions are immediate, which actions are queued, and how SDX decides whether a site is online.
## Recommended Path
Understand sites, workspaces, policies, jobs, tags, workflows, and the management tunnel.
See how heartbeats, queued jobs, faults, notifications, and reports fit together.
Create a site, generate a bootstrap command, run it on RouterOS, and verify the site is online.
Use the checks for offline sites, failed jobs, remote access problems, and reporting gaps.
# Operational Model
Source: https://altostrat.io/docs/sdx/en/getting-started/operational-model
Understand how SDX uses heartbeats, queued jobs, live commands, faults, notifications, and reports to operate a MikroTik fleet.
Altostrat SDX is not a remote desktop for routers. It is an event-driven operations platform built around outbound router check-ins, queued device work, and live management paths when a site is reachable.
This page explains the model you should keep in mind before you deploy policies, scripts, workflow automation, or reporting.
## The Runtime Core
Three platform areas carry most SDX operations:
Owns site adoption, heartbeats, pending router jobs, callbacks from devices, live state, and site lifecycle events.
Owns management-side orchestration, control plane policies, credentials, transient access, management server routing, and synchronous operations.
Stores shared context such as tags, notes, files, site imagery, and resource metadata used across the portal.
## Heartbeats and Online Status
Managed routers send regular heartbeats to SDX. Heartbeats update last-seen information, device details, availability state, and metrics inputs.
In reporting views, SDX treats a site outage as a missed-heartbeat window: routers report roughly every 30 seconds, and an outage fault is created after 10 consecutive missed heartbeats. That gives the platform a 5-minute sensitivity window before it records downtime. Downtime begins at the first missed heartbeat and clears when the next successful heartbeat arrives.
Short local network interruptions can appear as a delayed status update rather than an immediate outage. Use the fault log and heartbeat history together when you investigate reliability.
## Queued Device Jobs
Most changes are delivered as jobs. A service records the requested work, publishes it for the target site, and the router receives it when it checks in.
Common job-producing actions include:
* Running a scheduled script
* Requesting a fresh backup
* Applying control plane or security policy changes
* Updating VPN or WAN failover configuration
* Running ARP or inventory synchronization
* Hydrating an event-driven script into RouterOS commands
Queued jobs make distributed operations more reliable because a router does not need a permanent inbound connection from Altostrat. The router asks for work, executes the wrapped script, and calls back with status.
## Live Commands
Some actions need current router state. Those use the management server connected to the site and run through the management tunnel.
Use live commands when you need dynamic state such as current routes, active sessions, live interface data, or a direct operational check. Use backups when you need static configuration, because backup files are usually faster and more complete for reviewing installed configuration.
If a site is offline, has no active management server, or has a broken management tunnel, live commands and transient access may fail even though historical data remains visible.
## Faults, Notifications, and Workflows
Faults are normalized operational events. Core site state and feature services publish events such as site offline, site online, WAN offline, WAN online, and WAN packet loss. SDX stores the fault state, sends it to the portal, and can route it to notifications and workflows.
Notification groups decide who receives operational messages. Workflows can also subscribe to platform events, enrich context, call APIs, run scripts, tag resources, or trigger downstream workflows.
## Reports
SLA and vulnerability reports are generated from stored platform data. SLA reporting uses fault windows and optional business schedules. CVE reporting uses scan schedules, scan-site results, enrichment, and generated report artifacts.
Because reports depend on stored data, fix data quality first:
* Sites should have clear names and tags.
* Faults should be reviewed and acknowledged with useful context.
* Business schedules should match the service window you actually report against.
* Notification recipients should be maintained before reports are scheduled.
## Practical Implications
A successful save in the portal often means SDX accepted the change. Device completion may happen later and should be checked through progress, logs, or site state.
Use backups, staged policy rollout, tags, and narrow site selections before making fleet-wide changes.
Tags become operational routing data for reports, workflows, filtering, and ownership. Keep tag keys consistent.
Roles, transient access, workflow authorizations, and vault secrets should grant the minimum access needed for the task.
Put the model into practice by creating a site and bringing a router online.
# Onboard Your First Router
Source: https://altostrat.io/docs/sdx/en/getting-started/quickstart-onboarding
Create your first SDX site, run the bootstrap command on RouterOS, and verify that the router is online.
Use this guide to onboard one MikroTik router as an SDX site. By the end, the router should appear as online in the portal and be ready for management, monitoring, backups, policies, and automation.
## Prerequisites
Before you begin, make sure you have:
* A MikroTik router with working outbound internet access.
* RouterOS terminal access through WinBox, SSH, or a local console.
* An Altostrat SDX user with permission to create and manage sites.
* A control plane policy to apply during onboarding. The default policy is suitable for a first site unless your organization has a stricter standard.
Run onboarding during a maintenance window if the router is already carrying production traffic. The bootstrap script installs SDX management configuration and may change management-plane behavior.
## Onboard the Router
Create the logical site that will represent this router in SDX.
1. Open the SDX portal.
2. Go to **Sites**.
3. Select **Add**.
4. Enter a clear site name, such as the location or customer-facing service name.
5. Save the site.
Use a name your operations team will recognize in alerts and reports. You can add tags and notes after the site is online.
Generate the RouterOS command that binds the physical router to the site.
1. Open the new site.
2. Select **Add Router** or the onboarding action shown in the site view.
3. Select the control plane policy you want SDX to enforce.
4. Copy the generated bootstrap command.
The bootstrap command is site-specific. If you abandon the onboarding attempt or suspect the command was copied incorrectly, generate a fresh command from the portal.
Execute the command on the target router.
1. Open the router terminal through WinBox, SSH, or console.
2. Paste the full bootstrap command.
3. Press **Enter**.
4. Wait for the command to finish before closing the session.
The router connects outbound to Altostrat, adopts into the site, and begins the management relationship used for heartbeats and device jobs.
Return to the SDX portal and open the site.
Confirm that:
* The site status changes to online.
* Last seen updates after the router checks in.
* Device identity and RouterOS details appear on the site.
* The site appears in the fleet list and dashboard widgets.
If the site does not come online, start with outbound internet reachability, DNS resolution, the full copied command, and outbound access to the management VPN endpoint. See [Troubleshooting](../resources/troubleshooting) for a structured checklist.
## Next Steps
After the router is online, do these next:
Learn where SDX shows status, inventory, notes, tags, faults, metrics, and site settings.
Review the control plane policy applied during onboarding and create a stricter one if needed.
Request and review a configuration backup before making larger changes.
Add useful operational metadata before you build reports and workflows around the site.
# Dashboards and Metrics
Source: https://altostrat.io/docs/sdx/en/monitoring/dashboards-and-metrics
Use SDX dashboards to inspect fleet health, site state, WAN behavior, inventory, and operational trends.
Dashboards give you a current operating view of your SDX fleet. Use them for triage, capacity review, and day-to-day awareness before you drill into a specific site, fault, report, or workflow run.
## Prerequisites
* You have access to the team or workspace that owns the sites you want to monitor.
* At least one managed site is online and reporting heartbeats or metrics.
## Core Views
The portal exposes several monitoring surfaces.
| View | Use it for |
| --------- | ----------------------------------------------------------------------------------------- |
| Dashboard | Fleet-level health, recent changes, and operational priorities. |
| Sites | Per-site status, device details, interfaces, tunnels, and site actions. |
| Inventory | Hardware and managed-device information across the fleet. |
| WAN | Live WAN tunnel behavior, priority, health, latency, packet loss, jitter, and throughput. |
| Fault Log | Active and resolved events with causes, severity, duration, and timestamps. |
| Reports | SLA history and generated report artifacts. |
## Triage Flow
1. Start at the dashboard to identify sites or services that need attention.
2. Open the affected site and inspect device, interface, and WAN data.
3. Review [Fault Logging](./fault-logging) to understand whether the issue is active, resolved, repeated, or part of a wider pattern.
4. Check related policies, schedules, or workflows if the timing lines up with a change.
5. Use reports for historical impact after the incident is resolved.
## WAN Metrics
WAN views are especially useful for SD-WAN operations. Review latency, packet loss, jitter, traffic rates, tunnel state, and WAN priority when investigating degraded performance. A site may remain online through a backup path while one WAN interface is degraded or offline.
## Advanced Use Cases
Use dashboards during maintenance windows to confirm expected transitions. For example, when you change WAN priorities, watch live WAN behavior and fault events together so you can tell the difference between expected failover and unintended loss of reachability.
Use inventory and tags together when you need to find a pattern across device models, regions, or customer groups. Tags make it easier to correlate a monitoring issue with ownership or deployment context.
Dashboards are optimized for current state. Use [Reporting](./reporting) when you need historical SLA evidence or a shareable PDF.
# Fault Logging
Source: https://altostrat.io/docs/sdx/en/monitoring/fault-logging
Investigate active and resolved site, WAN, and service faults with timestamps, severity, type, cause, and duration.
The Fault Log is the operational timeline for detected issues in SDX. It shows active and resolved events so you can understand what is broken now, what recovered, and how long the event lasted.
## Prerequisites
* You have access to the team or sites you want to investigate.
* You know the approximate site, time range, severity, or fault type if you are researching a specific incident.
## What a Fault Shows
Fault rows can include:
* Created time
* Resolved time
* Message
* Severity
* Type
* Cause
* Active or resolved status
* Duration
Faults are normalized by SDX services and can feed notifications, workflows, and real-time portal updates.
## Offline Detection
Managed routers send heartbeats about every 30 seconds. SDX declares a site offline after 10 missed heartbeats, which creates a roughly five-minute sensitivity window. The downtime period starts at the first missed heartbeat and clears when the next successful heartbeat is received.
WAN faults are more specific. A WAN interface can go offline or experience packet loss while the site itself remains reachable through another path.
## Investigate a Fault
1. Open **Monitoring** and select **Fault Logging**.
2. Choose whether to show resolved faults.
3. Filter by cause, severity, type, site, or message text when available.
4. Open the affected site to inspect current device and WAN state.
5. Compare the event timestamp with recent policy, script, workflow, or user changes.
6. Confirm recovery in the fault row and current dashboard state.
## Advanced Use Cases
Use unresolved faults for live operations and resolved faults for incident review. Resolved fault history is helpful when you need to prove whether an issue was isolated, recurring, or tied to a maintenance window.
Use fault types as workflow entry points. Workflows can start from site offline, site online, WAN offline, WAN online, WAN packet loss, and WAN packet loss resolved events.
Build notification groups before incidents happen. See [Notifications](./notifications) for routing fault events to the right responders.
# Monitoring & Analytics
Source: https://altostrat.io/docs/sdx/en/monitoring/introduction
Understand how Altostrat SDX turns heartbeats, metrics, faults, reports, and notifications into an operating view of your fleet.
Monitoring in Altostrat SDX is designed for operators who need to know what is happening now, what happened earlier, and who needs to act. Managed routers send heartbeats and metrics into SDX, the platform normalizes faults, and the portal presents that data through dashboards, fault logs, reports, and notifications.
```mermaid theme={null}
flowchart LR
Site["Managed sites"] --> Heartbeat["Heartbeats and metrics"]
Heartbeat --> Faults["Fault detection"]
Heartbeat --> Dashboards["Dashboards and metrics"]
Faults --> Logs["Fault log"]
Faults --> Notifications["Notifications"]
Logs --> Reports["SLA reports"]
Faults --> Workflows["Workflow triggers"]
```
## What You Can Monitor
View fleet, site, interface, inventory, and WAN health from the portal.
Investigate active and resolved events with severity, type, cause, message, and duration.
Schedule SLA reports across all hours or business hours, then share or download generated reports.
Route operational events to the right people and channels with muting and topic controls.
## Heartbeat Sensitivity
Routers send SDX a heartbeat about every 30 seconds. A site is treated as offline after 10 missed heartbeats, which gives site availability detection a roughly five-minute sensitivity window. Downtime begins at the first missed heartbeat and clears on the next successful heartbeat.
This timing matters when you compare dashboards, fault logs, and SLA reports. A short interruption may appear differently from a sustained outage because SDX waits for missed heartbeat evidence before declaring the site offline.
## Operating Pattern
1. Use dashboards for current health and quick triage.
2. Use the fault log to understand event history and resolution.
3. Use notification groups so incidents reach the right team.
4. Use SLA reports for service review, customer reporting, and trend analysis.
5. Use workflow triggers when a monitored event should start an automated response.
For event-driven automation, see [Triggers and Webhooks](../automation/workflows/triggers-and-webhooks). Fault events can start workflows such as WAN offline, WAN packet loss, site offline, and site online handling.
# Notifications
Source: https://altostrat.io/docs/sdx/en/monitoring/notifications
Route operational events to the right responders with notification groups, topics, schedules, sites, and muting controls.
Notifications help you turn monitored events into timely human action. A notification group defines who should receive alerts, which channels are used, what topics matter, and when alerts should be muted.
## Prerequisites
* You know which team should respond to each event class.
* The intended recipients exist as users or notification-only users.
* Any external channel integration you want to use has been configured.
## Notification Groups
A notification group can define:
* Recipients
* Channels
* Topics
* Site scope
* Schedules
* Muting behavior
Use groups to keep alert routing readable. For example, a network operations group might receive site offline and WAN degradation alerts, while a customer success group receives only scheduled SLA reports.
## Create a Group
1. Open **Notifications** and select **Groups**.
2. Create a group with a purpose-driven name.
3. Add users or notification-only recipients.
4. Select the channels the group should use.
5. Select topics and site scope.
6. Configure schedule or muting behavior if the group should not receive alerts at all times.
7. Save the group.
## Where Groups Are Used
Notification groups can be selected by monitoring and reporting features, including fault alerting and SLA report schedules. Workflows can also send notifications as part of an automated response.
## Advanced Use Cases
Use separate groups for severity and audience. Critical site outages may go to on-call engineers, while weekly reports go to managers or customers.
Use muting during planned maintenance windows so expected events do not create unnecessary noise. After maintenance, remove or expire the mute so real incidents are routed again.
Notification-only users are useful when someone needs alerts or reports but should not sign in to the portal. See [User and Team Management](../account/user-and-team-management).
# Reporting
Source: https://altostrat.io/docs/sdx/en/monitoring/reporting
Schedule SLA reports, choose business-hour or all-hour calculations, and share generated report artifacts.
SLA reporting turns monitored availability into scheduled reports for operations review, customer updates, and service accountability. Reports can cover all hours or a business-hours schedule, and they can be generated daily, weekly, or monthly.
## Prerequisites
* You have access to the sites that should appear in the report.
* You know the SLA target and whether availability should be measured across all hours or business hours.
* You have a notification group ready if reports should be delivered automatically.
## Schedule Options
| Frequency | Behavior |
| --------- | -------------------------------------------------------------------------------------------------- |
| Daily | Runs at 8:00 AM and covers the previous day. |
| Weekly | Runs on the selected day and covers the past week. |
| Monthly | Runs on the selected day. If a month is shorter than that day, SDX uses the last day of the month. |
Schedules include a timezone, SLA target, selected sites, notification group, and calculation mode.
## Business Hours
Reports can calculate uptime across all hours or only within a business-hours schedule. Use business hours when service accountability should match staffed operating windows. Use all hours when the service is expected to be continuously available.
## Create a Report Schedule
1. Open **SLA** and select **Schedules**.
2. Create a schedule with a clear name.
3. Select daily, weekly, or monthly frequency.
4. Choose the sites to include. You can use tag grouping to keep site selection scalable.
5. Set the SLA target.
6. Choose all-hours or business-hours calculation.
7. Optionally show only breached sites.
8. Optionally ignore power outages when that matches your reporting policy.
9. Select a notification group if the report should be delivered automatically.
10. Save the schedule.
## Generated Reports
Generated SLA reports show the report name, uptime percentage, SLA target, site count, reporting period, and whether the report used all hours or business hours. Reports can be shared with a generated link or downloaded as a PDF.
You can also run a schedule on demand when you need a report outside its normal cadence.
## Advanced Use Cases
Use tag-based site selection for customer, region, or service-tier reports. This keeps reports accurate when sites are added or removed from a group.
Use separate schedules for internal operations and customer-facing reports. Internal reports may include every site and every outage, while customer-facing reports may use business hours, breached-site filters, or specific site groups.
SLA reports depend on monitoring history. For live incident response, use [Fault Logging](./fault-logging) and [Notifications](./notifications).
# Best Practices
Source: https://altostrat.io/docs/sdx/en/resources/best-practices
Operate Altostrat SDX safely across sites, policies, connectivity, automation, monitoring, and account administration.
These practices keep SDX predictable as your estate grows. They are written for operators managing many sites, not for a single demo router.
## Name For Operations
* Use site names that match how your team talks during incidents.
* Include location, customer, or service context where it helps.
* Keep policy and workflow names action-oriented, such as `Apply guest DNS filtering` or `Notify NOC on WAN packet loss`.
* Avoid names that only make sense to the creator.
## Tag Early
Use tags to classify:
* Region.
* Customer or business unit.
* Environment.
* Site criticality.
* ISP or access type.
* Service ownership.
Tags make workflows, reports, searches, and incident response much easier later.
## Keep Management Access Narrow
* Use control plane policies to restrict router management services.
* Keep `154.66.115.255/32` available where SDX must manage the router.
* Use transient access for short-lived operator access.
* Avoid permanent broad WinBox or SSH exposure.
* Recreate the management filter if site controls indicate the SDX rules have drifted.
## Test Before Fleet Changes
For scripts, policies, and workflows:
1. Test on a non-critical site.
2. Roll out to a small cohort.
3. Watch outcomes and faults.
4. Expand only after you understand the result.
This is slower than a one-click fleet change and much faster than recovering a broken fleet.
## Build Workflows Like Production Logic
* Give each workflow a clear owner.
* Store secrets in the vault.
* Keep loops bounded.
* Make actions idempotent.
* Inspect the first production run after every change.
* Use workflow chaining for repeated logic instead of copy-pasting large graphs.
## Keep Rollback Paths
* Use configuration backups before major script or policy changes.
* Document the intended state in the script or change description.
* Keep old templates available until the replacement has run successfully.
* Do not delete known-good workflow authorizations until dependent workflows have moved.
## Monitor The Result
After changes, check:
* Site status.
* Fault log.
* WAN health.
* Workflow runs and node logs.
* Scheduled script outcomes.
* Captive portal sessions, if guest access was affected.
The change is not finished when you click save. It is finished when the managed sites report the expected state.
# Glossary
Source: https://altostrat.io/docs/sdx/en/resources/glossary
Definitions for common Altostrat SDX terms used across documentation, the portal, and operational workflows.
Use this glossary when you need a precise meaning for SDX terms.
| Term | Meaning |
| ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- |
| API user | The `altostrat-api` RouterOS user SDX uses for scheduled and synchronous automation tasks. Its logins are restricted by the control plane policy. |
| Authorization | A workflow authorization that lets workflows perform SDX actions on behalf of a user. |
| Authorizer | A workflow configuration that validates inbound JWTs for synchronous workflow requests. |
| Captive portal instance | A guest access configuration with strategy, session lifetime, theme, sites, and subnets. |
| Control plane policy | A centrally managed policy that controls router management services, trusted networks, ports, and management-plane filtering. |
| Fault | A normalized operational event such as site offline, site online, WAN offline, or WAN packet loss. |
| Heartbeat | A recurring check-in from a managed router that SDX uses to assess site health and deliver pending work. |
| Management VPN | The SDX OpenVPN management tunnel used for remote management and platform operations. |
| Peer | A managed VPN endpoint, such as a site peer or client peer. |
| Site | The SDX representation of a managed MikroTik router or branch location. |
| Site peer | A managed VPN peer that connects an SDX site and advertises selected subnets. |
| Transient access | Time-limited remote access for WinBox, SSH, or port access without leaving permanent broad exposure in place. |
| Vault | Encrypted workflow secret storage for API keys, tokens, passwords, and signing material. |
| WAN tunnel | One managed WAN failover link associated with a site interface and gateway. |
| Workflow run | One execution of a workflow, including status, trigger context, node logs, and output. |
| Workspace | The administrative container for users, sites, policies, workflows, billing, and resources. |
# Platform Resources
Source: https://altostrat.io/docs/sdx/en/resources/introduction
Use Altostrat SDX platform references for endpoint planning, troubleshooting, glossary terms, and operational best practices.
Platform resources are the reference pages you use when you are not configuring one feature, but making the operating environment safer and easier to run.
Use this section for endpoint planning, management tunnel behavior, troubleshooting paths, terminology, and repeatable operating practices.
## Resource Map
Work through the standard checks for offline sites, failed jobs, VPN issues, captive portal issues, and workflow failures.
Understand the OpenVPN-based management tunnel SDX uses for router operations.
Review the outbound destinations and management addresses your network should allow.
Look up common SDX terms used across sites, policies, workflows, and connectivity.
## Operating Principle
SDX is designed around outbound connectivity from managed sites. Routers check in, fetch jobs, report status, and maintain a management tunnel without requiring you to expose inbound management ports to the public internet.
That means most platform preparation comes down to:
* Allowing required outbound traffic.
* Keeping control-plane policies accurate.
* Tagging and naming resources clearly.
* Watching faults, workflows, and job outcomes after changes.
* Using transient access instead of permanent broad management exposure.
# Management VPN
Source: https://altostrat.io/docs/sdx/en/resources/management-vpn
Understand the SDX management VPN used for router management, monitoring, jobs, and transient access.
The management VPN is the secure management path between an adopted MikroTik router and Altostrat SDX. During onboarding, SDX creates a PPP profile and an OpenVPN interface on the router. That interface connects outbound to `api.altostrat.io` on TCP port `8443` using AES-256 encryption.
The tunnel is for platform management. It is not a general user VPN and should not be treated as a branch internet path.
## What It Enables
The management VPN supports SDX operations such as:
* Site health and check-in behavior.
* Scheduled and synchronous automation tasks.
* Transient WinBox, SSH, and port access.
* Control plane policy operations.
* Configuration backup and diagnostic workflows.
* Site actions such as recreating the management tunnel or management filter.
```mermaid theme={null}
flowchart LR
Router["MikroTik router"] -->|OpenVPN TCP 8443| SDX["Altostrat SDX"]
SDX --> Jobs["Device jobs"]
SDX --> Access["Transient access"]
SDX --> Monitoring["Health and telemetry"]
```
## Addressing
Management tunnel addresses are selected from `100.64.0.0/10`. SDX also uses `154.66.115.255` as a management-plane address in control-plane filters and API-user restrictions.
During onboarding, SDX also creates the `altostrat-api` user for automation tasks. The portal copy notes that logins for this user are restricted to `154.66.115.255`.
Do not remove the management VPN, the `altostrat-api` account, or the control-plane filter unless you have a recovery path. Those pieces are part of how SDX manages the router.
## Recover The Tunnel
If the management VPN appears missing or corrupted:
Go to the affected site and open the site actions menu.
Select **Recreate Management VPN**. SDX dispatches the site action `site.recreate_tunnel` to tear down and rebuild the secure tunnel to the platform.
If management firewall rules are also suspect, select **Recreate Management Filter**. This reapplies the SDX management firewall rules.
Watch the site state and orchestration history until the site resumes normal check-ins.
## Firewall Planning
Your upstream firewall should allow outbound connections from managed routers to SDX service endpoints. For the management tunnel, allow outbound TCP `8443` to `api.altostrat.io`.
No public inbound management rule is required for the tunnel itself because the router initiates the connection.
## Related Pages
Review endpoint planning for firewalls and control-plane filters.
Manage trusted networks, service ports, and management access.
# Regional Servers
Source: https://altostrat.io/docs/sdx/en/resources/regional-servers
Understand how SDX regional infrastructure relates to router management and when operators need to think about regions.
SDX infrastructure is distributed so managed sites and services can operate close to users and routers. In day-to-day operations, you normally do not select a management server manually. You prepare outbound access to the SDX service names and let the platform route the connection.
## What Operators Need To Know
* The management VPN is created as an outbound OpenVPN connection to `api.altostrat.io` on TCP `8443`.
* Managed VPN instances have an explicit region because the region affects peer latency.
* Captive portals, workflow services, backups, reporting, and API calls rely on platform service endpoints rather than manual per-server selection.
* If your firewall supports DNS allowlists, prefer service names over static IP rules.
## When Region Choice Matters
You should think about regions when:
* Creating a managed VPN instance.
* Planning latency-sensitive site-to-site or remote-user VPN access.
* Troubleshooting a site whose upstream firewall or ISP restricts outbound destinations.
* Coordinating with Altostrat support on an infrastructure change.
For managed VPN, choose the region closest to the majority of peers. For management VPN, focus on allowing the documented service endpoint rather than hardcoding a regional node.
## Firewall Guidance
If your organization requires IP-based firewall rules, keep the regional endpoint list as a controlled operational artifact. Confirm the current list before enforcing it, because infrastructure can move independently of documentation releases.
Use the endpoint summary in [Trusted IPs and Endpoints](./trusted-ips) as your first planning reference, then add IP-level restrictions only when your environment requires them.
# Short Links
Source: https://altostrat.io/docs/sdx/en/resources/short-links
Create temporary short links in workflows with configurable expiration.
Short links let a workflow turn a long URL into a shorter temporary URL. Use them when you need to send signed report links, coupon links, dashboard links, or other long URLs through email, chat, or notification channels.
In workflows, the **Shorten Link** action accepts a destination URL and a time-to-live in days.
## Configuration
| Field | Meaning |
| --------------- | ------------------------------------------------------------------------------------ |
| Destination URL | The long URL the short link should redirect to. This can include workflow variables. |
| TTL | How long the short link remains active before expiring. |
Supported TTL choices in the workflow action are:
* 1 day
* 3 days
* 7 days
* 30 days
* 90 days
The default TTL is 7 days.
## Good Uses
* Sharing a signed PDF or report URL from a workflow notification.
* Sending a temporary link to a generated captive portal coupon document.
* Making long dashboard or workflow output URLs easier to read in an email.
* Giving an external system a short-lived redirect link instead of a permanent URL.
## Operating Guidance
* Choose the shortest TTL that gives the recipient enough time.
* Do not use short links as access control by themselves. The destination should still enforce its own authorization or signature where needed.
* Avoid shortening URLs that contain secrets in query parameters.
* Include enough context in the notification so users know why they received the link.
## Related Pages
Review the Shorten Link action with other workflow nodes.
Use coupon workflows and notification delivery for guest access.
# Troubleshooting
Source: https://altostrat.io/docs/sdx/en/resources/troubleshooting
Follow practical troubleshooting paths for offline sites, management VPN issues, failed jobs, WAN failover, captive portals, and workflows.
Use this page when an SDX-managed site or service does not behave as expected. Start with the narrowest symptom, then work outward from device reachability to service configuration and finally workflow or automation state.
## First Checks
Before feature-specific troubleshooting, check:
* The site exists in the expected workspace.
* The site status and last heartbeat are current.
* The management VPN is connected or recently connected.
* The control plane policy still allows the required management services.
* The fault log shows the same symptom you are investigating.
* Recent scripts, workflows, or policy changes did not coincide with the issue.
## Site Is Offline
1. Check the site's last heartbeat time.
2. Confirm the local router has outbound internet access.
3. Confirm outbound access to SDX endpoints is not blocked by an upstream firewall.
4. Review recent WAN faults or ISP issues.
5. If the router is reachable locally, check whether the SDX management interface still exists.
6. Use **Recreate Management VPN** only when you have reason to believe the tunnel configuration is missing or corrupted.
The platform marks site health from router check-ins. A site can have working local LAN traffic and still appear offline if the management path is blocked.
## Management VPN Is Missing Or Broken
1. Open the site controls.
2. Run **Recreate Management VPN**.
3. If management firewall rules are also suspect, run **Recreate Management Filter**.
4. Watch the orchestration or site job output.
5. Confirm the site returns online and that management tasks work again.
If a newer MikroTik device returns `failure: not allowed by device-mode`, enable advanced mode on the device before retrying the relevant setup action. The portal surfaces the RouterOS command when this condition applies.
## Device Job Or Script Failed
1. Open the scheduled script, workflow run, or site orchestration log.
2. Find the target site outcome rather than relying only on the parent job status.
3. Check whether the script depends on a RouterOS feature not present on that device.
4. Confirm the `altostrat-api` user and control plane policy still permit required actions.
5. Retry on one test site before relaunching a broad rollout.
## WAN Failover Is Not Switching
1. Confirm each WAN tunnel has the expected interface and gateway.
2. Confirm priorities are saved in the intended order.
3. Check live WAN health for packet loss, jitter, latency, and tunnel status.
4. Review WAN faults for offline and recovery events.
5. Test during a maintenance window by changing priority order or disconnecting the primary link.
## Captive Portal Users Cannot Log In
1. Confirm the portal instance is attached to the correct site and subnet.
2. Confirm the user's device is actually on that subnet.
3. For OAuth2, confirm the auth integration is valid and the provider can be reached before login.
4. For coupons, confirm the code is valid, unexpired, and not already redeemed.
5. Check the session TTL and whether the user had a previous active session.
## Workflow Did Not Run
1. Confirm the workflow is active.
2. Confirm the trigger matches the expected event type.
3. Check whether the workflow authorization is still valid.
4. Check vault secrets used by the failing nodes.
5. Open the workflow run and inspect node-level logs.
6. For workflow chaining, check for dependency validation errors or inactive target workflows.
## When To Escalate
Escalate with these details ready:
* Workspace and site name.
* Time range of the failure.
* Relevant fault IDs or workflow run IDs.
* The affected service, such as management VPN, WAN failover, captive portal, or workflows.
* The last known successful change or run.
* Whether local router access is available.
# Trusted IPs and Endpoints
Source: https://altostrat.io/docs/sdx/en/resources/trusted-ips
Plan firewall allowlists, control-plane trusted networks, and outbound SDX service access.
Use this page when you need to prepare firewalls, control-plane policies, or router trusted-network lists for SDX.
## Endpoint Summary
| Destination | Purpose | Allow |
| ----------------------- | --------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------- |
| `api.altostrat.io` | Management VPN endpoint used by managed routers | Outbound TCP `8443` for the management VPN |
| `v1.api.altostrat.io` | Public SDX API base URL used by the portal and integrations | HTTPS from user browsers, integrations, and services that call the public API |
| `sftp.sdx.altostrat.io` | Configuration backup upload target used by SDX backup jobs | SFTP from managed routers when backup jobs run |
| `154.66.115.255/32` | SDX management-plane address used in control-plane defaults and transient access restrictions | Include in control-plane trusted networks where SDX must manage the router |
Prefer DNS names for outbound firewall rules when your firewall supports them. IP addresses behind service names can change as platform infrastructure evolves.
## Control Plane Trusted Networks
Control plane policies define which source networks can reach management services such as WinBox, SSH, HTTP, HTTPS, Telnet, FTP, API, and API-SSL.
The default control-plane policy includes:
* `154.66.115.255`
* `10.0.0.0/8`
* `172.16.0.0/12`
* `192.168.0.0/16`
Adjust these networks to match your security model. For production, avoid broad private ranges unless you intentionally trust every internal source that can reach the router.
## Management Tunnel Addressing
The management VPN uses addresses from `100.64.0.0/10`. Do not reuse this range for site LANs if it would create routing ambiguity with the SDX management tunnel.
## Practical Firewall Rules
At minimum, managed routers need:
* Outbound TCP `8443` to `api.altostrat.io` for the management VPN.
* Outbound HTTPS to `v1.api.altostrat.io` for portal and integration calls to the public SDX API.
* Outbound SFTP to `sftp.sdx.altostrat.io` when configuration backups are enabled.
For operator devices, allow HTTPS access to the portal and API endpoints used by your organization.
## When You Need IP-Based Allowlists
If your environment cannot use DNS-based rules, keep IP allowlists under change control and confirm the current list with Altostrat before enforcing them. Avoid copying old regional IP lists between environments without validation.
## Related Pages
Understand how the outbound tunnel is created and recovered.
Configure router management services and trusted networks.
# Audit Logs
Source: https://altostrat.io/docs/sdx/en/security/audit-logs
Search workspace activity to investigate changes, access, errors, and security-sensitive events.
Audit Logs help you answer operational questions about activity in your SDX workspace: who made a change, when it happened, what area of the platform it touched, and whether the request succeeded.
## Prerequisites
* You have permission to view audit logs for the workspace.
* You know the approximate time range, user, resource, or event type you want to investigate.
## When to Use Audit Logs
Use audit logs when you need to:
* Investigate an unexpected policy, site, or user change
* Review access before or after an incident
* Confirm whether a request succeeded or failed
* Support change management or compliance review
* Correlate portal activity with monitoring and fault events
## Search and Filter
Start with the narrowest information you already know.
1. Open **Settings** and select **Audit Logs**.
2. Set the time range around the event.
3. Filter by user, status, method, or event details when available.
4. Review failed requests and error responses first if you are investigating breakage.
5. Compare the timestamp with related [Fault Logging](../monitoring/fault-logging), workflow runs, or notification events.
## Investigation Pattern
For a suspected configuration regression:
1. Identify when the behavior changed.
2. Search audit logs around that time.
3. Look for policy, site, team, role, script, or workflow changes.
4. Confirm whether the actor and action were expected.
5. Use the relevant feature page to inspect the current configuration.
## Good Practices
Use named users for operational work instead of shared accounts. Give users roles that match their responsibilities. When a user changes teams or leaves, update their access promptly so future audit review remains clear.
Audit logs are most useful when paired with least-privilege roles. See [User and Team Management](../account/user-and-team-management) for access control guidance.
# Security Essentials
Source: https://altostrat.io/docs/sdx/en/security/bgp-threat-mitigation
Use continuously updated threat mitigation lists to reduce exposure to known-risk network destinations.
Security Essentials policies attach curated network threat lists to managed sites. Each list includes operational metadata such as prefix count, BGP community, update interval, and last updated time so you can understand what the policy is doing before you attach it.
## Prerequisites
* You understand which sites should use the policy.
* You can test critical applications after attaching a new policy.
* You have a rollback plan for high-sensitivity environments.
## How It Works
Security Essentials policies are made from one or more list categories. SDX keeps the lists updated, and the policy determines which sites receive that protection.
List metadata helps you review operational impact.
| Field | Why it matters |
| --------------- | ----------------------------------------------------------------------------- |
| Prefix count | Shows the approximate size of the list. Larger lists can have broader impact. |
| BGP community | Identifies the route community used by the mitigation list. |
| Update interval | Shows how frequently the list is refreshed. |
| Last updated | Helps you verify freshness before rollout. |
Treat DoH and DoT related categories carefully. Blocking public encrypted DNS providers can strengthen DNS enforcement, but it can also affect clients that rely on those resolvers.
## Attach a Policy
1. Open **Policies** and select **Security Essentials**.
2. Create or edit a policy.
3. Select the list categories that match your risk posture.
4. Review prefix count and update metadata for each selected list.
5. Attach the policy to a small set of representative sites first.
6. Test critical traffic paths.
7. Roll out to the remaining sites after validation.
## Advanced Rollout Pattern
For production fleets, use a staged rollout.
1. Attach the policy to a low-risk pilot site.
2. Monitor connectivity, support tickets, and [Fault Logging](../monitoring/fault-logging).
3. Expand to a tagged group of similar sites.
4. Keep a stricter policy for higher-risk networks and a conservative policy for sensitive business locations.
## Troubleshooting
If a destination stops working after policy attachment, compare the timing of the failure with the policy change, test from a site without the policy, and review whether the destination belongs to a selected list category. If the policy is too broad for that environment, detach it or move the site to a narrower policy.
Security Essentials reduces exposure to known-risk networks. Use [DNS Content Filtering](./dns-content-filtering) for web category control and [Security Groups](./security-groups) for explicit firewall intent.
# DNS Content Filtering
Source: https://altostrat.io/docs/sdx/en/security/dns-content-filtering
Create DNS policies that combine category filtering, SafeSearch enforcement, and domain allow or block lists.
DNS Content Filtering lets you control browsing behavior across managed sites without hand-editing DNS rules on each router. A policy can combine category controls, SafeSearch settings, and explicit domain lists.
## Prerequisites
* You have access to the team that owns the target sites.
* The sites you want to protect are online and managed by SDX.
* You know whether the policy should apply broadly or only to tagged site groups.
## Policy Structure
DNS policies are built from three main areas.
Choose content and application categories to block. Adult content can be controlled separately from other categories.
Select the search engines where SDX should enforce safer search behavior.
Add explicit domain allow-list or block-list entries when a category alone is too broad.
Domain lists are useful for exceptions. For example, you can block a broad category while allowing a required business domain inside that category, or you can block a specific domain that is not covered by a category.
DNS-over-HTTPS and DNS-over-TLS can let clients bypass DNS controls if the network allows them. If you enable DoH or DoT blocking, validate the result with your endpoint and network teams because it can affect public DNS clients and privacy tooling.
## Create a DNS Policy
1. Open **Policies** and select **Content Filtering**.
2. Create a policy with a clear name that describes its purpose, such as `Branch Standard` or `Guest Wi-Fi Strict`.
3. Select the categories you want to block.
4. Configure SafeSearch for supported search engines.
5. Add domain allow-list or block-list entries for precise exceptions.
6. Attach the policy to the sites that should use it.
7. Monitor user reports and site health after the change.
## Advanced Use Cases
Use multiple policies when one audience should have a different browsing posture from another. For example, guest networks, staff networks, and education environments often need different category and domain choices.
Use site tags to keep assignments maintainable. Instead of attaching a policy to every site manually, group sites with tags such as `environment:guest`, `region:apac`, or `site-type:school`, then apply the policy consistently to that group.
## Validation
After you attach a policy, test from a client behind the target site.
1. Confirm blocked categories fail as expected.
2. Confirm allowed business domains still resolve.
3. Confirm SafeSearch behavior in the selected search engines.
4. Watch [Fault Logging](../monitoring/fault-logging) and user reports for unintended impact.
Pair DNS Content Filtering with [Security Essentials](./bgp-threat-mitigation) when you need both web category control and network-layer threat mitigation.
# Security & Compliance
Source: https://altostrat.io/docs/sdx/en/security/introduction
Understand the policy layers Altostrat SDX gives you for content control, threat mitigation, firewall rules, vulnerability scanning, and auditability.
Altostrat SDX centralizes the controls that are usually scattered across routers, scripts, spreadsheets, and security tools. You define security intent in the portal, attach it to the right sites, and use monitoring, reports, and audit logs to verify what changed.
Security in SDX is layered. DNS policies influence where users can browse. Security Essentials policies block known-risk network destinations. Security groups shape allowed traffic. Vulnerability schedules identify exposed CVEs. Audit logs help you investigate who changed what.
```mermaid theme={null}
flowchart LR
User["Users and devices"] --> DNS["DNS content filtering"]
User --> SG["Security groups"]
Internet["Internet destinations"] --> Essentials["Security Essentials"]
Router["Managed MikroTik sites"] --> CVE["Vulnerability schedules"]
DNS --> Audit["Audit logs"]
SG --> Audit
Essentials --> Audit
CVE --> Audit
```
## Choose the Right Control
Use each security feature for a different part of your operating model.
Apply category, SafeSearch, domain allow-list, and domain block-list policies to sites.
Attach continuously updated threat mitigation lists to reduce exposure to known-risk networks.
Build reusable firewall policies with ordered rules, common services, custom ports, CIDRs, and prefix lists.
Schedule CVE scans, review affected hosts, and track remediation status across sites.
Search workspace activity when you need to understand a change, investigate access, or support compliance review.
## Operating Pattern
1. Start with broad site segmentation using teams, tags, and security groups.
2. Add DNS content policies for user-facing environments.
3. Attach Security Essentials policies where internet egress needs threat mitigation.
4. Schedule vulnerability scans for networks with devices you are responsible for maintaining.
5. Review audit logs and monitoring data before and after high-risk changes.
Use tags from [Metadata and Tags](../fleet/metadata-and-tags) to keep security assignments scalable. A tag-driven operating model is easier to maintain than one-off policy exceptions per site.
# Security Groups
Source: https://altostrat.io/docs/sdx/en/security/security-groups
Create reusable firewall policies with ordered rules, services, ports, CIDRs, prefix lists, and site assignments.
Security groups let you define traffic policy once and apply it consistently across managed sites. They are useful when you need repeatable firewall intent for branches, customer networks, cameras, servers, guest networks, or restricted environments.
## Prerequisites
* You know the sites or tags that should receive the policy.
* You know which services, ports, and source or destination networks should be allowed.
* You have a maintenance window for rules that could affect user traffic.
## Rule Model
Security group rules are ordered. Lower order values are evaluated before higher order values, so place specific rules before broader rules.
Each rule can include:
* Order, from `1` to `1000`
* Direction and action
* Protocol
* Common service or custom port
* Address target, including custom CIDR entries and prefix lists
* Description for future operators
New security groups are seeded with common outbound allowances for HTTPS, ICMP, and DNS. Review those defaults before you attach the group to production sites.
## Prefix Lists
Prefix lists are reusable CIDR collections. Use them when the same network ranges appear in multiple rules, such as partner networks, datacenter ranges, or internal service ranges.
Prefix lists make changes safer because you update the range once, then every rule that references the list follows the updated definition.
## Create a Security Group
1. Open **Policies** and select **Security Groups**.
2. Create a group with a name that describes the protected environment.
3. Review the default outbound rules.
4. Add rules in the order they should be evaluated.
5. Use common services where possible, then custom ports when needed.
6. Use prefix lists for reusable network ranges.
7. Attach the group to a pilot site or tagged site group.
8. Validate critical traffic before a broader rollout.
## Advanced Use Cases
Use separate groups for separate security intent. A point-of-sale environment, guest network, camera VLAN, and office network should usually have different rule sets.
Use descriptions on every non-obvious rule. Six months later, the description is often the fastest way to decide whether a rule is still required.
Use tags for scalable assignments. For example, assign a policy to all sites tagged `site-type:retail` instead of maintaining a manual list.
For temporary management access, use [Secure Remote Access](../fleet/secure-remote-access) instead of creating permanent allow rules for administrative ports.
# Vulnerability Scanning
Source: https://altostrat.io/docs/sdx/en/security/vulnerability-scanning
Schedule CVE scans, review affected hosts, and track remediation status across managed sites.
Vulnerability scanning helps you identify known CVEs on networks managed by Altostrat SDX. You can schedule scans, review generated reports, inspect affected hosts, and track remediation status over time.
## Prerequisites
* You have permission to run scans for the target team and sites.
* You know the networks or hosts that should be scanned.
* You have approval to scan production networks.
## What a Scan Produces
CVE reports summarize the risk picture for the selected targets. Reports can include:
* Hosts scanned
* Hosts with CVEs
* Sites with CVEs
* Total CVE count
* Unique CVE count
* Repeat ratio
* Highest and average CVE score
* Affected host details, including MAC address where available
* CVE status and operator notes
## Create a Schedule
1. Open **Vulnerabilities** and select **CVE Schedules**.
2. Create a schedule for the sites or targets you want to scan.
3. Choose timing that will not surprise local users or operations teams.
4. Save the schedule.
5. Review generated results under **CVE Reports**.
## Review Results
Start with the highest-scoring findings and repeated findings across multiple hosts. Repeated CVEs usually indicate a shared device model, firmware family, or exposed service pattern.
For each important finding:
1. Confirm the host and service are still present.
2. Assign a remediation owner.
3. Record status and notes in the report workflow.
4. Re-scan after remediation to confirm the result.
## Advanced Use Cases
Use recurring schedules for environments where device inventory changes frequently. Use focused scans for targeted validation after a firmware update, firewall change, or incident response activity.
Use [Script Management](../automation/script-management) carefully when you need to collect evidence or apply repeatable remediation commands across multiple MikroTik devices.
A vulnerability report is a signal for investigation, not automatic proof that a device is exploitable in your environment. Validate exposure, compensating controls, and business impact before prioritizing remediation.
# AI Copilot
Source: https://altostrat.io/docs/studio/en/ai-copilot
Use Copilot modes, models, approvals, context, slash commands, queue and steer, sub-agents, and durable outputs safely.
Copilot is Studio's context-aware AI operating surface. It can reason over conversations, active tabs, hosts, files, procedures, memories, connectors, browser sessions, remote desktops, calls, and generated work. Its tools can inspect systems, open operational surfaces, and—after the required approval—change external state.
## Modes and Autopilot
Response mode and autonomy are separate controls.
| Control | Exact behavior | Use it for |
| --------- | ----------------------------------------------------------------------- | ----------------------------------------------------------------- |
| Default | Full tool access; acts as needed and pauses where approval is required. | Normal interactive operations. |
| Ask | Read-only tools and a conversational answer. | Explanation, review, and evidence gathering. |
| Planning | Researches first, then proposes a plan. | Unfamiliar or multi-step work that needs review before execution. |
| Autopilot | Auto-approves all tools and removes the turn limit. | Bounded, controlled work with a verified target and blast radius. |
Autopilot bypasses per-tool approval prompts. Do not enable it merely to clear a stuck approval or speed up an unverified production task.
## Models and context windows
**Auto (recommended)** is the default for new chats and standalone AI workflows. Auto chooses an appropriate Sonnet or Opus model per message. You can select a different model for a conversation without changing the global default.
For models that support selectable windows, Settings offers:
* **200K (recommended)** — summarizes sooner and keeps long conversations less expensive.
* **1M (extended)** — retains substantially more context before summarizing, with materially higher cost for long sessions.
Changing the default affects new chats and standalone workflows. An existing chat with an explicit model selection keeps it.
## Context hierarchy
Copilot's answer can be shaped by several layers:
1. Organization context and organization tool policy.
2. Your member context and preloaded tools.
3. The active channel's grounding and tool policy.
4. Conversation history, model, and mode.
5. Explicit mentions, attachments, and active-tab context.
Explicit context is the most reliable. Mention or attach the exact object instead of relying on Copilot to infer which host, file, tenant, or procedure you mean.
### What you can attach or mention
* Hosts and their configured protocols.
* Files, generated artifacts, dashboard apps, and session replays.
* Procedures and procedure runs.
* Connectors, MCP servers, and tools.
* The active terminal, browser, remote desktop, dashboard, or editor.
* Selected terminal output or an image.
* Computer Use when a local desktop application is the target.
Never attach a raw secret. Reference a Key Chain entry or complete the integration's account flow instead.
## Tools and approvals
Copilot tools span host access, local diagnostics, terminals, RDP, browser, Computer Use, inventory, diagrams, files, dashboards, calls, procedures, memory, connectors, MCP, planning, scheduling, and sub-agents.
Studio evaluates a proposed action before dispatch:
| Kind | Examples | Normal posture |
| ------------------------ | ----------------------------------------------------------------------------------- | ---------------------------------------------------------- |
| Read-only | Search, snapshots, ping, inventory lookup, file read, browser inspection. | Runs in Ask and other modes. |
| State-changing | Terminal configuration, click/type, file write, connector mutation, inventory edit. | Pauses for review unless explicitly auto-approved. |
| Dangerous or destructive | Reload, erase, delete, format, irreversible external operation. | Requires an explicit high-friction approval or is blocked. |
| Unknown | Action Studio cannot classify with confidence. | Treated as review-required. |
An approval is scoped to the displayed action. **Allow for session** is broader; use it only after you have verified the recurring target and operation.
## Browser AI Grounding
Enable **Browser AI Grounding** from the composer when Copilot needs stronger visual understanding of an unfamiliar or complex webpage. It can improve browser decisions, but adds token use to browser actions. See [Browser and Computer Use](./browser-and-computer-use) for takeover and browser autopilot.
## Queue and steer
While Copilot is working, a new message can either:
* **Queue** — preserve the current run and deliver the message at its next completion boundary.
* **Steer** — inject the message into the current run so Copilot changes direction.
Choose the default under **Settings → AI → Follow-up behavior**. Use `Command+Enter` on macOS or `Control+Enter` for the opposite action.
Steer when the target, assumption, or scope is wrong. Queue when you want the current task to finish before a related follow-up begins.
## Slash commands
System commands change the current conversation without a long prompt.
| Command | Effect |
| ----------------------------------------- | --------------------------------------------------------------- |
| `/compact [focus instructions]` | Summarize older context, optionally preserving the named focus. |
| `/clear` | Start a fresh conversation. |
| `/model ` | Select the current conversation's model. |
| `/effort ` | Set reasoning effort. |
| `/thinking ` | Set thinking behavior. |
| `/plan` | Enter Planning mode. |
| `/trust ` | Change the supported trust posture. |
| `/devices` | Show connected devices. |
| `/audit` | Show recent action history. |
| `/help` | List commands available in this build. |
Tool shortcuts route a prompt toward a specific surface: `/dashboard`, `/host`, `/hosts`, `/terminal`, `/exec`, `/explain`, `/inventory`, `/connector`, `/mcp`, `/procedure`, `/memory`, `/history`, `/video`, `/sip`, `/delegate`, and `/tools`.
Connected and dynamically discovered tools can add more shortcuts. Type `/` and use the menu instead of memorizing the full catalog.
## Plans and sub-agents
Planning mode gathers evidence and renders an actionable plan. Review its targets, prerequisites, approval points, validation, and rollback before execution.
For work that can proceed independently, Copilot can delegate to sub-agents. Their live progress and approvals remain attached to the parent conversation. Delegation does not lift organization, channel, member, or approval restrictions.
Digital workers are different: they are owner-enabled, cloud-run pipelines bound to a shared channel. See [Digital workers](./digital-workers) before turning an interactive workflow into unattended automation.
## Durable outcomes
Ask Copilot to preserve work in the right form:
| Outcome | Save it as |
| ------------------------------------ | --------------------------------------------------------- |
| Evidence, timeline, or handoff | Markdown artifact or exported PDF. |
| Live operational view | Dashboard. |
| Custom interaction | Sandboxed dashboard app. |
| Repeatable operator path | Procedure. |
| Stable operational fact | Memory. |
| Built app or durable artifact record | Organization memory, created automatically or on request. |
Organization memory stores last-known work-product state, not live proof. Verify a path, process, deployment, or URL before claiming it is currently available.
## Usage and cost
The transcript can show turn, token, model, and cost context. Open **Usage → Per-chat** for your detailed conversation history and **Usage → AI** for aggregate and model views.
Reduce unnecessary cost by attaching precise context, compacting long chats, avoiding repeated failed tools, and using Browser AI Grounding only when the page needs it.
## Safe operating pattern
1. Confirm organization, channel, host, tenant, and credential scope.
2. Start in Ask for explanation or Planning for a change.
3. Attach the exact active evidence.
4. Review the plan and remove out-of-scope actions.
5. Move to Default when you are ready to approve execution.
6. Steer immediately if Copilot follows a wrong assumption.
7. Validate the external result with a read-only check.
8. Save the durable outcome and set the conversation status.
## Related
Choose model, context window, region, Autopilot, follow-up behavior, and turn limits.
Review model, token, conversation, call, and transcription usage.
# Agent and local runtime
Source: https://altostrat.io/docs/studio/en/ai-safety/agent-and-local-runtime
How Studio divides work between the Electron desktop app and its local Go agent, including protocol access, local data, credentials, recordings, and the loopback trust boundary.
Studio ships an Electron desktop app together with a local Go agent. The desktop app owns the workbench, conversations, cloud-backed records, and approval UI. The Go agent owns many device-facing and machine-facing capabilities, including terminal protocols, diagnostics, packet capture, browser automation, local indexing, and vault cryptography.
This boundary improves capability separation, but both processes run inside the signed-in workstation's trust boundary. A compromised desktop account or privileged local process is not made safe merely because a capability lives in the agent.
## Responsibility split
| Component | Primary responsibilities |
| -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Electron app | Workspace UI, organizations and channels, conversations, context assembly, approval presentation, registry synchronization, calls, settings, and cloud service clients. |
| Go agent | SSH, Telnet, serial, RDP, VNC and related protocol work; discovery and diagnostics; packet capture; terminal recording; browser and native tools; local search index and knowledge graph; vault encryption and decryption operations. |
| OS security services | Protect the desktop app's locally cached key material and enforce permissions such as Screen Recording, Accessibility, microphone, camera, capture, and network access. |
The exact tool set depends on the platform, organization policy, channel policy, and the permissions granted on that workstation.
## Local loopback boundary
The desktop app talks to the local agent over loopback. Loopback prevents remote network clients from reaching the service directly, but it does not make every endpoint unreachable to other software already running as the user. The agent therefore also uses origin checks, scoped identity, approval tokens, and capability-specific controls where implemented.
Treat malware or an untrusted local process on an unlocked workstation as a serious boundary failure. Studio's local controls reduce accidental or cross-context access; they are not a sandbox against a fully compromised endpoint.
## Local data
Studio uses several forms of local state:
| Store | Typical contents | Important boundary |
| ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- |
| Electron local database | Cached or authoritative copies of workspace entities, depending on entity type. | Sensitive synchronized fields use envelope encryption, but metadata needed for lists and synchronization may remain plaintext. |
| Go agent database | Downstream mirrors used by tools, indexed chunks, embedding vectors, knowledge-graph nodes and edges, and recent operational data. | The database is local to that workstation and scoped by organization identifiers. |
| OS-protected storage | Cached data-encryption keys and session material protected with Electron `safeStorage` and the platform's credential service. | Protection depends on the signed-in OS account and the security of the unlocked endpoint. |
| Recording directory | Terminal recordings in asciicast form and associated metadata. | Treat local recording files as sensitive operational evidence; local files are not made safe by organization envelope encryption. |
| Workspace files | Uploads, generated files, replay archives, screenshots, and other artifacts. | Visibility depends on the file's scope and whether it has been synchronized or shared. |
Do not assume “local” means “encrypted,” and do not assume “visible in Studio” means “shared.” Check both the local storage boundary and the resource visibility.
## Vault operations and plaintext
The Go agent performs supported AES-GCM vault operations through the BoringCrypto-backed build. Per-organization data-encryption keys are wrapped through AWS KMS and cached locally through OS-protected storage for a limited period. Sensitive synchronized fields are encrypted before cloud persistence.
Plaintext still exists when a value is displayed, edited, or used:
* Some decrypted record fields can materialize in the Electron renderer while their editor or consumer is active.
* A protocol or connector must receive the resolved secret at the point of authentication.
* A compromised renderer or privileged process may observe values in memory on an unlocked endpoint.
* Putting a secret into a prompt, procedure argument, terminal command, generated file, or recording creates a new exposure outside the Key Chain record.
Use Key Chain references and supported credential-resolution paths. See [Vault and keys](./vault-and-keys) and [Known limits and roadmap](./known-limits-and-roadmap) for the cryptographic design and remaining plaintext boundaries.
## Local search and organization memory
The Go agent can chunk supported Studio entities, produce embeddings with the installed local ONNX model, and maintain a local vector index and knowledge graph. Local retrieval can return candidate records without sending the entire local corpus to the model.
The selected results can still enter a model prompt when a conversation or tool uses them. Organization work-product memory is a separate cloud-backed, policy-scoped capability. Read [Memories and search](../memories-and-search) before assuming that every search or memory path is local-only.
## Device access and Computer Use
Network diagnostics and device protocols execute with the workstation's routes and user privileges. Computer Use executes against the workstation's visible interface after the required OS permissions are granted.
* Studio does not create reachability that the workstation lacks.
* Packet capture, raw-network operations, and interface control may require additional OS permission.
* Screen inspection and state-changing clicks are separate tool effects even though both use the same desktop permission boundary.
* Approval behavior depends on the active response mode and tool policy; Autopilot removes per-call prompts for available tools.
See [Browser and Computer Use](../browser-and-computer-use) for operator controls.
## Terminal recordings
The local agent records supported terminal sessions and exposes them through Session Replays. Recordings preserve command input, output, and timing and can later be archived as Studio files.
Recordings can contain passwords typed into a terminal, tokens printed by a command, customer data, configuration, and other sensitive material. There is no reliable semantic redaction at capture time. Control who can access the workstation and any archived file, and avoid entering or printing a secret when recording is active.
## Calls and shared sessions
Calls use cloud media services and require a signed-in cloud session. Shared terminal sessions combine local device access with a collaboration path to other participants. The owner workstation remains responsible for the live device connection and its local permissions.
Review the participant list, interaction role, and resource visibility before sharing. See [Shared sessions](../shared-sessions) and [Calls and Audio Use](../calls-and-audio-use) for user-facing behavior.
## Updates and shutdown
The desktop app and Go agent ship as parts of the signed application. An application update can replace both. Signing out unloads organization key state and clears supported cached vault entries, but it does not retroactively remove exported files, terminal recordings, packet captures, or other evidence saved outside that cache.
## Operator checklist
1. Secure the workstation and OS account before granting broad Studio capability.
2. Install signed updates and review **Settings → About** when troubleshooting a version mismatch.
3. Grant only the OS permissions required for the current workflow.
4. Keep secrets in Key Chain and resolve them at execution.
5. Treat local recordings, captures, logs, and exported files as sensitive.
6. Verify the organization and channel after switching context.
7. Leave Autopilot off unless targets and external effects are already bounded.
## Related
Understand key wrapping, field encryption, rotation, and plaintext boundaries.
Review signing, build, and update controls.
Review browser sessions, takeover, native inspection, and desktop control.
See unresolved or operationally significant boundaries.
# AI provider and data flow
Source: https://altostrat.io/docs/studio/en/ai-safety/ai-provider-and-data-flow
How Studio sends selected context to AWS Bedrock, chooses models and regions, handles caching and compaction, and separates local work from cloud inference.
Studio's model catalog uses AWS Bedrock. The desktop does not call Anthropic's hosted API directly and does not offer a per-user API-key path that bypasses the configured Bedrock route.
## Current models
The current catalog includes:
| Selection | Use |
| ------------------ | ------------------------------------------------------------- |
| Auto (recommended) | Chooses Sonnet or Opus per message. |
| Claude Opus 4.8 | Complex reasoning and long work; supports 200K or 1M context. |
| Claude Sonnet 4.6 | General operational work with lower latency. |
| Claude Haiku 4.5 | Lightweight classification and background work. |
| Amazon Nova Micro | Small fallback tasks. |
Model availability can change by Studio release and Bedrock region. The selector in Studio is authoritative for the installed build.
## Inference regions
Choose the user-facing region under **Settings → AI → Bedrock region**:
| Selection | Claude route | Other supported regional work |
| ------------------------- | --------------------------------------------------------------------------------------------------------------- | ------------------------------------------------- |
| US (`us-east-1`) | US Bedrock inference profile. | US. |
| Sydney (`ap-southeast-2`) | Australia Bedrock inference profile. | Sydney. |
| Cape Town (`af-south-1`) | Frankfurt (`eu-central-1`) through the EU Claude profile because Claude is not natively invocable in Cape Town. | Supported OCR and voice work remain in Cape Town. |
Changing region resets the current conversation's prompt cache. The next call sends its full uncached input once.
The inference setting does not relocate Studio's identity, billing, organization records, or control-plane infrastructure. Treat model-processing region and application-data residency as separate review items.
## One Copilot turn
Studio combines the prompt, conversation history, organization and channel grounding, applicable memories, tool schemas, and the active objects you explicitly attached or mentioned.
Studio removes known secret patterns and excludes normal credential payloads in favor of references. Redaction is defense in depth, not permission to paste a secret.
Stable system and organization context precedes conversation and turn-specific content so Bedrock prompt caching can reuse eligible prefixes.
Studio signs the Bedrock request with scoped short-term AWS credentials and sends it over TLS to the resolved Bedrock endpoint.
Bedrock streams the response. Proposed tool calls pass through effective policy and the approval gate before dispatch.
Tool results are added to the agentic loop as context for the next model call. A result from a host, connector, MCP server, browser, or generated app is untrusted input until validated.
## What reaches model context
| Item | Reaches the model? |
| ------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------- |
| Prompt and visible conversation history | Yes. |
| Organization, member, and channel grounding | Yes, when applicable. |
| Mentioned host metadata, files, procedures, connectors, or tools | Yes, to the extent attached to the request. |
| Terminal, browser, RDP, Computer Use, dashboard, or editor context | Yes when explicitly or automatically attached for the requested action. |
| Images and voice transcription | Yes when sent as conversation context. |
| Retrieved memories | Yes when retrieval selects them. |
| Tool schemas and tool results | Yes. |
| Normal Key Chain credential payload | No; the model receives a reference or non-secret description. |
| A secret pasted into chat, a file, context, or tool output | It can. Do not paste it. |
| Generated artifact source | Only when the artifact is attached, opened for AI improvement, or otherwise selected as context. |
| Data from another organization | Not through a correctly scoped request; organization isolation and authorization apply before retrieval. |
## Local and cloud boundary
| Work | Location |
| ----------------------------------------------------------- | ---------------------------------------------------------------------------------------- |
| LLM inference | AWS Bedrock in the resolved region. |
| Supported transcription and OCR | AWS regional services selected by the workflow and region rules. |
| Terminal, packet capture, local discovery, and Computer Use | Workstation and Studio's local helper. |
| Browser automation | Studio-managed browser runtime, with results returned to the conversation. |
| Organization sync, billing, and shared records | Altostrat's cloud control plane. |
| Conversation and procedure state | Local working state plus organization/account synchronization according to the resource. |
Local execution does not mean its result stays local. When you send terminal output, a screenshot, a transcript, or a file to Copilot, that selected content becomes cloud inference context.
## Prompt caching and compaction
Prompt caching reduces repeated input processing when the prefix remains stable. Region, model, system context, and some policy changes can invalidate the cache.
Compaction replaces older conversation detail with a summary when a chat grows. Run `/compact [focus instructions]` when you want to preserve a named objective while dropping low-value history. For models with a selectable context window, 200K summarizes sooner and 1M retains more at materially higher long-session cost.
No summary is lossless. Start a new chat with explicit artifacts when exact historical detail matters more than continuity.
## Browser AI Grounding
Browser AI Grounding adds visual browser context to help Copilot interpret complex pages. It consumes additional tokens per action and can include visible page content. Enable it only for the browser session and task that need it.
## Thinking and effort
Supported models expose adaptive thinking and effort controls. Thinking state can be visible while a run executes; the durable transcript focuses on messages, tools, approvals, and results. Do not rely on an internal reasoning trace as an audit control—rely on the displayed action and recorded external evidence.
## Data-handling guidance
* Attach the minimum context necessary for the task.
* Use Key Chain references rather than plaintext secrets.
* Treat connector, MCP, browser, website, and file content as untrusted input.
* Verify model-generated conclusions against live read-only evidence.
* Check the configured region and model before regulated work.
* Review [Known limits and roadmap](./known-limits-and-roadmap) as part of security approval.
## Related
Understand response modes, tool classes, Autopilot, and other approval surfaces.
See how the desktop, renderer, helper, and cloud services divide work.
# Audit and telemetry
Source: https://altostrat.io/docs/studio/en/ai-safety/audit-and-telemetry
What Studio records about your work, what it sends to Sentry and Amplitude, how replay and redaction are configured, and where audit coverage still has gaps.
Two different things get called "logs" in most software. **Audit** is the record of meaningful actions taken in the application—who did what, when, against which resource. **Telemetry** is the operational signal used to keep and improve the application—performance, errors, feature events, and configured interaction replay. Studio has both. They are governed by different rules and are documented separately on this page.
## Audit
Studio runs as a managed SaaS in Altostrat's AWS account; you don't sign into Altostrat's AWS console or query its CloudTrail directly. Audit visibility is split between records exposed in Studio, records held in Altostrat's service accounts, and logs held by identity or target-system providers:
| Plane | What's captured | Visibility |
| ----------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- |
| Application history and audit | Conversation transcripts, procedure runs, tool calls, approval decisions, shares, ownership changes, and supported organization events. | Visibility follows the resource and administrative surface. Protected fields use the record's encryption path; not every metadata field is encrypted. |
| AWS infrastructure audit | Supported control-plane operations such as KMS, identity, storage, and model-service API activity. CloudTrail coverage and event detail depend on the AWS service and event class. | Altostrat's AWS account, available to Altostrat operations and producible where retained and appropriate for a security review. |
| Identity audit | Sign-in attempts, MFA prompts, session creation, organization membership changes, SSO events. | Clerk's audit log. We can produce relevant events on request; if your organization uses SSO, your IdP also has its own log. |
The combination is the answer to most "who did this and when" questions:
* **Who ran a procedure against a host on Tuesday?** Application audit (procedure run history) + the user's session record.
* **Why did a KMS unwrap fail?** CloudTrail can provide the KMS request, principal, encryption context, and denial detail where the event is retained. It does not by itself identify every application field later decrypted with the unwrapped data key.
* **Did a user share or change the visibility of a resource?** Start with the resource and application history, then correlate infrastructure evidence if the encrypted data path is relevant.
* **When did our DEK rotate last?** Producible from our CloudTrail (`KMS:GenerateDataKey` calls against your CMK on the 30-day cadence).
### What's in a procedure run record
A single procedure run captures, encrypted under the org DEK:
* The procedure's identifier and version at execution time.
* The argument values supplied.
* The full transcript of the agentic conversation: prompts, model responses, tool calls, tool results, approval decisions, sub-agent activity.
* Timing and token usage.
* The final output and the success/failure verdict against the procedure's success criteria.
This is the artifact you reach for when you need to reconstruct a change after the fact. Sharing a procedure run shares the full transcript with the recipient, subject to the resource's access scope.
### What's not in audit
The application audit deliberately does not record:
* The plaintext of any encrypted field.
* The plaintext of any credential, even when one was used during the run.
* Background telemetry counters that aren't tied to a user-visible action (those live in CloudWatch metrics, not in the per-user audit).
The honest gap: **per-decrypt audit logging is not yet implemented at the application layer**. The infrastructure for it is in place — every decrypt call carries a `purpose: DecryptPurpose` parameter — but the structured event emission keyed by `(purpose, recordId, userId)` is on the [roadmap](./known-limits-and-roadmap#decryption-audit). Until then, decrypt events are recorded only at the KMS layer in our CloudTrail, where they're producible on request but not surfaced inside Studio's own audit views.
## The user-facing audit surface
Inside Studio, the `/audit` slash command opens the recent action history for the current conversation: tool calls, approvals, model invocations. Cross-conversation organization-wide audit views are on the [roadmap](./known-limits-and-roadmap#organization-wide-audit-explorer); for now, requests outside the per-conversation view require correlation with retained application, infrastructure, identity, and target-system evidence.
## Telemetry
Studio sends telemetry to third-party vendors for reliability and product analysis. Content scrubbing, blocking, masking, and sampling differ by vendor; the current desktop app does not expose a general customer-facing telemetry switch.
### Sentry (error reporting)
Sentry receives selected desktop errors, crashes, warnings, and performance traces from the Electron renderer, main process, and local agent paths that are instrumented for it.
| Property | Behavior |
| --------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| What's sent | Stack traces, the exception message, breadcrumbs of recent user actions (UI navigation, tool invocations by name only), the application version, the OS version. |
| What's redacted before send | Authorization headers, password / secret / token / credential value patterns, private keys, and console messages matching sensitive-content patterns. Breadcrumbs drop request/response bodies. |
| Sample rate (production) | Performance traces default to 10%. Error events use client deduplication and event-specific filtering rather than a blanket 10% sample. |
| Session Replay | Disabled in the Sentry client as of the August 2026 release. |
| Region | The Sentry endpoint defaults to the US Sentry region. |
Sentry's default scrubbing is aggressive in Studio because the workspace contains terminal output that may have secrets in it by accident. False-positive redactions are preferred over false-negative leaks.
### Amplitude (product analytics)
Amplitude receives event-level analytics about which features are used.
| Property | Behavior |
| --------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| What's sent | Event names, event properties such as counts, durations, categories and relevant record identifiers, release environment, app version, Electron state, Amplitude device/session identifiers, and—after sign-in—the Studio user, organization, workspace, email, and display-name identity properties used by the analytics profile. |
| What's not intended as event properties | Credential values, authorization headers, raw conversation bodies, terminal output, file bodies, and raw tool payloads. Event schemas must continue to avoid placing operational content in analytics properties. |
| Session Replay | Enabled outside local development unless disabled by release configuration. The packaged default sample rate is currently 100%. Form inputs use medium masking; terminals, password fields, and marked sensitive regions are blocked; content-editable regions are explicitly masked. Internal Altostrat accounts are opted out in the client. |
| Region | Amplitude US data centre. |
Amplitude is for product-usage and interaction analysis. Its replay masking reduces exposure but is not equivalent to disabling capture. Do not display secrets in unprotected UI text, and contact Altostrat before deployment if replay collection conflicts with your policy.
### Web analytics on the docs site
This documentation site uses Fathom and Google Tag Manager. They are scoped to docs.altostrat.io traffic — they do not run inside the Studio desktop app and they do not see your operational data.
### Disabling telemetry
Studio is a managed SaaS—you don't run its service control plane in your own account—so telemetry control depends on the options exposed by the current desktop release:
| Telemetry | Today | If your posture requires more |
| ------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ |
| Sentry | Error/crash telemetry and sampled traces are on for production installs; Sentry Session Replay is off. Sensitive-content scrubbing and deduplication apply to supported client events. | There is no general customer-facing organization toggle documented in the current app. Contact Altostrat before deployment if this is a blocker. |
| Amplitude | Product analytics and masked Session Replay are enabled outside local development at the configured release sample rate. | There is no general customer-facing organization toggle documented in the current app. Contact Altostrat before deployment if this is a blocker. |
| Web analytics on this docs site | Fathom and GTM, scoped to docs traffic only. They never run inside the Studio desktop app. | Standard browser controls (Do Not Track, privacy mode, content blockers). |
## Data residency in audit and telemetry
| Surface | Region |
| ------------------------------- | ---------------------------------- |
| Application audit (DynamoDB) | `us-east-1`. |
| AWS CloudTrail (Altostrat-side) | `us-east-1`. |
| Clerk audit | Clerk's hosted region. |
| Sentry | Sentry's US ingestion endpoint. |
| Amplitude | Amplitude's US ingestion endpoint. |
If your organization has a strict residency requirement that conflicts with any of the above, talk to Altostrat before deployment. The AI inference region selector does not relocate audit, identity, billing, or other control-plane records; see [control-plane residency versus inference region](./known-limits-and-roadmap#control-plane-residency-versus-inference-region).
## Retention
| Surface | Default retention |
| ---------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Application history (procedure runs, conversation transcripts, share grants) | Until removed through supported product or organization lifecycle paths, subject to the record type and service policy. Deleting key material affects encrypted contents but does not necessarily erase unencrypted metadata immediately. |
| AWS CloudTrail (Altostrat-side) | Retained per our internal security policy for incident investigation; details available on request as part of a security review. |
| Clerk audit | Per Clerk's policy for the plan in use. |
| Sentry | Per Sentry's policy for the plan in use; Studio configures standard retention. |
| Amplitude | Per Amplitude's policy. |
## The honest gaps
Two telemetry/audit limits are worth being explicit about:
* **Per-decrypt audit logging is not yet GA.** As described above and in [known limits](./known-limits-and-roadmap#decryption-audit), decrypts are recorded at the KMS layer in our CloudTrail today; structured per-purpose events at the application layer (visible inside Studio) are the next iteration.
* **No first-party in-app audit explorer for an organization.** Today the audit surface inside the application is per-conversation. Cross-conversation organization-wide audit views are a roadmap item; in the meantime, ask Altostrat for relevant retained infrastructure or identity evidence when the application record is insufficient.
## Related
The cryptography that determines what audit logging at the decrypt boundary even means.
The roadmap for per-decrypt audit, organization-wide audit, and customer telemetry controls.
# Connectors and MCP safety
Source: https://altostrat.io/docs/studio/en/ai-safety/connectors-and-mcp-safety
How third-party API credentials are stored, how connector and MCP tool calls are gated, what happens when an OAuth token rotates, and the realistic limits on what we can prevent a remote MCP server from doing.
[Connectors and MCP servers](../connectors-and-mcp) are how Studio reaches the rest of your toolchain — the ticketing system, the monitoring platform, the carrier portal, the chat tool. They are also the most common path by which third-party data enters or leaves the workspace. This page describes the safety controls around them.
There is a hard truth here that we will not soft-pedal: a connector or MCP server is, by design, a way for Copilot to call out into a system you chose to add. Some of the safety story is what Studio enforces. Some of it is what the operator and the org admin are responsible for. The page is honest about both.
## Definitions, credentials, and policy
Studio separates three things that are easy to conflate:
1. The connector or MCP **definition**—URL, endpoints, transport, schemas, and tool descriptions.
2. The **credential** used at execution.
3. The effective **tool policy** that decides whether a member, channel, or worker may call it.
An organization definition can use **per-member** credentials, where every member connects a private Key Chain entry, or an explicitly provisioned **shared** organization/service credential. Admins can see readiness without reading a member's private secret.
Current connectors support none, basic, bearer, API key, digest, AWS SigV4, custom headers, and several OAuth 2 flows. MCP supports none, API key, bearer, client credentials, authorization code, and MCP-standard automatic OAuth. New secret values should be referenced through Key Chain rather than persisted inline in a definition; legacy inline fields are migrated or retained only for compatibility.
The model context should receive a credential reference, not the plaintext token. Custom templates, prompts, tool descriptions, context fields, and approval detail must not echo the resolved value.
## Per-call approval
Connector and MCP calls use the same runtime policy and [approval framework](./human-in-the-loop) as other tools. In a supervised posture, the review surface can show:
* The connector or MCP server name.
* The endpoint or tool being called.
* The arguments and request detail Studio makes available for review.
* The credential reference that will be used.
* The risk class — Read-only, Moderate, Dangerous, or Unknown.
Availability is layered. Organization policy can disable an integration or individual MCP tool; member and channel policy can narrow it; a worker stage can narrow it again. The runtime checks the effective policy at dispatch, so an old conversation cannot call a tool that was later disabled.
A connector endpoint that mutates external state—creates a ticket, posts a message, sends an SMS, or changes a remote record—should never be described as read-only. Destructive or high-impact operations need the strictest classification supported by the tool definition and organization policy.
Autopilot or an equivalent autonomous trust posture can bypass per-call review for tools that remain available under policy. Do not enable it while validating a new connector or MCP server.
## OAuth2 flows
Studio supports the OAuth2 flows real systems use:
| Flow | Use case |
| ----------------------------------------------- | ------------------------------------------------------------------------------------------ |
| Client credentials | Server-to-server APIs (most ticketing, monitoring, billing connectors). |
| Authorization code (with PKCE) | User-context APIs (Gmail, Outlook, Calendar — where the operator is acting as themselves). |
| Auto-discovery (RFC 9728 / RFC 8414 / RFC 7591) | MCP servers that publish OpenID Connect or OAuth metadata. |
Token refresh is handled by the connector or MCP runtime. For per-member authorization-code flows, refreshed tokens are written back to that member's private entry. A failed refresh becomes a visible **needs auth** or re-authorization state instead of silently widening credential scope.
## What an MCP server can and cannot do
An MCP server is a process you connected. By definition, it is an extension point — Studio cannot enforce arbitrary safety properties on a third-party server's behavior. Here is what it can do and what limits it:
| It can | Limited by |
| ------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------- |
| Expose tools that Copilot may choose to call. | Organization, member, channel, worker-stage, and runtime policy plus the active trust posture. |
| Read tool arguments Copilot fills in. | Whatever the tool call sends. In supervised use, inspect the review detail before approving. |
| Return responses that become part of the model context on the next turn. | Pre-send redaction on tool output (same patterns as the prompt path). |
| Use and refresh an OAuth token. | The token is decrypted at the point of use and sent over TLS to the relevant authorization or resource server. It should not enter model context. |
| Disconnect itself. | Studio detects disconnection and pauses tool calls until the server returns. |
| It cannot | Why |
| --------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Read another member's personal credential. | Per-member entries remain private; administration sees readiness, not the token. |
| Receive Studio's AWS credentials automatically. | Adding an MCP server does not grant it the desktop session's AWS credentials. A server can still have its own cloud identity or any credential you explicitly configure. |
| Read another organization merely because you switched Studio context. | Studio scopes definitions, policy, and credentials to the active organization, but the external service must enforce its own tenant boundary too. |
| Write Studio's history directly. | Studio persists the call and returned result through its own conversation path. The returned content can still influence later model turns and must be treated as untrusted input. |
## Threat scenarios for an unfriendly MCP
Three concrete scenarios are worth being explicit about:
**Exfiltration via tool argument.** A hostile MCP exposes a tool whose description encourages Copilot to "send the host inventory for diagnostic purposes." Mitigation: Copilot's tool selection is governed by the system prompt, the user's intent, and the approval gate. The operator sees the tool call before it goes out. Defense: do not approve tool calls whose arguments include data you don't want to send.
**Data injection via tool response.** A hostile MCP returns a tool response containing a prompt-injection payload aimed at convincing the model to leak data on the next turn. Mitigation: tool responses are pre-send redacted on the way back into the model context for the next turn (same patterns as outgoing prompts catch most secret leaks). Operators should treat MCP responses with the same skepticism as untrusted text from any external source.
**Long-lived credential abuse.** A compromised external server or authorization path can misuse a token for as long as the issuer accepts it. Mitigation: keep refresh material in the configured Key Chain flow, request narrow OAuth scopes, revoke the token at the issuer, and remove the Studio credential reference and definition. Rotating Studio encryption keys does not revoke a token already issued by the external provider.
These are honest descriptions of an inherent class of risk in any extensibility model. The defenses are real but they are defenses, not impossibilities.
## What admins should do
The operator picks tool calls; the admin picks what tools are even available. The admin's role is to:
* **Curate the connector and MCP catalog.** Treat adding a connector or MCP server as adding a piece of software to the workspace. Vet the source. Read the tool catalog. Classify endpoints.
* **Review the OAuth scopes.** Connectors authenticate with whatever scope you grant. The principle of least privilege applies — if the connector only needs to read tickets, do not give it write.
* **Set organization and per-tool availability.** Keep write endpoints and broad MCP tools disabled until their side effects and approval detail are reviewable.
* **Choose credential mode deliberately.** Prefer per-member identity for accountability; give shared service credentials an owner and rotation plan.
* **Rotate credentials.** Connector credentials should rotate on the same cadence as the underlying API's recommendation.
* **Remove unused connectors.** A connector that no one calls is just an attack-surface item. Audit periodically and remove what's not in use.
## What operators should do
* **Read approval cards.** They tell you the destination, the payload, and the credential reference. Approving without reading is the riskiest motion in Studio.
* **Use Manual or Supervised for unfamiliar tools.** A tool from a newly-added MCP server you haven't seen before is exactly the situation Manual exists for.
* **Treat tool output as untrusted.** A response from an MCP server is not a fact. If the next turn proposes a destructive action based on it, re-read the response carefully before approving.
* **Report odd behavior.** If an MCP tool's description encourages something that doesn't match its purpose, that's an admin problem worth raising.
## Built-in tools use the same framework
Studio's built-in tools, connectors, and MCP tools all pass through effective tool policy and the conversation's trust posture. Classification and approval detail can differ by tool. Autopilot can suppress per-call prompts, but it does not re-enable a tool disabled by organization or channel policy.
## Related
The user-facing description of how to add and use connectors and MCP servers.
The policy, classification, trust posture, and approval model used for tool calls.
# Human in the loop
Source: https://altostrat.io/docs/studio/en/ai-safety/human-in-the-loop
How Studio classifies tool calls by risk, presents approvals the operator can read and act on, and lets you steer or stop a running agent in real time. The trust-level model, the approval gate, and the streaming surface that makes the autonomy visible.
The hardest engineering problem in agent design isn't getting the agent to do useful work. It's making sure a useful agent doesn't do harmful work. Studio's answer is a single, opinionated architecture: every tool call passes through a classifier, every classifier-flagged call passes through an approval gate, the gate is rendered in a way the operator can actually read, and the operator can stop or redirect a run at any moment.
This page is the engineering description of that architecture. It is the page to read if you are deciding whether to grant your team Autopilot.
## Response mode and trust posture
The visible response modes are **Default**, **Ask**, and **Planning**. Ask stays read-only. Planning researches and proposes a plan. Default can use the full effective tool set and pauses where approval is required.
Studio also supports manual, supervised, and autonomous trust postures. The **Autopilot** control is the high-trust form: it auto-approves all tools and removes the turn limit. Tool policy still constrains which tools exist, but Autopilot removes the per-call human gate for those tools.
Autopilot can approve dangerous external actions. Use it only when organization, channel, target, credential, and blast radius are already bounded.
## Tool classification
Every tool that Copilot can call is classified before it runs. The class determines whether the trust level alone is enough to authorize the call.
| Class | Examples | Behavior |
| --------- | --------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------ |
| Read-only | `show`, `display`, ping, traceroute, inventory list, log fetch, SNMP get, browser or desktop observation. | Available in Ask and normally runs without a per-call prompt. |
| Moderate | Configuration, file write, connector mutation, browser click/type, or approved Computer Use input. | Requires review in the normal supervised posture. |
| Dangerous | Reload, erase, format, force-delete, factory reset, purchase, or another irreversible external effect. | Requires explicit review unless Autopilot has been deliberately enabled. |
| Unknown | A call the classifier cannot place with confidence. | Treated as review-required. |
The classifier is part of the tool registry. Each tool's domain (terminal, connector, MCP, diagram, search, network discovery, packet capture, etc.) declares which subset of its operations require approval. New connector and MCP tools default to Unknown until the org admin explicitly classifies them.
## The approval gate
When a tool call requires approval, Copilot pauses and renders a card the operator can read. The card includes:
* **The tool name and the domain it belongs to** — so you know whether it's a terminal command, a connector call, a write to your inventory, or a destructive operation on a device.
* **The exact arguments** — including the destination (host, connector endpoint, file path), the payload (command text, request body), and any parameters the model is filling in.
* **The risk class** — Read-only / Moderate / Dangerous / Unknown.
* **The credential reference** that would be used, if any — by name only, never the secret.
* **A diff or preview** for staged commands, so you can see the change in human-readable form before approving.
* **Approve, reject, or modify** as actions. Modify lets you edit the arguments before approving.
The approval gate is non-bypassable. A tool that wants to run cannot get past it; the agent simply waits. The wait is observable — Copilot's status shows "awaiting approval" with the tool and the time elapsed.
## Streaming and steering
While Copilot is running, you watch progress in the conversation and activity stack. Studio shows:
* The current model thinking state (when extended thinking is enabled).
* Each tool call as it streams (name, arguments, partial output as the call returns).
* Token and turn usage against the run's budget.
* The classification and approval state of any pending tool.
* Sub-agent activity when a delegated agent is running.
You can act on what you see in three ways:
| Action | What it does |
| ---------------- | ---------------------------------------------------------------------------------------- |
| **Steer** | Injects the message into the active run so Copilot changes direction. |
| **Queue** | Preserves the active run and delivers the message at its next completion boundary. |
| **Stop the run** | Hard stop. The current tool finishes; nothing further runs. The transcript is preserved. |
Steering is a first-class feature. It exists because no one writes a perfect first prompt, and because plans drift. You should use it freely. The transcript will show what the agent did and what you said in response — that's the record, and it's complete.
## Sub-agents inherit the gate
Copilot can delegate to specialist sub-agents — researcher, executor, terminal-ops, browser-ops, network discovery, procedure authoring. A sub-agent runs in the same conversation, with the same trust level, and the same approval policy. A delegation cannot escalate beyond what the parent's posture allows.
Sub-agents inherit the parent conversation's organization, channel, tool policy, and approval posture. Digital workers are a separate cloud runtime and use stage-level grants and human gates under their bound channel policy.
## Other approval surfaces
* Browser live view shows intent, lets the user take over, and has a session autopilot control.
* Computer Use separates read-only observation from state-changing clicks and typing, with macOS Screen Recording and Accessibility permissions.
* Generated dashboard apps require exact, per-user capability grants bound to the current capability hash.
* Studio Remote can surface approval requests on a paired iPhone; the decision has the same consequence as a desktop approval.
## Just-in-time credentials
When a tool call requires a credential — to authenticate to an SSH host, to call a connector — the credential is requested through the vault, not through the LLM. The flow is:
The tool's argument schema includes a `credentialRef` (a Key Chain entry ID), not the secret itself.
The operator sees "will authenticate to `core-router-1` using Key Chain entry `core-fleet-admin`" — by name, never by secret.
The Go sidecar requests the credential from the vault, unwraps the per-record envelope, and uses the secret in the protocol library.
The plaintext credential never crosses back into the Electron renderer process or the LLM context. It is used by the Go sidecar at the moment of authentication and discarded.
This is what we mean when we say "secrets never enter the model context" — the LLM sees the credential reference, the protocol library sees the secret, and the two are wired together by the vault without the LLM ever holding the plaintext.
The exception is procedure substitution: if a procedure body explicitly substitutes `{{password}}` into a prompt that goes to the model, that plaintext does enter the model context. This is documented under [known limits](./known-limits-and-roadmap) and the AI-context scrubbing roadmap.
## Pre- and post-tool hooks
Studio supports hooks that run before and after every tool call. Hooks are an extensibility point, not a default behavior, and they exist for organizations that want to:
* Log every tool call to a SIEM.
* Block specific tool argument patterns regardless of class.
* Reject calls that target hosts outside an allowlist.
* Re-classify a tool dynamically based on the argument (for example, treating `interface gigabitethernet0/0/0` as Dangerous on the management interface).
Hooks run server-side or in the agent depending on the kind. Failed hooks block the tool call and surface the failure in the approval gate.
## Choosing the right posture
A practical mapping for the kinds of work Studio gets used for:
| Situation | Trust level | Notes |
| --------------------------------------------------------------------- | ---------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- |
| Investigating a production incident on a device you don't fully know. | Manual or Supervised. | Read-only checks first; switch to Supervised once you've characterised the device. |
| Routine diagnostic on a known host. | Supervised. | The approval prompts catch the rare moderate operation; everything else is fluid. |
| Drafting a runbook from a successful conversation. | Supervised + Planning mode. | Planning produces clean sequences; supervision catches the few moderate steps. |
| Running a vetted procedure against a labelled host. | Supervised or Autonomous, depending on the procedure's allowed\_tools. | Procedures restrict tools at run time; Autonomous on top is appropriate when the runbook itself is trusted. |
| Bulk operations against a fleet inside a maintenance window. | Autonomous, scoped procedure, narrow allowed\_tools. | Approval per device would be operationally unworkable. The scope is the safety mechanism. |
The shape that emerges: **the threshold for Autopilot is "I know what's allowed and what target it's allowed against." Not "I trust the agent."**
## What this is not
The HITL surface is not a substitute for any of the following:
* A change-management process. Approval at the agent gate is not approval at the CAB.
* A separation-of-duties review. One person approving their own approvals is one person doing both.
* An audit log. The gate produces evidence; the [audit page](./audit-and-telemetry) describes what's recorded.
* A guarantee that the agent does not surprise you. The gate makes surprises observable, not impossible.
The gate is the enforcement point. Process around it is the reason the enforcement matters.
## Related
What happens to the data the gate is approving — where it goes for inference and what comes back.
What's recorded about every approval, every tool call, and every steering interruption.
# Identity and access
Source: https://altostrat.io/docs/studio/en/ai-safety/identity-and-access
How Studio authenticates users, derives short-term AWS credentials, isolates organizations, and enforces resource-level access — with the boundary between Clerk (identity) and Cognito (AWS authorization) explained.
Studio separates two concerns most apps blur. **Who you are** is Clerk. **What AWS calls you can sign** is Cognito. The two are wired together so a Clerk session can produce short-lived AWS credentials with the active organization context. Revoking the Clerk session prevents refresh; an already issued AWS credential remains usable until it expires or the request is rejected by another control.
This page walks through that flow, the organization isolation that sits on top of it, and the resource-level access controls that govern what you can see inside an org.
## The identity stack
| Layer | Provider | What it does |
| ----------------- | ------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------- |
| User identity | Clerk | Email, password, MFA, SSO (where configured), session lifecycle, organization membership. |
| AWS authorization | AWS Cognito Identity Pool | Exchanges a Clerk JWT for short-term AWS credentials scoped to the user's current organization. |
| API gateway | AWS AppSync (GraphQL) + custom Lambda authorizer | Validates the Clerk JWT on every request, enforces organization membership, scopes resolvers to the caller's org. |
| Resource ACLs | AppSync resolvers + DynamoDB row-level checks | Enforce ownership, organization scope, custom share grants. |
## Sign-in flow
Studio opens a Clerk sign-in surface. Clerk handles password, MFA, SSO if configured by the org admin.
The Electron renderer holds the Clerk session. Studio requests JWTs from Clerk for the downstream services it needs to call, with the user's organization claim populated.
The Clerk JWT is exchanged with the Cognito Identity Pool for short-term AWS access credentials valid for the lifetime AWS sets.
The Identity Pool's principal-tag mapping reads the organization claim from the Clerk JWT and attaches it as an AWS principal tag on every signed request.
AppSync, KMS, and Bedrock calls are signed with the temporary credential. Server-side IAM policies and KMS key policies condition on the principal tag, so a credential issued for org A cannot read resources or decrypt material belonging to org B.
The desktop credential cache refreshes before the credential expires. A revoked Clerk session means the next refresh fails and AWS calls stop being signed within minutes.
## Why two systems instead of one
Clerk gives us first-class organization, role, and session management — including hosted MFA and SSO — without us having to operate it. Cognito Identity Pool is the only AWS-native way to convert a third-party JWT into short-term AWS credentials with attribute-based authorization. Wiring the two together means:
* We get the user-facing experience and security features of a dedicated identity vendor.
* We get AWS-native enforcement of organization scope at the IAM and KMS layers, not just at the application layer.
* A Clerk session revocation cuts AWS access at the next credential refresh — there is no long-lived AWS key to chase.
## Sign-out and revocation
Clerk session is invalidated. Future Cognito refreshes for that session fail.
On the desktop, the sign-out routine purges every `vault:*` entry from the OS keychain, including cached plaintext data keys, and zeros the Go sidecar's in-memory copy.
The AWS credential cache holds the last issued credential until its natural expiry, typically within an hour. New requests cannot be signed after that.
From the Clerk dashboard, an org admin can invalidate all sessions for a user (e.g., on departure). Combined with a [DEK rotation](./vault-and-keys), this guarantees the departed user cannot decrypt new envelopes even if they kept a copy of an old DEK.
## Organization isolation
Every record in Studio carries an `orgId`. Three layers enforce that boundary:
1. **AppSync custom Lambda authorizer.** Every GraphQL request hits a Lambda that validates the Clerk JWT, extracts the active `org_id`, and refuses requests where the caller's organization does not match the requested resource's organization.
2. **Resolver-level filters.** Every list/get/update operation is rewritten so the `orgId` filter is non-negotiable. Strict mode rejects any query that attempts to filter on a different `orgId`; lenient mode (used during the rollout) logs and rewrites.
3. **KMS key policy condition.** The per-organization customer master key in KMS will only decrypt for callers whose AWS principal tag `orgId` matches and whose `kms:EncryptionContext:orgId` matches the wrap. If an encrypted row leaked without a matching key path, its protected fields would remain ciphertext.
These layers are defense in depth. KMS protects fields that Studio encrypts; organization metadata needed for indexing, synchronization, billing, or audit can have a different storage boundary and still depends on authorization controls.
## Resource-level access inside an organization
Within an organization, resources can be private to a member, shared at an organization or team scope, placed in a channel, explicitly shared, or inherited from a parent. The exact options depend on the resource type.
| Scope | Who can see it |
| ----------------------- | --------------------------------------------------------------- |
| Private | Only the owner. |
| Org or team | Members included by the selected organization or team boundary. |
| Channel or custom share | Members included by the selected channel or explicit grant. |
| Inherit | Resolved at read time from the parent folder's scope. |
Visibility and decryption are separate checks. A grant must make the record visible and the current organization key path must be able to decrypt its protected fields. Review the actual visibility indicator after moving or sharing a resource; do not infer access from its folder name alone.
## The desktop sidecar's identity
The Go agent that runs SSH, packet capture, vault operations, and other local capabilities inherits the workstation and signed-in organization context supplied by the desktop app. It is reached over loopback and does not represent a separately authenticated human or organization member.
Loopback blocks direct remote-network access but is not a sandbox from other software already running on the workstation. The agent applies origin, identity, approval, and capability checks to supported paths; the endpoint itself remains inside the local device trust boundary. See [Agent and local runtime](./agent-and-local-runtime).
## Federation and SSO
SSO is configured at the Clerk layer per organization. Clerk supports SAML and the major OIDC providers (Microsoft Entra, Google Workspace, Okta). When SSO is in place:
* The Clerk session lifetime is governed by the org's SSO policy.
* MFA is the SSO provider's MFA, not Clerk's.
* Sign-out propagates from the SSO provider to Clerk to Studio's AWS credential cache.
Org admins should treat SSO as the right default for any production deployment.
## Related
Where the per-organization KMS keys live and how they enforce isolation cryptographically.
What's logged about authentication and authorization events.
# Known limits and roadmap
Source: https://altostrat.io/docs/studio/en/ai-safety/known-limits-and-roadmap
The honest list of what Studio's safety story does not cover yet, what's explicitly out of scope, and what's being worked on. Read this before making a procurement decision.
Every safety claim on the other pages in this section is a commitment. This page is about the commitments we haven't kept yet and the ones we deliberately will not make. It is the most important page for anyone making a procurement decision, because what isn't built is usually more informative than what is.
We update this page as limits are resolved or new ones emerge. If the date on a roadmap item has passed without a corresponding update, assume it's delayed and [ask us](../troubleshooting) — don't assume silently that it shipped.
## Roadmap items (in flight or next up)
### AI context scrubbing
**What's missing.** When a procedure substitutes `{{password}}` or `{{api_token}}` into a prompt that goes to Bedrock, that plaintext enters the model context for that call. The [context safeguards](./ai-provider-and-data-flow#one-copilot-turn) catch known inadvertent patterns, but a deliberate procedure substitution is, today, not scrubbed.
**Why it matters.** Bedrock's contractual terms with Anthropic for inference traffic prohibit training on the data, but the data still enters the model context for the duration of the call. For organizations with the strictest posture, "the secret leaves the device" is the boundary that matters.
**What's being built.** A procedure-runtime indirection layer that substitutes a reference into the prompt and resolves the reference at the tool-call boundary, so the model sees `{{credentialRef:core-admin}}` and the tool call receives the unwrapped secret — the same pattern used today for interactive tool calls.
**Interim guidance.** For procedures that authenticate to external APIs via substituted secrets, authenticate at the tool-call layer (the `credentialRef` mechanism) instead of via prompt substitution wherever possible. This is already the default for the built-in SSH, RDP, connector, and MCP tools.
### Decryption audit
**What's missing.** Every decrypt call carries a `purpose: DecryptPurpose` parameter, and the Go sidecar already applies additional authenticated data (AAD) binding decrypts to record and purpose. The structured emission of `(purpose, recordId, userId, timestamp)` events into a per-organization audit log is the next iteration.
**Why it matters.** Until this lands, decrypt events are observable at the AWS CloudTrail layer (`KMS:Decrypt` calls against the org CMK) but not at the application layer. CloudTrail answers "did a decrypt happen" but not "which record, for which purpose".
**What's being built.** A dedicated DynamoDB audit table with per-decrypt events, partitioned by organization and queryable by record, user, and time. Retention configured at the organization level.
**Interim guidance.** Use AWS CloudTrail for KMS audit; use the application's procedure run history for per-run decrypt purpose (procedure runs record which credentials they unwrapped). Organizations with strict audit requirements can query CloudTrail directly today.
### Organization-wide audit explorer
**What's missing.** The in-app audit surface is per-conversation today. A central "show me every tool call everyone in my organization ran this week" view is not built in.
**What's being built.** An organization-scoped audit view that composes application audit, approval decisions, and CloudTrail for KMS events into one surface. Admin-only by default.
**Interim guidance.** Ask Altostrat to produce relevant retained infrastructure or identity evidence when an in-app record is insufficient. Individual procedure run transcripts and conversation transcripts remain the operator-accessible evidence.
### Device-side plaintext minimization
**What's missing.** Today, the decrypted plaintext of a record (Key Chain entry, connector auth, procedure body) is materialized in the Electron renderer process when the record is loaded for display or editing. Plaintext is then observable in the React state tree for the life of the component.
**Why it matters.** An endpoint-level attacker who executes code in the renderer process has the same observation window as "everything you currently have open." Today that window is "whenever you've viewed the record this session"; after the refactor it will be "only at the exact moment of use."
**What's being built.** A decrypt-on-demand refactor where plaintext is unwrapped at the point of use (the moment a terminal authenticates, the moment a connector request signs, the moment a procedure runs) and discarded immediately after. The `DecryptPurpose` parameter is the infrastructure for this; the next step is moving every consumer off load-time decryption.
**Interim guidance.** Lock the desktop session when walking away. EDR and signed-process policies are the right device-level controls.
### Control-plane residency versus inference region
**Current boundary.** AI settings now provide a Bedrock region selector for supported inference, vision, OCR, and transcription paths. Region availability differs by model: when Claude is unavailable in Cape Town, Studio routes Claude chat, titles, summaries, and vision through Frankfurt while keeping supported OCR and voice work in Cape Town.
**What the selector does not do.** Changing inference region does not move the organization's control-plane records, identity, billing, or encryption resources into a customer-selected region, and Studio does not currently provide a per-customer self-hosted deployment.
**Interim guidance.** Treat model-processing region and application-data residency as separate procurement questions. Ask Altostrat for the current region matrix before approval; do not infer control-plane residency from the AI setting.
### Encrypted organizational metadata
**What's missing.** Hostnames, display names, folder structure, and ownership rows are intentionally plaintext server-side (see [vault and keys](./vault-and-keys#encrypted-fields)). They can be sensitive operational metadata even though they are outside the encrypted-secret set.
**What's the plan.** A searchable-encryption design to selectively encrypt categories of metadata where the search/sort cost is acceptable. This is research-grade work, not a near-term roadmap item — listed here for transparency, not as a commitment.
**Interim guidance.** Treat display names and folder labels as information that does not need to embed sensitive content. Use memories and encrypted fields for the sensitive material.
### Customer telemetry controls
**Current boundary.** Sentry error and crash reporting is active with client-side scrubbing and deduplication; Sentry Session Replay is disabled. Amplitude product analytics and masked Session Replay are enabled outside local development at the configured release sample rate. The packaged default replay sample rate is currently 100%, with terminals and marked sensitive regions blocked and form input masked.
**What's missing.** The current desktop app does not expose a general customer-facing organization switch for Sentry or Amplitude collection.
**Interim guidance.** Review [Audit and telemetry](./audit-and-telemetry) before rollout and contact Altostrat if telemetry or interaction replay conflicts with policy. Masking reduces exposure but is not equivalent to disabling capture.
## Out of scope (by design)
These are limits we do not intend to resolve — not because they are unimportant, but because the fix would break something else or because the responsibility belongs elsewhere.
| Limit | Why it's out of scope |
| ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Device-while-unlocked compromise.** Code running in the signed-in Electron process or with sufficient local privilege can observe plaintext keys and data at their point of use. | The desktop and local agent are inside the endpoint trust boundary. Endpoint security, application control, least privilege, and screen locks are the right controls. |
| **Operator making a bad approval.** An operator who clicks "approve" on a dangerous tool call without reading it is unsafe regardless of our gate. | The gate's job is to make the consequence visible. Operator discipline is operator discipline. |
| **Two operators colluding.** Two people with the right roles can agree to do something they shouldn't. | Audit history, separation-of-duties policy, and HR processes are the right controls. |
| **MCP server behavior beyond the approval gate.** A hostile MCP can propose tool calls; its responses can include prompt-injection payloads. | The gate is the enforcement point. Admin curation of the connector and MCP catalog is the other control. We cannot enforce arbitrary safety properties on code we don't run. |
| **Paired-phone compromise.** A phone paired through Studio Remote can read supported conversation state and submit supported approvals while the desktop bridge is running. | Device authentication, notification privacy, short-lived pairing codes, and immediate revocation from Current connections are the controls. A compromised unlocked phone is an endpoint compromise. |
| **Generated-app logic.** Sandboxing and capability grants constrain access, but they do not prove generated business logic is correct. | Review the revision, keep grants exact, test with capabilities disabled first, and validate external results. |
| **Carrier or transit metadata leakage.** TLS protects content; timing, volume, and metadata leak. | Standard for any cloud-connected software. |
| **Quantum-capable adversaries.** Current ciphers are not post-quantum. | AWS's published roadmap will move us when post-quantum KMS becomes operationally available. |
## The update-channel trust question
Studio self-updates through electron-updater. [Code signing and SHA-512 verification](./supply-chain-and-updates#update-flow) protect the update channel, but the channel itself is a channel. An organization that does not want self-update can disable it at the OS deployment level (MDM policy, group policy) and manage Studio updates through normal software distribution. This is supported; it is not the default because the cost-benefit for most users favors timely security updates.
## How to read this page
**Don't treat roadmap items as commitments with dates.** They are priorities. They move. When one lands, it leaves this page. When a new limit emerges, it lands here.
**Weight the out-of-scope items heavily.** They will not change. If an out-of-scope limit is incompatible with your environment, the rest of Studio's safety story does not compensate.
**Be suspicious of any vendor who has no page like this one.** Every security architecture has limits. A vendor who does not describe theirs has not done the work or is not being honest about it.
## Related
The actors and defenses these limits sit next to.
The cryptographic core that most of these roadmap items extend.
# AI safety in Studio
Source: https://altostrat.io/docs/studio/en/ai-safety/overview
How Altostrat Studio runs AI against production networks safely — the architecture, the controls, the cryptography, and the honest limits. Written for the security engineer reviewing whether to authorize this in their environment.
Studio is an AI-assisted operations IDE that connects directly to production network and server infrastructure. That combination — autonomous agents, persistent credentials, real device access — sets a high bar for safety. This section is the engineering account of how we meet that bar, and where we're still working.
We wrote it for the person who has to sign off on Studio for their environment. It's not a marketing page. It cites the actual controls we've built, names the cryptographic primitives, and is honest about the things that aren't done yet. If you find a gap, [tell us](../troubleshooting) — that's how this gets stronger.
## The principles
Six commitments shape every safety decision Studio makes:
Supported secret fields use envelope encryption and Key Chain resolution. Plaintext still exists when a value is displayed or used, and local recordings, exports, or prompts can create additional copies that need their own controls.
Tool policy, risk classification, and approval UI make external effects reviewable. Autopilot is the explicit exception: it removes per-call prompts for tools that remain available under policy.
Organization authorization is reinforced by per-organization encryption for supported sensitive fields. Metadata and unencrypted fields still depend on identity, resolver, and storage controls.
Model inference goes through AWS Bedrock in the region selected under AI settings, subject to model availability. Studio does not call Anthropic's hosted API directly.
Tool activity, conversation history, usage, and supported audit events make operational work inspectable. Coverage differs by surface, so target-system logs and endpoint evidence remain important.
Some things are not built yet. Some things never will be (because they conflict with operational reality). We document both. Buying decisions made on incomplete information cost more than the truth.
## What's on this tab
What we're defending against, what we're not, and the assumptions our controls rely on.
Clerk for the user, Cognito for the AWS calls, organization isolation enforced top to bottom.
Per-org KMS keys in a FIPS-validated HSM, AES-256-GCM envelope encryption, automatic 30-day DEK rotation, cryptographic shredding on org deletion.
The trust-level model, tool classification, the approval gate, and how the steering controls let you stop or redirect a running agent in real time.
Bedrock-only, model and region pinning, three-tier prompt cache, secret redaction before model context, and the boundary between local and cloud.
Electron + Go sidecar architecture, what stays on your device, the local embeddings model, and how the desktop process talks to the backend.
What's logged, what's redacted, what third parties get (Sentry, Amplitude), and how to disable optional telemetry.
How third-party API credentials are stored, how MCP tool catalogs are gated, and what happens if a remote MCP server tries to misbehave.
Code signing, notarization, update signature verification, the build pipeline, and the path from source to your machine.
The honest list of what isn't done yet and what we're working on. Read this before committing.
## A one-paragraph version
If you read nothing else: **Studio's user identity is Clerk; AWS access goes through Cognito Identity Pool short-term credentials; sensitive fields are encrypted with AES-256-GCM under per-organization data keys wrapped by AWS KMS; the AI agent runs through tool policy and risk-based approval gates; model inference uses Anthropic models through AWS Bedrock in the configured region, with documented regional fallbacks where a model is unavailable; the desktop app is a signed Electron binary with a Go sidecar for local operations; and the remaining gaps are documented under [known limits](./known-limits-and-roadmap).**
## Apply controls by surface
The normal chat approval model is only one boundary. Browser autopilot, Computer Use, generated apps, Studio Remote, shared sessions, and early-access digital workers each add a distinct execution or delegation path. Review the page for that surface and test with a non-production target before granting broader access.
For an operator-focused control summary, see [Security and privacy](../security-and-privacy).
## How to read this section
If you're a CISO doing initial diligence: read [threat model](./threat-model), [vault and keys](./vault-and-keys), [known limits](./known-limits-and-roadmap), in that order.
If you're a security engineer doing the deep review: read every page. The vault and HITL pages have the most engineering detail; the supply chain page has the most surprises.
If you're an MSP or ISP team lead deciding whether your operators can use Studio: read [overview](./overview), [human in the loop](./human-in-the-loop), and [audit and telemetry](./audit-and-telemetry).
# Supply chain and updates
Source: https://altostrat.io/docs/studio/en/ai-safety/supply-chain-and-updates
How Studio gets from our source repo to your machine intact — code signing, notarization, the build pipeline, the update flow with SHA-512 verification, and where the release artifacts live.
The most subtle attack on a desktop application is the one that gets a malicious build into your installer or your update channel. This page describes the controls that protect that path.
## The build pipeline
Studio's frontend, backend, and Go agent are built in the same controlled CI environment as the AWS infrastructure. The pipeline runs through AWS Amplify Hosting:
| Phase | What happens |
| ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Backend pre-build | A required-secrets check runs first; if any expected SSM parameter is missing, the build fails before any code runs. |
| Backend build | Amplify CDK synthesises the AppSync schema, the DynamoDB tables, the Lambda functions, the IAM and KMS resources. |
| Backend post-build | Smoke tests run against the deployed stack — including the FIPS endpoint assertion (`kms-fips.us-east-1.amazonaws.com`) and the principal-tag mapping. |
| Frontend pre-build | Dependencies install; lockfile is enforced. |
| Frontend build | Next.js produces the static export shipped inside Electron. |
| Agent build | Go sidecar compiles with `GOEXPERIMENT=boringcrypto` and the version-stamped build flags. |
| Desktop package | electron-builder produces signed installers for macOS (universal and Intel) and Windows (x64). |
| Release publish | Artifacts upload to a controlled CDN under `download.altostrat.io`. |
Per-branch secrets live in AWS SSM Parameter Store, scoped to the branch and the AWS account. Secrets are never committed; the CI environment fails the build rather than substituting placeholders.
## Code signing
| Platform | Signature |
| -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| macOS | Signed with an Apple Developer ID Application certificate. Notarized through Apple's notary service so Gatekeeper allows the install without a right-click bypass. |
| Windows | Signed with an Authenticode certificate. The installer reports a verified publisher in the standard SmartScreen / UAC dialogs. |
Both signatures are verified by the operating system at install time and on every launch. An installer whose signature does not validate is rejected by the OS before it can run.
## Update flow
The desktop app uses electron-updater for self-update. The flow:
On launch and on a periodic schedule, Studio checks the release feed at `download.altostrat.io` for the current channel.
If a newer version exists, Studio downloads its metadata file (`latest-mac.yml` or `latest.yml`) which contains the version, release date, and SHA-512 hashes for each artifact.
Studio downloads the platform-specific installer.
electron-updater computes the SHA-512 of the downloaded artifact and compares it against the hash in the metadata file. A mismatch aborts the update.
The OS verifies the installer's signature. macOS additionally checks notarization status. A failed signature aborts the update.
The verified update is staged. Studio applies it on the next restart so a long-running session is not interrupted mid-task.
The metadata file is served alongside the artifacts on the same controlled domain. Both are TLS-protected; the SHA-512 verification provides a defense-in-depth check that the bytes you ran through the OS-level signature check are also the bytes the release pipeline produced.
## Release artifacts
Release artifacts are versioned and immutable. The naming follows:
| Artifact | Where to download |
| ------------------- | ------------------------------------------------------------------------------ |
| macOS Apple Silicon | `https://download.altostrat.io/studio/altostrat-studio-apple-arm64-latest.dmg` |
| macOS Intel | `https://download.altostrat.io/studio/altostrat-studio-apple-x64-latest.dmg` |
| Windows x64 | `https://download.altostrat.io/studio/altostrat-studio-windows-x64-latest.exe` |
The `latest` symbolic links always point to the most recent release in the active channel. A specific version is also addressable by version number for organizations that want to pin to a known build.
## Dependencies
Studio's dependency surface is large by browser-app standards and small by desktop-app standards. The main lines of defense:
* **Lockfile enforcement.** Every release builds against a committed lockfile. Floating versions are not used in production builds.
* **No post-install scripts.** Dependencies that try to run scripts during install are rejected; the lockfile-install step disables this.
* **Periodic vulnerability scanning.** The dependency tree is scanned against published advisory databases on every release; high-severity advisories block the release until addressed.
* **First-party crypto.** Cryptographic primitives that matter for Studio's safety claims are not pulled from arbitrary third parties. AES-256-GCM is BoringCrypto in the Go agent; KMS is AWS-managed; the JWT path is Clerk-managed.
## What we do not do
* **No remote code load at runtime.** Studio does not download and execute additional code modules at runtime. Updates always go through the signed installer flow.
* **No silent telemetry-driven feature flags that change behavior.** Feature flags exist for staged rollout, but they enable or disable existing code paths; they do not load new code.
* **No second binary fetched at runtime.** The Go sidecar is part of the signed installer. It is not a separate download.
## What you can verify
* The macOS signature: `codesign -dv --verbose=4 /Applications/Altostrat\ Studio.app` reports the signing identity and team.
* The macOS notarization: `spctl --assess --type execute /Applications/Altostrat\ Studio.app` reports `accepted` from the notary service.
* The Windows signature: right-click the installer → Properties → Digital Signatures, or `Get-AuthenticodeSignature` in PowerShell.
* The release SHA-512: visible in `latest-mac.yml` / `latest.yml` on the download server, comparable against your downloaded installer.
## Reporting a supply-chain concern
If you find something that looks like a tampered installer, an unexpected signature, a suspicious update prompt, or any indication that the supply-chain controls described here failed, [contact us through troubleshooting](../troubleshooting). Supply-chain concerns are escalated immediately and not subject to normal triage queues.
## Related
The runtime authentication that depends on the signed binary having reached your machine intact.
The two processes inside the signed installer and how they coordinate.
# Threat model
Source: https://altostrat.io/docs/studio/en/ai-safety/threat-model
What Studio is built to defend against, what it explicitly is not, the assumptions our controls depend on, and the boundaries between the components that hold those controls together.
A threat model worth writing names actors, what they want, what they can do, what stops them, and what doesn't. This page is that for Studio.
## Actors and what they want
| Actor | Capability | Motive |
| ---------------------------- | ----------------------------------------------------------------------------------------------- | --------------------------------------------------------------------- |
| Curious co-tenant | Authenticated to a different organization on the same Studio infrastructure. | Read another org's hosts, credentials, conversations, or recordings. |
| Compromised teammate account | Holds valid credentials in a target org. | Exfiltrate sensitive operational data, run destructive commands. |
| Malicious operator | Authorised user, intentional misuse. | Avoid leaving traces of disallowed actions. |
| Network adversary | On-path between client and AWS endpoints. | Capture traffic, downgrade TLS, impersonate endpoints. |
| Endpoint malware | Code execution on the user's signed-in workstation. | Read plaintext credentials, replay sessions, observe device commands. |
| Hostile MCP/connector | A third-party tool the org has chosen to add. | Exfiltrate data through tool-call arguments and responses. |
| Supply chain attacker | Tries to get malicious code into a Studio release. | Persistent backdoor across all installs. |
| Hostile AI prompt injection | Untrusted text reaches the model context. | Coerce the model to run actions outside the user's intent. |
| Stolen paired phone | A device paired through Studio Remote is lost or accessed by another person. | Read visible work or approve a consequential action. |
| Hostile generated app | Generated dashboard code requests overly broad capabilities or misleadingly presents an action. | Read or change resources beyond the app's stated purpose. |
## What we defend, where the defense lives
| Threat | Primary defense | Secondary defense |
| ------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Cross-tenant data access | Per-organization KMS CMK with org-scoped principal tags; resolver-level org filters. | AppSync custom Lambda authorizer validates Clerk JWT and org membership on every request. |
| Stolen at-rest copies of database rows | AES-256-GCM envelope encryption of sensitive fields under per-org DEK; ciphertext useless without KMS access. | DEK rotation every 30 days; old DEKs retained encrypted but unusable for new wraps. |
| Stolen at-rest object storage | S3 bucket SSE-S3 + presigned-URL-only access through a Lambda that performs ACL checks. | `enforceSSL=true`, public access blocked. |
| Network-on-path attacks | TLS for external endpoints; supported Cognito and KMS paths use configured AWS endpoints. | Certificate validation uses the platform trust path; unexpected certificates fail unless a feature explicitly allows a reviewed exception. |
| Compromised user account | Clerk-managed MFA, SSO, and session policy; short-lived AWS credentials with 5-minute refresh buffer. | KMS principal tag prevents the credential from operating outside the user's org context even if leaked. |
| Endpoint malware reading local protected storage | Plaintext DEKs are cached through the OS credential service with a bounded lifetime and supported cache purge on logout. | Device-while-unlocked compromise is explicitly out of scope (see below). |
| Disgruntled-operator removal | Org admin triggers DEK rotation; new envelopes use new DEK; revoked operator's cached plaintext expires within 12 hours. | Clerk session revocation cuts AWS credential issuance immediately. |
| Hostile MCP server | Per-tool approval gate, credentials live in vault not in the model context, OAuth tokens rotated where supported. | The connector and MCP catalog is org-controlled; admins can disable a connector. |
| Prompt injection | Tool-call execution is constrained by organization, channel, and runtime policy plus the selected trust posture. | Tool output is treated as untrusted context; consequential actions require review unless the operator deliberately enabled Autopilot or an equivalent autonomous posture. |
| Stolen paired phone | Paired connections can be listed and revoked from the desktop. | The desktop remains the execution bridge; use device lock and reject approvals that lack enough visible context. |
| Hostile generated app | Sandboxed execution and explicit per-user capability grants bound to the requested capability set and revision. | Restrict allowed origins and re-review grants after a revision or capability change. |
| Supply chain | Code signing, notarization, update artifacts SHA-512 verified by `electron-updater`. | Build pipeline runs in a controlled CI environment; release artifacts published to a controlled domain. |
## What we explicitly do not defend against
Honesty here matters more than completeness. The list below is the set of attacks Studio's current architecture cannot stop. Some are by design; some are roadmap items.
| Out of scope | Why |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Device-while-unlocked compromise.** Code running in the signed-in Electron process or with sufficient local privilege can observe plaintext credentials and session data at their point of use. | The desktop app and local agent are inside the endpoint trust boundary. Use OS hardening, EDR, application control, rapid locking, and least privilege. |
| **Operationally-required plaintext.** Hostnames, display names, ownership, folder structure, and audit-context fields are stored unencrypted server-side. | Encrypting these would break search, sort, sync, and audit query patterns. Sensitivity of these fields is acknowledged and explicit. |
| **AI provider seeing substituted secrets.** When a procedure substitutes `{{password}}` into a prompt that goes to Bedrock, the substituted value enters Anthropic's model context for that call. | Bedrock-side data handling is governed by AWS's contracts with Anthropic; no model training on inference data. AI context scrubbing is on the [roadmap](./known-limits-and-roadmap). |
| **Self-inflicted misuse with autonomy.** A user who switches Copilot to autonomous trust and walks away from the keyboard can be convinced by prompt injection to run something destructive. | Autonomous trust is a deliberate choice with a deliberate cost. The defense is not removing the option; it is making the option visible and the consequences observable in the audit history. |
| **Carrier or transit eavesdropping below TLS.** TLS protects content but timing, volume, and metadata leak. | Standard for any cloud-connected app. |
| **OS credential-store extraction by a privileged process.** Platform-protected storage is not a boundary against a sufficiently privileged local attacker. | Privileged-process compromise is device-level and out of scope. |
| **Remote approval with incomplete visual context.** A paired phone can show the request but not every relevant desktop surface. | Reject ambiguous mobile approvals and continue on the desktop. |
| **Unattended early-access workers.** A poorly scoped worker can repeat an incorrect action under its granted channel and stage tools. | Keep workers owner-gated, use human gates, and restrict service credentials and stage tools. |
| **Multi-party collusion among trusted operators.** Two operators with the right roles can agree to do something they shouldn't. | This is what audit logs and approvals exist for after the fact, not before. |
| **Quantum-capable adversaries.** Current ciphers are not post-quantum. | AWS's published roadmap will move us when that becomes operationally available. |
## Trust boundaries
Studio has four crossings worth naming:
1. **User ↔ Studio desktop app.** Established by OS sign-in and Clerk authentication. The app trusts the user once authenticated.
2. **Desktop app ↔ Go agent.** Local loopback; the agent is part of the same package and receives signed-in scope and capability calls from the desktop. Loopback is not isolation from a compromised local account.
3. **Desktop app ↔ AWS backend.** Authenticated via short-term Cognito-issued AWS credentials, derived from a Clerk JWT. Every AWS API call is signed.
4. **Studio ↔ external systems (devices, connectors, MCP, AI provider).** The most variable boundary. Each system has its own credential and external audit behavior; Studio's tool history does not replace the target system's logs.
5. **Studio desktop ↔ paired phone or collaborator.** The desktop lends a bounded control and visibility path to another device or participant. Revocation, role, and approval scope matter.
6. **Generated app or worker ↔ granted capabilities.** Sandboxing or cloud execution is useful only if the grant, channel, credential, and target boundaries are narrow.
The vault, the approval gate, and the audit trail sit on these boundaries. The pages that follow walk through each in detail.
## Assumptions our controls rely on
If any of these assumptions don't hold for you, our controls are weaker than advertised. They're worth verifying:
* The user's workstation is not compromised at the OS level.
* The user's Clerk account uses MFA.
* The user keeps secrets in Key Chain and does not copy resolved values into prompts, commands, recordings, or less protected files.
* The user reviews approval prompts rather than reflexively clicking "approve."
* The user's organization is configured so that not every operator has admin or autonomous-trust capability.
* The user's connectors and MCP servers are sourced from trusted parties.
* Paired phones, generated apps, and early-access workers are reviewed and revoked or paused when their purpose ends.
The controls described in the rest of this section are designed to make these assumptions easy to keep, not to make them unnecessary.
## Related
The crown jewel: per-org KMS, AES-256-GCM, 30-day rotation, cryptographic shredding.
The honest list of what isn't built yet and what we're working on.
# Vault and keys
Source: https://altostrat.io/docs/studio/en/ai-safety/vault-and-keys
The cryptographic core of Studio: per-organization customer master keys in a FIPS 140-2 HSM, AES-256-GCM envelope encryption with additional authenticated data, automatic 30-day data-key rotation, and cryptographic shredding on organization deletion.
Studio uses envelope encryption to add a cryptographic boundary around supported sensitive fields. A copied ciphertext is not useful without the matching data key, KMS authorization, and authenticated context. This protection does not cover every record field, local recording, exported file, or plaintext value at its point of use, so it complements rather than replaces application and endpoint controls.
This page describes the design end to end: the keys, the algorithm, the envelope format, the rotation behavior, the cross-organization sharing flow, the keychain caching, and the organization-deletion path that ends in cryptographic shredding.
## The shape
| Layer | What it is | Where it lives |
| ------------------------- | ------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------- |
| Customer master key (CMK) | Per-organization symmetric KMS key. | AWS KMS, FIPS 140-2 validated HSM, `us-east-1` FIPS endpoint. |
| Data encryption key (DEK) | Per-organization symmetric data key, one per active version. | Encrypted at rest in DynamoDB, wrapped by the org's CMK. |
| Resource DEK wrap | A separate wrap of a record's DEK for each organization that is allowed to decrypt it (used for cross-org shares). | Persisted as scoped wrap rows in the backend store. |
| Per-record envelope | The actual sensitive field as ciphertext. | DynamoDB `keyChainEntries`, `connectorEntries`, `mcpServerEntries`, `procedures`, `procedureRuns`, `connectionProtocols`. |
| Plaintext DEK cache | Decrypted DEK protected through Electron `safeStorage` with a 12-hour TTL. | The supported desktop platform's OS credential service. |
| Plaintext field | Decrypted record value while it is displayed, edited, or used. | Go agent memory and, for current load-time consumers, Electron renderer state. |
Three layers of indirection — CMK wraps DEK wraps record — sound complex. They give us four properties we want:
* The CMK never leaves the HSM.
* The DEK can be rotated frequently without rewriting every ciphertext immediately (envelopes carry a `dekRef` and the corresponding wrap is fetched at decrypt time).
* A single record can be re-wrapped for additional organizations (sharing) without re-encrypting.
* Organization key destruction can make remaining encrypted envelopes unrecoverable after the KMS deletion window. It does not erase unencrypted metadata, exports, or endpoint copies.
## The algorithm
| Component | Choice |
| ---------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Symmetric cipher | AES-256-GCM |
| Wrap (CMK → DEK) | AWS KMS, FIPS 140-2 validated HSM |
| KMS endpoint | AWS FIPS endpoint in `us-east-1` |
| Key derivation | None at the application layer; KMS handles CMK-side derivation. |
| AAD | A canonical binding of the envelope to its organization, table, record, and field. |
| IV | 96 bits, randomly generated per encryption. |
| Tag | 128 bits, GCM standard. |
| Crypto library | Go built with the BoringCrypto path in the agent; AWS KMS in the cloud. The KMS HSM validation and the agent build's module-validation claim are distinct. |
Envelope payloads are versioned so the format can evolve without breaking historical decrypts; every envelope carries a version tag and a reference to the DEK that wrapped it.
## Additional authenticated data
Every envelope's AAD binds it to its location. An adversary who copies a ciphertext from one record to another (transplantation attack) cannot decrypt it: the AAD they would have to forge includes the destination record's identity, and the GCM tag fails verification.
This means:
* A field copied from one record to another in the same table fails to decrypt.
* A field copied from one organization to another fails to decrypt.
* A field copied between two semantically different fields on the same record fails to decrypt.
The exact AAD construction is a hardening detail we don't publish, but the property it enforces is the one above.
## DEK lifecycle
A new organization receives a freshly minted DEK:
On organization creation, a backend handler creates a dedicated KMS customer master key, applies the org-scoped key policy, and records the binding so subsequent calls route to the right key.
The same handler asks KMS to generate a fresh data key under the new CMK. The plaintext form is used once and discarded; the wrapped form is persisted as the org's active DEK.
Encryption calls fetch the active DEK, unwrap it via KMS into protected memory, perform the AES-256-GCM operation with the appropriate AAD, and embed a reference to the DEK in the envelope so it can be located again at decrypt time.
A scheduled rotation mints a new DEK version and marks the previous one retired. New envelopes use the new DEK; old envelopes still decrypt because retired DEKs are kept (encrypted) for the lifetime of the organization.
An organization admin can also trigger rotation manually — for example, after a personnel change. The same handler runs; the same retirement semantics apply.
Rotation is **idempotent and concurrent-safe**: the active-version pointer is updated with a conditional write so two simultaneous rotations cannot produce two different "active" versions.
Retired DEKs are **never deleted** while the organization exists. Old envelopes must keep decrypting. The cost of keeping them is negligible, and the benefit is that historical data does not become inaccessible after a routine rotation.
## Plaintext DEK caching
Decrypting a record requires the plaintext DEK. Calling KMS for every decrypt is too slow for a workspace that opens hundreds of records per session, so plaintext DEKs are cached in the operating system keychain on the desktop with a short lifetime.
| Cached material | Where | Behavior |
| ---------------- | ------------ | --------------------------------------------------------------------------------------------------------------- |
| Wrapped DEK | OS keychain. | Safe to keep; it's only useful with a KMS unwrap. |
| Plaintext DEK | OS keychain. | Held for a short, bounded interval (hours, not days), then expired. The next decrypt requires another KMS call. |
| Session metadata | OS keychain. | Same bounded interval; purged on sign-out. |
Electron `safeStorage` uses the platform credential service to protect cached values at rest. This is an OS-account boundary, not a defense against a privileged process on an unlocked workstation.
The bounded TTL is a deliberate safety margin: a stolen workstation that is signed in for a day still has limited useful key material once the cache expires, and an explicit sign-out purges every cached vault entry immediately.
## Cross-organization shares
When a user shares a resource with a member of another organization, the resource's encrypted contents must become readable to the other org without exposing the originating org's DEK. Studio uses a **per-resource DEK wrap** for this:
The originating user's session unwraps the record's envelope using the active org DEK and re-encrypts it under a fresh per-record DEK.
The per-record DEK is wrapped once under each participating organization's CMK via KMS. Each wrap is persisted as its own row, scoped by (resource, organization).
A recipient's session looks up the wrap for its own org, calls KMS with its own CMK to unwrap the per-record DEK, then decrypts the record. At no point does the recipient's session see the originating org's DEK or CMK.
Removing a share deletes the recipient org's wrap. The recipient's session can no longer unwrap the per-record DEK; the underlying record is unchanged for the originating org.
This pattern lets Studio revoke future unwrap access without replacing the originating organization's envelope. Revocation cannot erase plaintext, exports, screenshots, or keys a recipient legitimately obtained and retained outside the supported cache while the share was active.
## Encrypted fields
The following fields are encrypted under the org DEK at rest:
| Domain | What's encrypted |
| ----------------- | ----------------------------------------------------------------------------------------------------------------------------- |
| Host protocols | Per-host passwords, key references, ONVIF camera credentials. |
| Connectors | The full authentication blob (basic, bearer, OAuth tokens, custom-header secrets). |
| MCP servers | The full authentication blob. |
| Procedures | The procedure body, which may contain inlined sensitive text. |
| Procedure runs | Argument values, conversation messages, tool-call summaries, final output. |
| Key Chain entries | The credential payload itself. Personal and explicitly managed shared entries have different visibility and execution scopes. |
Hostnames, display names, organization membership, ownership, and folder structure are intentionally **not** encrypted. They have to be queryable for the workspace to be usable, and they are not the secrets — they are operational metadata. This boundary is documented honestly under [known limits](./known-limits-and-roadmap).
## KMS access policy
Each organization's CMK has a key policy that only permits decryption when the caller is bound to that organization. The binding is established at sign-in: the user's identity claim is propagated as an AWS principal tag on every signed call, and KMS will only unwrap a DEK when the tag and the key's policy align with the encryption context the application supplies.
A user signed into organization A should not be able to unwrap organization B's data key because the identity tag, key policy, and encryption context do not match. This protects encrypted fields; it does not replace resolver checks on unencrypted metadata.
## Organization deletion and cryptographic shredding
When an organization is deleted, an organization-lifecycle handler:
KMS marks the org's CMK pending deletion with the AWS-mandated 30-day window. Shorter windows aren't permitted.
The org-key state is updated so the application no longer encrypts new records against the soon-to-be-destroyed CMK.
During the 30 days, an admin can cancel the deletion if it was a mistake.
After the window, AWS destroys the CMK irreversibly. Every wrapped DEK for the organization is now unrecoverable; every envelope encrypted with those DEKs is now ciphertext that can never be decrypted.
This is **cryptographic shredding for the protected envelopes**: ciphertext may remain in database rows, object storage, or backups but becomes unrecoverable after the key is destroyed. Unencrypted metadata and copies made outside the envelope path require separate deletion and retention controls.
## How to verify any of this
Studio runs as a managed SaaS in Altostrat's AWS account. The current vault, KMS, CloudTrail, and AppSync control plane is not deployed into your AWS account. The verification options reflect that:
* **FIPS endpoint and HSM:** AWS's published documentation establishes that the FIPS KMS endpoint in `us-east-1` runs on FIPS 140-2 validated hardware. Our internal integration suite asserts on every release that we route to the FIPS endpoint; the assertion details are part of the security pack we share under NDA.
* **DEK rotation cadence and key isolation:** producible from our CloudTrail on request as part of a security or compliance review.
* **Per-organization isolation:** observable in any record export — each organization's encrypted blobs reference a different KMS key, and sharing produces additional per-organization wraps.
* **Envelope versioning:** observable in any record export — the version tag is unambiguous and lets us evolve the format without breaking historical records.
If you need formal evidence — for a SOC review, a PCI assessment, a customer security questionnaire — contact us. We share controls documentation and CloudTrail evidence under standard NDA.
## Related
How the principal tag that gates KMS access gets attached to your AWS calls.
What the vault does not yet do — including audit logging of every decrypt and AI-context scrubbing.
# Browser and Computer Use
Source: https://altostrat.io/docs/studio/en/browser-and-computer-use
Let Copilot operate a headless browser or your local macOS desktop with live previews, takeover controls, and explicit approvals.
Studio has two different ways to operate a graphical interface:
* **Browser tools** run a managed headless browser session for websites and web consoles.
* **Computer Use** observes and, with approval, controls applications on your local macOS desktop.
Use the browser whenever the task can stay inside a website. Use Computer Use for a native desktop application or an operating-system surface that has no safer API, connector, command-line, or browser path.
## Choose the right surface
| Task | Preferred surface |
| ------------------------------------------------------------ | ---------------------------------- |
| Read a monitoring dashboard or change a web-console setting. | Browser. |
| Query a service with a supported API. | Connector or MCP, not pixels. |
| Run a host command. | Terminal or host tool, not pixels. |
| Inspect a native macOS application. | Computer Use. |
| Click or type in a local native application. | Computer Use with approval. |
Studio routes to structured tools before pixel control when one is available. Structured operations are easier to review, retry, audit, and constrain.
## Browser sessions
Ask Copilot to open or use a website. The active headless-browser session appears in the activity area and opens a live browser tab. The live view shows the current URL, connection state, interactive element strip, and the next proposed intent.
Browser tools can navigate, inspect content, fill forms, click elements, capture screenshots, collect downloads, and gather network or trace evidence. Actions that could submit data or change external state pause for approval unless browser autopilot is enabled.
### Take control
Select **Take over** when you need to interact with the browser yourself. Studio pauses AI control and sends your pointer, keyboard, and scroll input to the headless session. Select **Release** to return control to Copilot.
Click the live preview while Copilot controls the session to open a picture-in-picture view. If an approval is needed, Studio closes picture-in-picture and focuses the conversation so the request is not hidden.
### Browser autopilot
The lightning control in the browser toolbar enables autopilot for browser actions in that session. While enabled, browser actions are auto-approved.
Browser autopilot can submit forms, send messages, and change remote systems. Enable it only for a bounded session with the correct tenant, account, and target already verified.
### Browser AI Grounding
The composer option **Browser AI Grounding** gives Copilot additional visual grounding while it operates browser pages. This can improve performance on unfamiliar or visually complex sites, but consumes additional tokens per browser action. Turn it on for difficult interfaces and leave it off when semantic element data is sufficient.
## Computer Use on macOS
Computer Use is available in the Studio desktop app on macOS. It can list applications and windows, capture the current desktop, read visible text, and operate the pointer and keyboard through the local Studio helper.
Observation operations are read-only. State-changing operations—clicking, typing, scrolling, opening an application, or activating a control—require approval unless your current autonomy settings explicitly bypass approvals.
### Grant permissions
Before first use:
1. Open **Settings → Computer Use**.
2. Grant **Screen Recording** so Studio can see the desktop before acting.
3. Grant **Accessibility** so approved actions can move the pointer and type.
4. Return to Studio and select **Re-check**.
If macOS still reports a permission as blocked, quit and restart Studio. macOS can retain the previous permission state until the app process restarts.
Screen Recording lets Studio observe the desktop. Accessibility is the separate permission that lets approved actions control it. Grant only the capabilities you intend to use.
### Secondary cursor
Studio uses a secondary-cursor helper for background desktop actions. Its status appears while Computer Use runs. The helper checks the active window and display before acting so a moved or changed window does not silently receive input intended for the old target.
## Review an approval
Before approving a browser or Computer Use action, check:
* The website URL, application, window title, and signed-in account.
* The proposed target element and input text.
* Whether the action submits, purchases, deletes, publishes, or changes access.
* Whether a structured tool could perform the same action with a clearer boundary.
Take over or reject when the visual state does not match Copilot's description.
## Troubleshooting
| Symptom | What to check |
| ----------------------------------- | -------------------------------------------------------------------------------------- |
| Browser shows **Reconnecting** | Check the Studio helper and network connection; keep the tab open while it reconnects. |
| Browser is on the wrong page | Take over, navigate to the correct page, then release control. |
| Copilot cannot see a macOS window | Grant Screen Recording, select **Re-check**, then restart Studio if needed. |
| Pointer or typing actions fail | Grant Accessibility and confirm the target window is still open. |
| The action targets the wrong tenant | Reject it, correct the account or URL manually, and restate the boundary in chat. |
## Related
Choose modes, autonomy, and approval posture for graphical work.
Understand approvals, local permissions, and external side effects.
# Calls and Audio Use
Source: https://altostrat.io/docs/studio/en/calls-and-audio-use
Place and receive Studio calls, use dedicated call workspaces, transcribe live audio, and capture external call audio with Audio Use.
Studio supports built-in calls and a separate **Audio Use** capture workflow.
* Use a Studio call when participants are joining through Studio or a Studio guest link, or when you are placing a configured SIP call.
* Use Audio Use when the call is happening in another application and you want Studio to transcribe your microphone and system output into a Studio session.
Both surfaces can create sensitive transcripts. Tell participants when transcription or recording is active and follow local consent requirements.
## Studio call workspace
When a call connects, Studio can open a dedicated workspace tab with controls, participants, transcript, and live diagnostics. The tab opens after connection, so a failed ringing or dialing attempt does not leave an empty call workspace.
In **Settings → Calls**, configure:
* **Open call workspace automatically** — opens the tab as soon as a call connects.
* **Transcribe calls by default** — starts real-time transcription when the connected call workspace opens.
You can still open the workspace or toggle transcription manually during a call.
## Place, receive, and join calls
Studio can surface incoming-call notifications, call history, device selection, participant controls, and guest invitation links. For built-in team calls, choose the microphone, speaker, and camera before joining when the preview is available.
For SIP work, Studio provides dialing, incoming-call handling, DTMF, WebRTC connection status, live quality statistics, transcript controls, and a persistent call workspace. Confirm the number, trunk, and external destination before placing a call.
Guest links let someone join the specific call without becoming an organization member. Share them only with intended participants and end the call when guest access should end.
## Audio Use
Audio Use captures two local sources:
* **Microphone** — your side of the conversation.
* **System audio** — remote speakers or application output from Zoom, Slack, SIP applications, and other call surfaces.
Start Audio Use from Copilot or the Studio surface that offers it. Studio opens an Audio Use tab with live transcript state and controls to pause, resume, or terminate the listening session. Pausing releases local audio capture while retaining the transcript tab and session history.
Ask Copilot to summarize, extract decisions, create a follow-up list, or turn the transcript into a durable artifact. Verify names, numbers, and commands against the audio before treating the transcript as authoritative.
## Grant Audio Use permissions
Open **Settings → Audio Use**.
### macOS
* Grant **Microphone** for your local side.
* Grant **Screen Recording** for system audio from other applications.
* Select **Re-check** after changing permissions.
* Restart Studio if macOS still reports a granted permission as blocked.
### Windows
* Grant microphone access.
* Enable **Stereo Mix** or route call audio through a virtual audio device if remote output is not captured.
* Use the **Sound settings** action in Studio to inspect the active source.
On platforms where system audio needs no separate setting, Studio reports that no additional permission is required.
## Transcription and usage
Transcription is metered separately from AI chat. Open **Usage → Transcription** for daily minutes and **Usage → Calls** for call consumption. Limits can be set for transcription seconds, transcription sessions, and other supported call metrics.
The transcript is context, not live proof. Audio can be missed, speakers can overlap, and technical terms can be misheard. Confirm operational instructions before executing them.
## Troubleshooting
| Symptom | What to check |
| ------------------------------------- | ------------------------------------------------------------------------------------------------- |
| No microphone audio | Check the selected input device and OS microphone permission. |
| Only your voice is transcribed | Grant system-audio permission on macOS or configure Stereo Mix/virtual audio on Windows. |
| A connected call has no workspace tab | Enable automatic opening in **Settings → Calls** or open the call workspace manually. |
| Transcript starts too late | Enable **Transcribe calls by default** and verify usage is not limited. |
| Permission still shows blocked | Select **Re-check**, then restart Studio. |
| Call quality is poor | Inspect the call workspace diagnostics, device choice, and WebRTC network state before redialing. |
## Related
Bring a teammate or guest into an operational session.
Inspect call and transcription consumption and configure limits.
# Changelog
Source: https://altostrat.io/docs/studio/en/changelog/overview
Weekly updates to Altostrat Studio — new features, improvements, and fixes.
What's new in Studio. Entries are dated to the week they shipped, newest first.
## What's new
* **Studio Remote is available in production.** Pair the desktop app with Studio on iPhone, continue a conversation from your phone, follow live activity, and answer approval requests while the paired desktop remains the execution bridge.
* **Connector activity in the status bar.** Waiting connector connections now appear alongside other live work, making it easier to find an integration that needs attention.
## Improved
* **Faster connector use in chat.** Studio gets an integration into the conversation with less setup narration and clearer progress.
* **Free low-cost background assistance.** Eligible thread suggestions and other bounded Nova Micro side calls no longer consume the member's paid balance.
* **More stable long tool runs.** Tool configuration and MCP governance now carry consistently across continuation turns without unnecessary cache forks.
## What's new
* **Guided mobile pairing.** The desktop connection flow now supports a QR code or short pairing code, reports connected devices clearly, and lets you revoke a phone that should no longer have access.
* **Reusable generated artifacts.** Files produced during a conversation remain available as reusable work products instead of being tied only to the turn that created them.
* **Organization work-product memory.** Studio can preserve useful organization-scoped outcomes across chats, with policy and source context separating them from a member's private operational memory.
* **Per-conversation AI cost.** Chat details now show the models, tokens, and cost attributed to that conversation.
## Improved
* **Safer credit top-ups.** Purchase review now shows the amount, payment method, and required card confirmation before the charge is submitted. Top-up value remains visible after plan credits are exhausted.
* **Long-run guardrails.** The agent loop now has tool deadlines, a wall-clock boundary, cost preflight, and mid-run spend checks. Completion, cancellation, and recoverable-stop states are preserved in the transcript.
* **Clearer chat navigation.** Turn navigation sits beside the conversation, completed runs have compact summaries, and the latest-response controls are easier to reach.
## Fixed
* Concurrent approvals are queued instead of replacing one another, cancelled tools keep a truthful cancelled state, and follow-up prompts survive a conversation remount.
## What's new
* **Sandboxed Studio apps.** Generate a focused interactive app inside a dashboard. Apps run in a restricted frame and request named host capabilities rather than inheriting unrestricted workspace access.
* **Immutable app revisions.** Preview a revision, grant capabilities to its exact content hash, and explicitly promote the version that should be active. A changed revision must earn its own grants.
* **Dashboard version controls.** Batch snapshots, inline previews, and explicit promotion make it easier to inspect and recover dashboard changes.
## Improved
* Generated apps compile in packaged desktop builds, start more reliably, recover saved state, and present requested layouts and controls consistently.
* Dashboard panels resize more smoothly and show truthful loading, readiness, failure, and retry states.
* Credit top-ups are limited to the billing owner.
## Fixed
* Closed revision activation races, stale capability refreshes, app-startup transport failures, parent-visibility gaps, and dashboard polling hydration races.
## What's new
* **Organization control plane.** Administrators can manage member context, integration definitions, per-member or shared credential mode, tool policy, and account-readiness tasks from a coordinated organization surface.
* **Status-based chat board.** Organize conversations by status and move them through the board without losing their channel or transcript.
* **Per-chat model selection.** Choose a model for the current conversation instead of changing every chat globally.
* **Live browser activity.** Active browser sessions appear with the rest of a chat's running activity.
## Improved
* Computer Use now prefers direct, OS-aware tools before falling back to broad visual interaction.
* Studio Remote refreshes conversation snapshots, publishes approval changes reactively, and can wake an eligible paired desktop.
* Chat streaming, typing, scrolling, code-workspace routing, and general workbench interaction are more responsive.
## Fixed
* Tightened organization switching, integration-editor isolation, member-profile updates, shared-credential resolution, browser session reuse, and cloud credential scoping.
## What's new
* **Integration policy and account checklist.** Admins can allow an integration, choose personal or managed shared credentials, set defaults, and see whether members have completed required personal account setup without reading their secrets.
* **Layered tool policy.** Organization and channel controls now constrain connector, MCP, and first-party tools before they are offered to a conversation.
* **Detailed usage views.** Usage now breaks AI activity down by model and feature, shows remaining allocation as a percentage, and distinguishes plan value from top-ups.
## Improved
* Member context and approved tool preloads are synchronized so a conversation starts with the effective organization policy.
* Integration editors preserve supported configuration fields across the desktop and admin surfaces.
* Billing state, usage summaries, and shared-credit reads are more consistent across organization changes.
## Fixed
* Closed races around integration hydration, OAuth registration, member profile updates, partial policy, catalog visibility, and cross-organization editor state.
## What's new
* **Local OCR for Computer Use.** Studio can read visible application text through the local Computer Use path and use stronger window and coordinate context before targeting an action.
* **Digital-worker foundation behind the owner gate.** Early-access worker definitions gained staged execution, trigger dispatch, checkpoints, resume, and channel-bound control tools. Workers remain disabled unless explicitly enabled for the organization.
* **Clearer plan lifecycle.** Planning cards now expose the active plan state and execution progress more consistently.
## Improved
* Long chats compact and recover with more stable cache boundaries, model attribution, and exact-usage estimates.
* Computer Use prefers native inspection and checks the current window before applying coordinate-based interaction.
* Conversation failures remain visible after reload, truncated internal tool payloads stay out of the transcript, and procedure editors handle narrow layouts better.
## Fixed
* Corrected over-cap top-up accounting races, stale credit warnings after recovery, model-specific cache attribution, and several long-conversation retry loops.
## What's new
* **Model-aware usage display.** Studio replaced raw internal credits with percentage remaining for plan allowance and currency for purchased top-ups, while attributing cost to the model that ran each turn.
* **Postman-style connector defaults.** Connector definitions can set reusable headers and parameters, reference Key Chain entries, and sign supported AWS requests with SigV4.
* **Studio Remote preview foundation.** The first pairing, relay, conversation snapshot, suggestion, and approval paths entered gated desktop preview ahead of the production launch.
## Improved
* Adaptive thinking and the effort control now apply consistently to supported models; retired Sonnet 4.5 and Opus 4.6 choices were removed.
* Billing and Key Chain now open as first-class workspace destinations, and the macOS menu bar can show active Studio work.
* Hidden live dashboards pause work, Markdown and Mermaid rendering is steadier, and completed tool results remain visible.
## Fixed
* Improved connector parameter handling, default synchronization, billing-plan refresh, top-up state, mobile pairing-code expiry, and remote message snapshots.
## What's new
* **Dashboard data history.** Persistent versioned history records dashboard changes and supports earlier-state inspection and recovery.
* **Cloud dashboard refresh foundation.** Source hashes, shared refresh jobs, cached results, metering, and IP-pinned outbound fetches support coordinated panel data.
* **TV mode controls.** Detached live dashboards gained clearer wall-display controls and source-display behavior.
## Improved
* Dashboard type filters, edit controls, and detached-window presentation are easier to use.
* Auto routing, context estimation, prompt caching, and per-turn attribution reduce avoidable long-conversation cost.
* Billing usage reflects cached-input economics and the model and region that actually served each turn.
## Fixed
* Improved dashboard refresh coordination, source validation, files filtering, detached-route packaging, and update-status handling.
## What's new
* **Auto becomes the default model.** New and migrated conversations can use a visible Auto choice that selects Sonnet for normal work and escalates to Opus when deeper reasoning is warranted, with a one-click revert notice.
* **Synced channels.** Channels became organization resources with an administrative surface and channel-aware desktop sign-in and context.
* **Dashboard variables.** Define static or query-backed variables and reference them in panel parameters and request bodies.
## Improved
* Long agent sessions retain a bounded output tail and preserve salient terminal evidence during compaction.
* Procedure shortcut triggers are visible from the procedure list.
* Browser-anchored desktop sign-in uses a PKCE flow and respects the active release environment.
## Fixed
* Improved CLI table parsing, tab overflow, conversation-local suggestions, dictation draft isolation, dashboard variable resolution, and build reliability for the local embedding assets.
## What's new
* **Computer Use.** On macOS, Studio can inspect and interact with the desktop after Screen Recording and Accessibility permissions are granted. A secondary cursor path supports controlled background interaction.
* **Audio Use.** Capture microphone or system audio into a conversation, with clear start and stop state.
* **Claude Opus 4.8 with extended context.** Opus 4.8 is selectable with a 1M context option and adaptive thinking on the supported Bedrock path.
* **Procedure event triggers.** Start a procedure on a schedule, application focus, supported host lifecycle event, or configurable shortcut. App context can be attached to the triggered run.
* **Dashboard schema v3.** A resilient widget registry, explicit data-source adapters, error boundaries, autosaved layout, and optimistic editing form the new dashboard foundation.
## Improved
* New-chat shortcuts are configurable and can attach foreground application context.
* Trial conversion can carry unused value into top-up credit, plan downgrades wait for the billing-cycle boundary, and top-ups can cover use after a rolling plan window is full.
## Fixed
* Hardened Computer Use permission startup and moved-window safety, RDP workspace behavior, local code-tool approvals, MCP tool resolution, and approval hashing for shell redirection.
## What's new
* **Channel-scoped conversations.** Choose a channel for a new chat so its tools and context follow the team's operational scope.
* **Browser takeover.** Temporarily take manual control of the live browser session, then release it back to Studio without creating a second session.
* **Native web research.** Web search and page fetch tools can gather public source material without driving an interactive browser.
* **PDF export for reports.** Export a Markdown report as PDF from its artifact controls.
## Improved
* Procedure runs get their own linked conversations, scheduled runs prompt for inputs, and run artifacts appear with chat activity and files.
* Mentions for hosts and procedures persist as structured references in the composer and transcript.
* The billing surface consistently expresses plan and purchased value as credits and handles card confirmation when required.
## Fixed
* Improved RDP idle connection, browser approval noise, host credential linking, procedure-run approvals, replay availability, and payment or invoice links opened from the desktop app.
## What's new
* **Computer Use foundation.** Studio gained native screen inspection and controlled desktop interaction, with explicit separation between observation and state-changing actions.
* **Firmware staging over TFTP.** Stage a local firmware file from a selected private-network interface and copy the generated URL into a device workflow.
* **Local shell.** Studio gained a workstation shell with common file, text, network, pipeline, redirection, history, and completion commands, plus direct routing from Copilot.
## Improved
* RDP uses incremental frame updates for a more responsive remote desktop and resolves attached credential references at connection time.
* Runtime tabs survive conversation switches, and terminal sharing sends viewer interaction over the live peer channel instead of routing every keystroke through cloud state.
## Fixed
* Improved remote desktop reconnection, local permission reporting, terminal selection context, and workspace state restoration.
## What's new
* **SSH host-key verification.** Studio now checks an SSH host's key fingerprint on every connection. It asks you to confirm a device the first time you reach it, and warns you clearly if a known host's key changes later — a built-in guard against man-in-the-middle attacks.
* **Invoices for credit top-ups.** Every credit purchase now produces a downloadable invoice, ready for expenses and accounting.
## Improved
* **A chat-centric workspace.** The workspace was reorganized around the conversation — Copilot stays front and centre, with a single focused slot for whatever you're working on, whether that's a diagram, a data table, an editor, or a report.
* **A broad security-hardening release.** Device credentials are kept out of Copilot's tool calls, logs, and telemetry; stored connection settings are encrypted at rest; and isolation between organizations was tightened across sync and sharing.
* **Fewer interruptions from approvals.** Routine, low-risk actions prompt you less often, while anything that changes a device still asks first.
* **Per-conversation drafts.** Unsent text in the chat composer is saved per conversation, and each chat keeps its own artifact space — switching threads no longer mixes your work.
## Fixed
* **Call startup.** Fixed a set of issues that could delay or drop audio when a call first connected.
## What's new
* **One-click connector presets.** Add a ready-made connector in a single click. Altostrat SDX and Zendesk are the first presets, with their endpoints already mapped — no manual setup.
* **Mention Studio objects in chat.** Type `@` in the chat composer to drop a host, file, diagram, connector, or other object straight into your prompt, so Copilot works from the exact reference instead of a description.
## Improved
* **Your workspace persists and syncs.** Open tabs, splits, and layout are saved as you work, restored when you reopen Studio, and kept consistent across your Studio windows.
* **Smarter, safer Copilot.** Copilot now judges whether a command is destructive from the full conversation context rather than simple pattern-matching, gathers available evidence before acting, and asks instead of guessing when something is ambiguous.
* **Faster long conversations.** Copilot compacts conversation history in a way that preserves its working cache, cutting latency and cost on long threads.
## Fixed
* **MikroTik terminal.** Cleared stray colour codes in MikroTik output and a multi-second hang when opening some SSH sessions. SSH sessions also wait for their credentials to be ready before connecting.
* **Procedure edits.** Copilot editing a procedure no longer leaves a duplicate copy behind.
* **Sync and sharing.** Closed a class of bugs affecting shared-resource visibility and data isolation between organizations.
## What's new
* **Just-in-time runbooks.** Copilot can now propose a multi-step terminal sequence as a single approval, then run each step on your okay — quick fixes get the same audit trail as formal procedures.
* **Copilot drives dashboards and data tables.** Ask Copilot to update a panel, inspect a widget, or edit a data table inline, and it changes what you see without leaving the conversation.
* **Calls open in their own tab.** When a call connects, Studio now opens a dedicated workspace tab with live stats, dual audio meters, and auto-starting transcription. A new **Calls** settings panel controls the auto-open and auto-transcribe toggles.
* **Public-client OAuth for connectors.** Wire up APIs that use OIDC discovery and PKCE — no client secret required — when defining a connector.
## Improved
* **Resource sharing, rebuilt.** The visibility model and Share dialog were redesigned for clearer private/shared distinctions across hosts, files, procedures, diagrams, and chats.
* **Smarter voice transcription.** Voice input is now anchored with NetOps/MSP vocabulary so jargon and vendor names come through correctly, and streaming partials show in italics for quick visual confirmation.
* **Terminal replays as private files.** Saved sessions are now archived as deduped private files, browseable from the Files sidebar with an improved playback UI — sidebar entries open the replay directly.
* **Better default image generation.** Image generation now defaults to Stable Diffusion 3.5 Large with a richer fallback chain, and you can request a specific model by alias.
## Fixed
* **Single-click HTTP hosts and browser auto-login.** Hosts using HTTP/HTTPS now open straight into the in-app web view, and Copilot's browser tool correctly threads stored credentials into text fields when filling forms.
## What's new
* **Copilot can schedule itself.** Ask Copilot to follow up later — "check this in an hour", "remind me Monday morning" — and it will wake up and continue the conversation on time.
* **Live sub-agents in chat.** When Copilot delegates work to a sub-agent, you now see the sub-agent's progress as a live, expandable card in the conversation and in the status bar.
* **Open a Zendesk ticket from chat.** When Copilot can't help, it can escalate to Altostrat support without leaving the conversation.
* **Faster, peer-to-peer shared terminals.** Sharing a terminal session now uses a direct peer connection where possible, with smoother typing and fewer drops. Past sessions land in a new **Session Replays** tab.
* **Browse and install MCP servers from inside Studio.** A new MCP Directory lets you search a curated catalogue, see what each server does, and install it in one click — including support for self-signed certs.
* **Vulnerability scanning.** Copilot can now look up CVEs that match the devices you're connected to and explain the risk in plain English.
* **Native, redesigned billing.** Top up credits, add a card, and manage your plan with native Stripe Elements styled to match Studio. Country, tax-ID, and payment-method pickers are all searchable.
* **High contrast and personal themes.** A new high contrast theme for accessibility, plus dynamic themes that pick accents from your email domain.
## Improved
* **Procedures get scheduled runs and a richer timeline.** Schedule a procedure for later, browse runs in a timeline, and find their artifacts in the Files sidebar. The Markdown editor now supports an AI edit tool and a slash-command picker.
* **Real-time billing across windows.** Your usage, credits, and trial status update in real time across every open Studio window — no refresh needed.
* **Live dashboards on a responsive grid.** The dashboard canvas was rebuilt as a flexible grid that fills the viewport, with live summaries from your connectors.
* **Hardware-grade credential vault.** Your organization's credentials now live in a FIPS-compliant vault with automatic 30-day key rotation. The old master-password flow is gone.
## Fixed
* The "Trialing" badge now reflects remaining credits, not remaining days, so it disappears the moment you actually run out.
* Hosts no longer save before their keychain writes complete, eliminating a class of credential drift on shared folders.
## What's new
* **RDP support.** Connect to Windows hosts over RDP from the same workspace as your SSH sessions. Includes live frame streaming, fullscreen, a session indicator in the status bar, and AI-driven actions through Copilot.
* **Onboarding for new users.** A guided first-run flow that imports your existing hosts from PuTTY, SecureCRT, and Termius, scans for installed network tools, and walks you through your first Copilot task.
* **Procedures, rebuilt around Markdown runbooks.** Procedures are now plain-Markdown runbooks that Copilot can read, edit, and execute step-by-step. Sub-agents can run them as tools, and runs land in a unified timeline.
* **Share files and procedures with your team.** A new Share dialog lets you mark resources as private or shared with your organization, with a visibility badge on every list.
* **Improved sign-in with team management.** Sign-in, organization switching, billing, and team profile now share a single, themed dialog.
* **VS Code-style command palette and keybindings.** A unified command surface for the workspace with keybinding overrides — search commands, navigate, and run actions without touching the mouse.
* **Activity indicator in the status bar.** A single live indicator that shows every running task — chat agentic loops, sub-agents, sessions, calls, sync — with a popover to drill in.
* **Ask mode in chat.** Toggle Copilot into a read-only "Ask" mode for questions where you don't want any actions taken.
* **SNMP from chat.** Copilot can now run SNMP GET, walk, and bulk-GET against your devices, with vendor MIB name resolution.
* **New network probing tools.** PMTUD probing, packet capture, and flow collection are now available as Copilot tools.
## Improved
* The renderer was overhauled to use a VS Code-style workbench (now called the **Workspace**) with split panes, tab groups, and persistent state.
* Empty sidebar states are unified across hosts, files, diagrams, procedures, and chats.
* Onboarding events fire only on actual milestones, so the rating prompt shows up at the right moment.
## What's new
* **Voice calling.** Place and receive SIP calls from Studio with live transcription, DTMF, call history, codec pinning, and call-quality scoring. Calls survive NAT with built-in STUN.
* **PTZ camera control.** ONVIF detection lets you discover IP cameras on your network and control pan/tilt/zoom directly from a stream viewer.
* **OAuth for MCP servers.** Studio now supports the MCP standard OAuth flow (PKCE, dynamic registration, auto-discovery). Localhost callbacks are handled by Studio itself.
* **MCP servers as tabs.** The old MCP server dialog is gone — adding and editing MCP servers now opens as a tab, with reconnect feedback inline.
* **Online/offline indicator.** Studio now shows when it's offline and reconnects gracefully.
## Improved
* **Local-first storage with a cloud twin.** Your conversations, hosts, diagrams, and procedures sync continuously between local storage and the cloud, with conflict detection and force-resync controls.
* **Search and command palette merged.** One dropdown handles both — search local entities, app settings, and quick actions in the same list, with recent search terms.
* **Dashboards rebuilt as a builder.** The dashboard canvas became a rigid grid builder with viewport-aware generation and live polling panels.
* **Browser tools.** A picture-in-picture browser view, faster auto-approve toggle, and self-signed cert acceptance for MCP servers and connectors.
* **Team presence overhaul.** Manual status, idle detection, and deduplicated presence across devices.
## Fixed
* **Calling reliability.** Six bugs that were preventing reliable Chime calls and screen sharing have been fixed.
## What's new
* **Live dashboards.** Build polling dashboards from your connectors in a widget grid, with summaries and per-panel refresh.
* **API connectors.** A new connector system lets you wire any HTTP API into Studio with OAuth2 or custom auth, then call it from chat or a dashboard. Custom MCP servers join the same sidebar.
* **Account management inside Studio.** A full self-service account surface — profile, organizations, billing entry, team members.
* **Network status popover.** See your public IP, ASN, and ISP in one click from the status bar.
* **Network calculation tools.** Subnet math, IP parsing, and YAML/XML data conversion are now available as Copilot tools.
* **JIT components in chat.** Copilot can now render rich, just-in-time UI inside its responses — tables, charts, alerts, code blocks, diff views, forms — instead of plain text.
## Improved
* **Faster, smarter Copilot.** A new agentic loop runs tools concurrently, streams progress as it works, and routes to Claude Opus 4.6 or Sonnet 4.6 based on the task. Long conversations are now compacted in stages instead of failing.
* **Streaming status bar.** A persistent bar shows Copilot's current phase, turn progress, and per-tool durations.
* **Usage tracking.** Per-feature usage is now metered server-side and surfaced in a usage page, with a status-bar badge for app resource use.
* **Files sidebar.** Streamlined with cleaner empty states and faster host file workflows.
## Fixed
* Sign-in now exchanges tokens through the main process so production CORS no longer blocks Bedrock calls.
## What's new
* **Local credential vault.** Store device credentials encrypted on your machine with AES-256-GCM. Credentials redact themselves before anything is sent to Copilot.
* **Vendor-aware terminal.** Studio detects Cisco, Juniper, and MikroTik prompts, parses their CLI output into interactive tables, and shows a two-tier AI explanation for any error inline in the terminal.
* **Quake-mode terminal.** A global hotkey drops a terminal pane down from the top of the screen, ChatGPT-launcher style.
* **Up to 8 split panes.** Run more sessions side by side, with per-pane close controls.
* **Saved commands and templates.** Save commands for reuse, parameterize them with `{{variables}}`, and configure post-connect scripts that run automatically when you open a session.
* **SFTP file management.** Browse, upload, and download files on remote hosts from the Files sidebar.
* **Structured logs panel.** A bottom-panel **Logs** tab with structured agent log timelines, plus video support (HLS and RTSP) for CCTV troubleshooting.
* **Markdown editing.** Markdown documents now have a toolbar with formatting actions and a built-in Mermaid diagram creator.
## Improved
* **Memory budget per session.** Long terminal sessions automatically prune scrollback to keep performance steady.
* **Sidebar consistency.** Hosts, diagrams, chats, and procedures now share the same context-menu actions, folder behavior, and item layout.
## What's new
* **Shared terminal sessions.** Invite a teammate into a live terminal session — they see your output, you see them typing, and the session can be replayed afterwards.
* **Memory system.** A dedicated sidebar and detail view for Copilot's long-term memories, with date grouping, search, and full CRUD.
* **Workflows.** Multi-step procedures Copilot can run end-to-end, with grouped nodes, a context menu for editing, debug copy, and a workflow reflector for after-action review.
* **Browser auto-approve.** Toggle to let Copilot drive the headless browser without an approval prompt for each step.
* **Auto-updater.** Studio now checks for updates and notifies you in the status bar — with a manual check option.
* **Custom title bar on Windows and Linux.** Native minimize/maximize/close in a dark frame that matches the rest of the app.
## Improved
* **Diagram editor.** A new layers panel and selection spotlight in the inspector, AWS draw\.io fidelity import (with gradient fills and theme-aware contrast), section shapes, multi-select property edits, and smarter responsive toolbars.
* **VS Code-style workspace menus.** Unified tab chrome, workspace-level commands, and a faster team switcher.
* **Chat composer.** New `prompt-kit` based chat UI, deep-linked AI settings, and grouped tool cards for repeated actions.
* **YOLO mode.** Optional auto-approval for chat tools when you want Copilot to keep moving.
* **Theming.** A new theming architecture with smooth, native-feeling transitions between light and dark.
## What's new
* **Studio for Windows.** Studio now ships as a signed installer for Windows alongside macOS, with auto-incrementing versions and an integrated update flow.
* **Voice in chat.** Talk to Copilot — recordings transcribe in real time and an audio visualizer shows you the level. Microphone and camera permissions are now properly entitled on macOS.
* **Extended thinking.** Copilot can now think harder when needed, with cryptographically-signed reasoning sessions you can audit.
* **Team presence.** See who else from your organization is in the workspace and what they're doing.
* **AI usage tracking.** A usage page shows token consumption per feature, with a token-usage indicator wired into the status bar.
## Improved
* **Diagram editor v2.** A new MaxGraph-based editor with cleaner shape rendering, draw\.io import and export, viewport-preserving edits, and improved label and edge styling.
* **Local search.** Built-in full-text search now uses an on-device embedding model for relevance, downloaded the first time you launch Studio.
* **System tray.** A macOS tray icon and About dialog, plus dynamic window icons.
## Fixed
* Team switching is faster and more reliable, with better error logging when an org load fails.
Welcome to Altostrat Studio — an AI-native network operations IDE for engineers running production. A single workspace that combines a terminal, network diagrams, runbook execution, and a Copilot that can drive any of them.
## What's in the box
* **AI Copilot.** A conversational sidebar that can read your screen, run commands in your terminals, navigate web admin UIs, and edit code or markdown — with a clear approval flow for anything that touches a host.
* **Multi-protocol terminal.** SSH, Telnet, and serial console sessions in tabbed editor groups, with private-key and jump-host support.
* **Hosts and credentials.** A hosts sidebar with folder organization plus a local keychain that stores credentials encrypted on your machine.
* **Diagrams.** A diagram canvas with shape libraries, draw\.io import, and Mermaid support — opened side-by-side with terminals and chat.
* **Browser automation.** A headless browser tab Copilot can drive on your behalf for web-based device admin and service dashboards.
* **Search and command palette.** Full-text search across hosts, diagrams, conversations, and settings, plus a quick-action command palette.
* **Image attachments and Monaco code blocks.** Drop images into chat for Copilot to look at, and view structured output in a real code editor with syntax highlighting.
# Channels and the chat board
Source: https://altostrat.io/docs/studio/en/channels-and-chat-board
Organize Studio conversations by channel, control channel context and tools, and track work on the built-in chat board.
Channels give a group of conversations one operating context. A channel can be personal or shared, can have its own members and AI grounding, and can limit which tool families Copilot may use. Use channels for a customer, service, incident stream, or operating function where the same people and guardrails should apply repeatedly.
The chat board turns conversations in the active channel into a lightweight work queue. It is useful when a conversation represents work to track, not just a question to answer.
## Personal and shared channels
| Channel kind | Best for | Who can see it |
| ------------ | --------------------------------------------------------------------------- | ---------------- |
| Personal | Scratch investigations, private notes, and work that is not ready to share. | You. |
| Shared | Team operations, customer work, incident coordination, and durable queues. | Channel members. |
The channel switcher sits above the chat list. Switching channels changes the conversations, suggested context, members, and effective tool policy available to new work. It does not change the active Altostrat organization.
Always check both the organization and channel before approving an external or state-changing action. A correct host in the wrong customer channel can still use the wrong context or policy.
## Create a channel
Select the current channel above the conversation list, then choose the create action.
Pick a personal channel for private work or a shared channel for a defined group of organization members.
Use a name people will recognize in search and the switcher. Add an icon and concise purpose when several channels have similar names.
Open channel settings before operational use. For a shared channel, add only the members who need its context and resources.
## Channel settings
Channel settings are divided into five sections.
| Section | What it controls |
| ------------ | ----------------------------------------------------------------------------------- |
| General | Channel name, icon, and descriptive fields. |
| Members | Channel membership and the channel role for each member. |
| Tools | Capability families and individual tools available to conversations in the channel. |
| Your context | Personal grounding that applies to you inside this channel. |
| Advanced | Administrative actions, including archiving the channel. |
Channel owners and admins can edit shared-channel settings. Members can view the channel and maintain their own context where policy permits.
### Roles
| Role | Typical responsibility |
| ------ | --------------------------------------------------------------------------------- |
| Owner | Owns the channel boundary and can manage all settings and membership. |
| Admin | Maintains members, tool availability, and channel configuration. |
| Member | Participates in conversations and uses the tools allowed by the effective policy. |
An organization role and a channel role are separate. An organization admin is not automatically the owner of every channel, and channel membership does not grant organization-administration access.
### Tool policy
The **Tools** section enables capability families such as host operations, connectors, procedures, planning, and Studio management. Channel policy is a ceiling: it can narrow organization policy, but it cannot re-enable a tool the organization has disabled.
Effective access is layered:
1. The organization makes a built-in domain, connector, MCP server, or individual tool available.
2. Member policy can preload or further restrict tools for a person.
3. The active channel can narrow the set again.
4. A digital worker stage can narrow its own grants below the channel ceiling.
Changing policy affects which tools are offered and which calls the runtime will dispatch. It does not place missing personal credentials into a member's Key Chain.
### Context
Channel context is grounding, not a secret store. Use it for the customer's operating rules, naming conventions, escalation path, environment boundaries, and definitions that should shape every conversation in that channel.
Good channel context is specific and stable:
* "Production changes require a linked change record and a peer approval."
* "Use the `customer-a-prod` connector for this channel; do not query the lab tenant."
* "All times in incident summaries must be UTC."
Do not paste passwords, tokens, private keys, or recovery codes. Use [Key Chain and managed credentials](./connectors-and-mcp) instead.
## Work with conversations
New chats start in the selected channel. The composer shows the current channel so you can catch an incorrect scope before sending. From the chat list you can rename, pin, archive, or set the conversation status.
The supported statuses are:
* **No status** — ordinary conversation or untriaged work.
* **Processing** — Studio or a teammate is actively processing it.
* **In progress** — accepted work that is not finished.
* **Cancelled** — intentionally stopped.
* **Done** — completed work.
## Use the chat board
Open **Chat board** from the channel menu. The board groups conversations by status. Drag a card to another column to update its status, or open the card to continue the conversation.
Use the board for queues where the conversation is the work record:
* Incident investigations awaiting evidence.
* Customer requests moving from triage to action.
* Maintenance tasks that need approval or follow-up.
* Digital-worker items that pause for human judgment.
Keep status meaning consistent within a channel. If **Processing** means "automation is running" for one team, do not also use it for "waiting for customer."
## Archive a channel
Archive a channel when the operating stream is no longer active. Archiving removes it from normal switching without rewriting its history. Review active conversations, scheduled work, integrations, and worker bindings before archiving.
## Related
Manage organization-wide members, context, integrations, and tool availability.
Run staged, trigger-driven pipelines under a shared channel's policy.
# Connectors and MCP
Source: https://altostrat.io/docs/studio/en/connectors-and-mcp
Extend Studio with REST or SOAP connectors and HTTP or SSE MCP servers, with personal or shared credentials and layered tool policy.
Connectors and MCP servers extend Copilot and dashboards beyond Studio's built-in tools.
* A **connector** defines named REST or SOAP endpoints and their request shape.
* An **MCP server** publishes a tool catalog over Streamable HTTP or SSE.
Definitions, credentials, and tool availability are separate concerns. A shared definition does not require a shared secret, and an enabled tool cannot run until the effective credential is ready.
## Choose connector or MCP
| Need | Prefer |
| ------------------------------------------------------- | ------------------------- |
| A small set of known REST or SOAP operations | Connector. |
| Explicit method, path, query, body, and response schema | Connector. |
| A service already publishes MCP tools | MCP server. |
| A tool catalog that evolves at the server | MCP server. |
| A standard website with no API | Browser, not a connector. |
## Personal and organization integrations
Create a personal integration for private experimentation. Use the organization catalog when a definition, description, and policy should be centrally maintained.
For an organization definition, choose a credential mode:
| Mode | Behavior |
| ---------- | ---------------------------------------------------------------------------------------------------------------------------------- |
| Per member | Every member connects their own external account in a private Key Chain entry. External audit can attribute actions to the person. |
| Shared | An authorized administrator provisions one organization/service credential for permitted members. |
Use per-member credentials for user-level authorization and accountability. Use shared credentials only for an intentional service identity with a documented owner, rotation path, and external audit trail.
## Create a connector
Add a clear name, description, base URL, and visibility. Name the tenant or environment when confusion would be dangerous.
Link a Key Chain entry or complete OAuth. Avoid inline legacy secret fields.
Define method, path, inputs, body, response, and side effects for each callable operation.
Verify authentication, tenant, pagination, error shape, and rate limits with a safe endpoint.
Add mutation endpoints only after the approval view clearly identifies the target and payload.
### Connector authentication
Studio supports none, basic, bearer, API key, OAuth 2 client credentials, OAuth 2 password, OAuth 2 authorization code, digest, AWS Signature Version 4, and custom header templates.
Authorization-code flows can use OIDC discovery and public-client PKCE where supported. When an OAuth refresh fails, Studio keeps a visible re-authorization state rather than silently retrying forever.
Store values in Key Chain. Custom header templates may reference named Key Chain values, but the template and endpoint description must not print the resolved secret.
### Endpoint quality
| Field | Good practice |
| ----------- | --------------------------------------------------------------------------------------------- |
| Name | Start with a verb, such as `listAlarms` or `createTicket`. |
| Description | State purpose, side effects, tenant, and when not to use it. |
| Inputs | Use explicit typed fields and enums instead of one free-form object. |
| Response | Describe the stable shape, pagination, and important error fields. |
| Mutation | Include the destination, object identity, idempotency key, and dry-run option when available. |
## Add an MCP server
Provide a name, server URL, transport, authentication, and visibility. Studio supports browser-compatible **HTTP** and **SSE** transports, not local stdio servers.
MCP authentication supports none, API key, bearer, OAuth 2 client credentials, OAuth 2 authorization code, and MCP-standard automatic OAuth discovery. For automatic OAuth, Studio follows the server's discovery and registration flow.
Studio discovers the tool catalog after connection. An organization server can publish that catalog to the administration console, where an admin can disable the server or individual tools.
### MCP Directory
Open the MCP Directory from the Connectors surface to search the curated catalog and install a definition. Review the source, requested server URL, authentication, and tool descriptions before connecting. A catalog listing is not a security guarantee.
## Connect your account
When organization policy allows a per-member integration but your private credential is missing, **Settings → Profile** shows it in the connect-your-accounts checklist. Use the offered OAuth or Key Chain action.
Admins can see readiness status, not the secret. Do not send a token to an admin in chat as a workaround.
## Effective tool policy
An integration must pass every layer:
1. Organization availability and per-tool policy.
2. Member access and optional preload.
3. Active channel policy.
4. Worker-stage policy, for a digital worker.
5. Credential readiness.
Studio enforces the result at discovery and dispatch. If an old conversation references a now-disabled MCP tool, runtime dispatch still rejects it.
## Approvals and external effects
Read-only and write endpoints should be separate tools. An approval must identify the external system, tenant, target object, and proposed payload. Keep browser or Copilot Autopilot off while validating a new integration.
For dashboards, choose read-only endpoints and sustainable refresh intervals. A dashboard can multiply traffic if several panels poll similar calls, even though Studio reuses compatible fetches where possible.
## Troubleshooting
| State or symptom | What to check |
| -------------------------------------- | ------------------------------------------------------------------------------ |
| `needs-auth` | Complete the account flow or create the required named Key Chain entry. |
| 401 or refresh failure | Re-authorize, verify client configuration, and confirm the credential mode. |
| 403 | Check external permissions and Studio's organization/member/channel policy. |
| MCP connects but tools are missing | Refresh the catalog and inspect per-tool organization and channel toggles. |
| Tool is visible but dispatch is denied | The active policy changed or the conversation contains a stale tool reference. |
| Connector returns an unexpected shape | Correct the response schema and account for pagination or error envelopes. |
| Wrong tenant | Disable the integration until base URL and credential scope are corrected. |
## Related
Maintain organization definitions, credential modes, tool catalogs, and member readiness.
Build resilient views from connectors and review app capabilities.
# Dashboards and generated apps
Source: https://altostrat.io/docs/studio/en/dashboards-and-apps
Build live operational dashboards, investigate changes, and run sandboxed AI-generated apps with explicit capability grants.
Studio dashboards turn connector data, host evidence, and structured results into a saved operational view. You can build the layout directly or ask Copilot to create and refine it. A dashboard can contain standard widgets and sandboxed generated apps.
## Dashboard building blocks
Standard widgets cover the common monitoring shapes:
| Widget | Use it for |
| --------------------------------- | ---------------------------------------------------------------- |
| Metric, gauge, and stat sparkline | A current value, threshold, or compact trend. |
| Chart and heatmap | Time series, comparisons, and density. |
| Table and logs | Detailed rows, events, and sortable evidence. |
| Alert and status | Conditions that need attention. |
| Topology | Relationships between devices or services. |
| AI card | A generated explanation or summary tied to dashboard data. |
| App | A custom, interactive React surface generated for the dashboard. |
The dashboard grid supports resize, drag, multi-select, contextual actions, and responsive layouts. Use variables for repeated filters such as site, tenant, host, or time range. Use transforms to derive the value a widget actually needs from a larger response.
## Create a dashboard
Start with the question the dashboard must answer, such as "Which sites are outside latency SLO?" Avoid collecting metrics with no operating action.
Use a connector, MCP tool, host operation, or other structured source. Confirm the credential scope and tenant before saving it.
Ask Copilot to create the initial layout or add widgets manually. Give each widget a clear title, unit, empty state, and threshold.
Verify normal data, no data, partial data, authentication failure, and a slow source. A dashboard must remain readable when one panel fails.
Name the dashboard for the operational question and confirm its visibility before teammates rely on it.
## Refresh behavior
Dashboards can poll live sources. Studio coordinates shared fetches so panels that use the same source can reuse one result instead of multiplying external calls. Use a refresh interval that matches the source and decision; faster is not always better.
Pause or lengthen polling for expensive APIs and during large-screen wall use. A panel should display the last successful result and a visible error state rather than turning a source outage into an empty dashboard.
## Investigate changes
Studio can mark anomalies and apply visual filters across a dashboard. Use **Explain anomaly** for a focused interpretation of an unusual point and **What changed** to compare the current view with earlier evidence.
Treat generated explanations as hypotheses. Open the underlying data and verify timestamps, units, aggregation windows, and missing records before acting.
## History and recovery
Dashboard edits create history. Open history to inspect earlier versions and restore a known-good layout after an accidental or unhelpful change. Restoration changes the current dashboard but does not rewrite the earlier revision record.
Use history before manually rebuilding a damaged dashboard. It is also the fastest way to identify whether a source change or a layout change caused a regression.
## Wall and TV mode
Wall mode removes editing chrome and emphasizes the live grid for a shared display. Before leaving a dashboard unattended:
* Confirm every source uses the intended tenant and read-only access where possible.
* Remove panels that expose personal or customer-sensitive data.
* Set a sustainable refresh interval.
* Test reconnect and stale-data indicators.
* Keep an operator path for exiting wall mode and restoring a failed panel.
## Generated dashboard apps
A dashboard app is a small React application generated and stored as an immutable revision. Use one when standard widgets cannot express the interaction you need—for example, a guided calculator, a multi-step inspection surface, or a specialized topology interaction.
Each improvement creates a new revision. The dashboard continues to reference a specific revision until the update is accepted, which keeps a generated change from silently replacing the running version.
### Capability grants
Apps run in a sandbox. An app receives no external capability simply because its code asks for one. You explicitly enable the requested capabilities in app settings.
Grants are:
* **Per user** — your grant does not silently authorize another teammate.
* **Exact** — the current capability set is hashed and bound to the grant.
* **Revision-aware** — a capability change can require renewed review.
* **Origin-limited** — network access is constrained to the allowed resource origins.
Review generated app capabilities like connector permissions. A polished UI does not make a broad network or mutation grant safe.
### Improve an app
Open the app's improvement action, describe the behavior you want changed, and review the generated revision. Test the new revision with capabilities disabled first, then grant only what the app needs.
If an update breaks the app, return to the previous working revision rather than expanding permissions to make the failure disappear.
## Troubleshooting
| Symptom | What to check |
| ------------------------------ | ------------------------------------------------------------------------------------------- |
| A widget never leaves loading | Confirm the connector is ready, authenticated, and returning the expected response shape. |
| Panels show different values | Check time range, variables, transforms, refresh timestamps, and units. |
| A generated app is disabled | Open app settings and review its requested capabilities and resource origins. |
| A grant stopped applying | The app's capability hash changed; review the new request instead of reusing the old grant. |
| A recent edit broke the layout | Open dashboard history and restore the last known-good version. |
## Related
Define the sources and credential modes that dashboards call.
Reopen durable dashboards, apps, reports, and artifacts across chats.
# Digital workers (early access)
Source: https://altostrat.io/docs/studio/en/digital-workers
Create owner-enabled cloud workers that run staged, trigger-driven pipelines under a shared channel's grounding and tool policy.
Digital workers are cloud-run, trigger-driven pipelines for repeatable operational work such as ticket triage, scheduled reports, and follow-ups. A worker is bound to a shared channel and acts under that channel's grounding and tool ceiling.
Digital workers are an owner-gated early-access capability. Organizations fail closed with workers disabled. If **Administration → Workers** says workers are off, only the organization owner can enable access when the feature is available to the organization.
## When to use a worker
Use a worker when all of these are true:
* Work arrives from a repeatable trigger.
* The job can be split into clear stages with explicit outputs.
* The channel's context and tool policy provide a safe operating boundary.
* A human gate can catch steps that need judgment.
* The organization accepts cloud execution for the selected tools and data.
Use an interactive conversation or a [procedure](./procedures) when a person should initiate and supervise the work directly. Workers are not a shortcut for removing approvals from uncertain tasks.
## Worker structure
| Part | Purpose |
| -------------- | ------------------------------------------------------------------------------ |
| Identity | Name, description, and lifecycle state. |
| Channel | Shared channel that supplies context, membership, and the maximum tool policy. |
| Trigger | Event or schedule that starts work. |
| Input contract | Fields a new work item must provide. |
| Stages | Ordered AI steps with their own instructions and grants. |
| Stage exit | Automatic continuation, verification criteria, or a human gate. |
| Output | Result passed to later stages, the channel, or the originating system. |
New workers begin as drafts. Configure and test them before activation.
## Create a worker
Set the channel's members, grounding, and tool policy first. A worker cannot safely compensate for an ambiguous channel boundary.
Select **Create worker**. If the action is unavailable, confirm the organization owner has enabled the feature.
Name the worker for the outcome and define structured input fields. Avoid one free-form field when the trigger can provide tenant, device, priority, or ticket ID separately.
Give each stage one job, a clear completion condition, and only the tool domains or individual tools it needs.
Use a human gate before consequential external actions. Add exit criteria that prove the stage produced usable evidence.
Run representative inputs, failure cases, missing credentials, and policy-denied tools. Review the resulting work item and channel activity.
Enable the trigger only after the draft is ready. Pause the worker if behavior, source data, or policy becomes uncertain.
## Tool policy and credentials
A worker stage can narrow the tools available to it, but cannot exceed the bound channel or organization policy. If a selected domain is disabled at the channel layer, the runtime drops it even if the worker editor still contains the old grant.
Workers are organization actors rather than member sessions. Plan credential access deliberately:
* Prefer read-only organization service credentials for unattended collection.
* Keep tenant and target explicit in stage instructions and tool inputs.
* Do not assume a member's personal Key Chain entry is available to a cloud worker.
* Use human gates for writes, purchases, user communication, or other irreversible external effects.
## Human gates
A stage with **Human gate** pauses before leaving the stage. The reviewer should inspect input, evidence, proposed action, and channel scope before approving or answering the task.
A good gate asks for a decision a person can actually make. "Approve remediation on `edge-03` using change `CHG-123`" is better than "Continue?"
Open worker items can surface in the channel's work flow and chat board. Assign ownership for reviewing gates; an unattended gate is a stalled automation.
## Operate the lifecycle
* **Draft** — editable and not trigger-active.
* **Active** — accepts enabled triggers and runs work.
* **Paused** — stops new triggered work while preserving the definition and history.
* **Archived** — retained for history and no longer operated.
Pause before changing a live worker's tool boundary or stage semantics. Validate the updated draft path, then reactivate.
## Troubleshooting
| Symptom | What to check |
| ------------------------------ | ---------------------------------------------------------------------------------------- |
| Workers are off | The organization owner must enable early access when available. |
| Create worker has no channel | Create an active shared channel first. |
| A stage cannot find a tool | Check organization, channel, and stage policy, then confirm the tool catalog is current. |
| A stage lacks authentication | Use an appropriate organization credential; do not rely on a member's private entry. |
| Work is stuck | Check trigger state, open work items, human gates, and stage verification criteria. |
| A policy change broke a worker | Pause it, review effective grants against the channel, and test before reactivation. |
## Related
Define the grounding, membership, and tool ceiling a worker inherits.
Manage organization context, integrations, members, and effective access.
# Files and artifacts
Source: https://altostrat.io/docs/studio/en/files-and-artifacts
Find persistent generated work, reports, tables, code, dashboard apps, session replays, and remote host files from Studio's Files view.
The **Files** view is the durable entry point for work created or opened in Studio. It brings together generated artifacts, saved dashboard apps, session replays, user-created documents, and files reached through a host.
Recent generated work persists beyond the chat that created it. Studio also records durable work products in organization memory so a later conversation can find and continue the right app or artifact without relying on the old transcript alone.
## Artifact types
Copilot can create structured work such as:
* Markdown reports with tables, code, and Mermaid diagrams.
* Data tables with sorting, filtering, selection, and export.
* Code, configuration, and text in an editor.
* Before-and-after diffs.
* Network diagrams.
* Saved dashboards and sandboxed dashboard apps.
* Status cards, forms, charts, and other generated interaction surfaces.
Use a dashboard for live, refreshable operational state. Use a report or table for a point-in-time result. Use a procedure for steps the team will run again.
## Find generated work
Open **Files** from the fixed sidebar. Recent artifacts appear directly in the Files surface and unified search. Search by title, content, kind, or related operational term.
When you ask Copilot to continue an app or artifact from an earlier chat, Studio can use its organization work-product record to recover the locator, workspace, source host, revision, and last-known state.
"Last known" is not "currently running." Verify the file path, host, process, revision, dashboard, or URL before resuming or announcing availability.
## Work with generated artifacts
| Action | Guidance |
| --------------- | --------------------------------------------------------------------------------------- |
| Open | Opens the artifact in the workbench without requiring the originating chat. |
| Edit | Creates or saves a new current state appropriate to the artifact type. |
| Improve with AI | Sends the current artifact and requested change back to Copilot. |
| Export | Uses an artifact-appropriate format, such as Markdown, PDF, CSV, image, or source file. |
| Archive | Removes stale work from the active view while retaining history. |
| Delete | Removes the selected durable record; read the confirmation scope before proceeding. |
Export a report as PDF when it needs to leave Studio. Export structured table data as CSV when another system will process it.
## Dashboard apps
Generated dashboard apps are saved as immutable revisions. An accepted improvement creates a new revision rather than mutating the old source in place. Open app settings to review the current revision, requested capability grants, and permitted resource origins.
See [Dashboards and generated apps](./dashboards-and-apps) before granting an app external access.
## Session replays
Terminal session recordings appear as private replay files. Open a replay from Files to review the recorded output and timeline. A replay is evidence of what Studio captured, but does not prove the remote system remained in that state afterward.
Share recordings only with people who are allowed to see the terminal output and commands. Recording can contain hostnames, addresses, data, and secrets printed by a remote system.
## Remote files over SFTP
For an SSH-capable host, select the host in Files and browse its remote filesystem over SFTP. Remote files open in Studio editors and save through the configured host session.
| Action | Result |
| ------------------ | -------------------------------------------------------------- |
| Browse | Lists directories available to the SSH credential. |
| Open | Reads the remote file into an editor tab. |
| Save | Writes the edited content back to the remote path. |
| Upload or download | Transfers a file between the workstation and host. |
| Inspect properties | Shows or changes supported permissions and ownership metadata. |
Saving, uploading, deleting, renaming, or changing permissions modifies the remote host. Confirm the host, absolute path, active credential, and backup or rollback path first.
## Create and organize documents
Create a file for a note, checklist, report, or source document that should exist independently of a single answer. Use clear, searchable names that include the site, service, date, or change identifier when relevant.
Prefer a small number of meaningful folders over a deep hierarchy. Unified search and organization memory are designed to retrieve work by meaning and operational context.
## Keep durable work trustworthy
* Include source timestamps and time zones in reports.
* Link or name the host, connector, tenant, and procedure that produced evidence.
* Mark assumptions and unverified conclusions.
* Store secrets in Key Chain, never in an artifact or organization memory.
* Verify generated code and app permissions before execution.
* Archive stale operational views and keep historical reports clearly dated.
## Troubleshooting
| Symptom | What to check |
| ------------------------------------------- | ----------------------------------------------------------------------------------------------------- |
| A recent artifact is missing | Search the title or content, check the current organization, then open the originating chat if known. |
| Copilot found the app but it is not running | Treat organization memory as last-known state and verify its host, process, port, and revision. |
| A dashboard app is blocked | Review its revision-specific capability grants and allowed origins. |
| A remote folder will not open | Confirm the host supports SSH/SFTP, credentials are ready, and the path is permitted. |
| Save failed | Re-check the active host, remote permissions, session health, and whether the file changed remotely. |
## Related
Understand personal facts, organization work-product records, and unified retrieval.
Create dashboards and review generated-app revisions and capability grants.
# Hosts and credentials
Source: https://altostrat.io/docs/studio/en/hosts-and-credentials
Build device inventory, attach multiple protocols per host, and reuse personal or managed credentials through Key Chain.
A host in Studio is an entry in your inventory — a logical target you connect to. Most hosts have more than one way in: an SSH CLI, an HTTPS management UI, sometimes RDP, sometimes VNC, sometimes a video stream. Studio lets you attach all of those to a single host instead of maintaining duplicate rows.
Credentials live in Key Chain and get referenced from hosts. A username and password, SSH key, or token is maintained as a credential entry rather than copied into every protocol. When an entry rotates, every host that references it uses the updated value on the next connection.
The result is inventory that reflects the real shape of your environment: one device, several ways to reach it, and credentials you don't duplicate by hand.
## Creating and organizing hosts
Open the Hosts activity in the sidebar to see your inventory tree. The toolbar gives you search, sort, **New Host**, **New Folder**, import, and collapse actions. You can add a host directly, nest hosts in folders that mirror your sites or customers, and search by hostname, address, or tag.
Right-click a host for the fast path: connect over SSH, open it, open it to the side, edit it, detect the device with AI, pin it, or delete it. Use **Open to the Side** when you want the host editor beside a terminal, procedure, artifact, or comparison target.
## Add your first host
The host editor opens in the main canvas. Give the host a name first; this is the label people will search for later.
Fill in the hostname or IP. Use the stable management address, not an address you only learned during an incident.
Choose SSH, Telnet, HTTP, HTTPS, RDP, VNC, Video Stream, or Custom. Set the label, port, address override if needed, and any protocol-specific fields.
Studio does not store credentials inline on the host. Pick an existing Key Chain entry or create one from the credential control.
The preferred protocol is what Studio uses for a quick open or double-click. Pick the safest everyday entry point.
The connect action stays disabled until the required host, protocol, and credential fields are complete.
The editor also includes jump host settings, post-connect scripts, and device identity fields. You can let Studio detect vendor, model, operating system, and version automatically, then override those values when you need a cleaner inventory label.
* Add a host from the Hosts activity, inline from a diagram, or from inside a terminal when Copilot suggests one.
* Organize into folders — region, customer, site, lab, device role, on-call ownership.
* Search by hostname, address, tag, or vendor.
* Import from a list — existing session exports or a CSV paste.
* Right-click for quick actions without opening the full editor.
## Protocols
A host can carry any combination of the protocols below. Each one has its own settings, and you mark one as the preferred protocol so a quick open or double-click uses it.
| Protocol | Typical use | What you configure |
| ------------ | ----------------------------------------------------------------- | ------------------------------------------------------------------------------------- |
| SSH | Network device CLI, Linux shells. | Address, port, username, credential reference, optional jump host, optional key path. |
| Telnet | Older equipment that doesn't speak SSH. | Address, port, username, credential reference. |
| HTTP / HTTPS | Device web management UIs. | URL, optional credential reference for basic auth. |
| RDP | Windows desktop access. | Address, port, username, credential reference, NLA/CredSSP options. |
| VNC | Remote framebuffer access. | Address, port, credential reference. |
| Video stream | RTSP or ONVIF camera. | Stream URL or ONVIF endpoint, credential reference, profile. |
| Custom | Anything you need to track that does not fit a built-in protocol. | Label, address, port, and any connection details your team needs. |
### Protocol labels and overrides
Use protocol labels to make intent obvious: `SSH`, `OOB SSH`, `HTTPS GUI`, `RDP jump`, `Camera stream`, `Vendor portal`. If one protocol reaches a different address than the host's primary address, set an address override on that protocol instead of creating a second host.
Custom protocols are useful for things you need to document even when Studio does not open them directly: a vendor console, a support portal, a maintenance URL, or a local-only jump path.
## Jump hosts
For devices you can only reach through a bastion, set a jump host by name on the SSH protocol. Studio inherits the jump host's SSH session and chains to the target — you don't duplicate credentials on the inner host, you just point at the bastion and let its configuration do the work.
Use a jump host when the network path matters as much as the target. It makes the access pattern visible to your team and gives Copilot the right context when it plans diagnostics or explains why a device is reachable from one place and not another.
## Device identity
Studio fingerprints each device automatically. On first connect it reads the banner and runs a small set of read-only probes to infer vendor, OS, and software version. The identity shows up in the status bar and feeds Copilot's command hints, parsers, and diagnostic suggestions. You can override any field manually when the auto-detection gets it wrong or when you want to label a host a specific way.
You can also run device detection from the host context menu. Use that when you imported inventory from a flat list and want Studio to fill in vendor or OS details before anyone connects during a change window.
## Key Chain
Key Chain is the credential store behind every host. Personal entries remain private to the member. Where the organization has deliberately provisioned a shared service credential, policy and membership determine who can use its reference.
### What it stores
| Type | What it holds |
| ------------------- | ---------------------------------------------------------------------- |
| Username & password | Classic login pairs for CLI, web UI, and RDP. |
| SSH key | Pasted key material or a path to a key file, with optional passphrase. |
| Token or secret | API tokens, bearer tokens, shared secrets for connectors or webhooks. |
### Referencing a Key Chain entry
In the host editor, each protocol has a credential dropdown. Pick an existing Key Chain entry and the host uses it for authentication. You can set the same reference on a folder to apply it to every host inside — useful when a site or customer shares one set of credentials.
The credential field is intentionally required for protocols that authenticate. A host with a missing credential can still be organized and edited, but it cannot connect until a Key Chain entry is attached.
### Rotating a credential
Edit the Key Chain entry once. Every host that references it picks up the new value on the next connect. You don't hunt through the inventory touching individual rows.
Put reusable secrets in Key Chain from day one. Per-host credentials should be the exception — device-specific keys, one-off admin passwords — not the default.
## Visibility
Hosts can be private or shared according to the visibility control. Sharing a host does not share your personal credential. Every teammate needs an allowed personal entry or an explicitly managed shared credential. See [teams and organizations](./teams-and-organizations) for organization, channel, role, and credential boundaries.
## Related
Connect, use clickable network objects, stage commands, and replay sessions.
How credentials are protected, what syncs, and what stays on your machine.
# Install and sign in
Source: https://altostrat.io/docs/studio/en/install-and-sign-in
Install Studio for macOS or Windows, prepare network and OS access, sign in, and complete a safe first setup.
Studio is a desktop app. Device sessions and local interface control originate from the workstation running Studio, so that workstation must have the same VPN, routing, firewall, and operating-system access an operator would need without Studio.
## Download Studio
For Apple silicon Macs.
For Intel-based Macs.
For supported 64-bit Windows systems.
Install the package and launch Studio. The desktop app checks for signed updates after installation; you can also check from **Settings → About**.
## Prepare the workstation
| Check | Why it matters |
| ------------------------------------------- | ------------------------------------------------------------------------------------------------------------ |
| Internet access | Sign-in, synchronization, updates, model calls, billing, and cloud integrations require outbound access. |
| Device reachability | Terminal, remote desktop, browser, diagnostics, and custom host connections originate from this workstation. |
| VPN, route, or jump host | Private management networks must already be reachable through the approved path. |
| Screen Recording and Accessibility on macOS | Computer Use requires both. System-audio capture also depends on Screen Recording permission. |
| Microphone and camera | Voice input, calls, and related media features request the appropriate OS permission. |
| Capture and local-network access | Packet capture, discovery, and some diagnostics may need additional OS privileges or security approval. |
| Organization membership | An existing organization must invite or add you before its team and channel resources appear. |
See [System requirements](./system-requirements) for protocol-specific prerequisites and [Troubleshooting](./troubleshooting) if a permission or connection fails.
## Sign in and choose a workspace
Sign in with your Altostrat account. Studio loads the organizations you belong to and the resources visible to your membership and channel policy. If you are joining an existing organization, use the invited account rather than creating a second workspace.
On a fresh profile, Studio guides you through initial identity and workspace choices. The exact prompts can change as onboarding evolves; review the resulting defaults before the first production task.
## Review the first-run defaults
Check the organization and channel switcher before creating a conversation or shared resource. Scope determines which context and policies apply.
Open **Settings → AI**. Confirm the default model, context window, inference region, follow-up behavior, turn limit, and memory settings. Leave Autopilot off for the first run.
Enable Computer Use, Audio Use, microphone, camera, capture, or local-network access only for features you intend to test.
In **Settings → Profile**, complete any organization integration tasks assigned to you. Use OAuth or a private Key Chain entry as directed.
Create a host, attach the needed protocol, and select a Key Chain credential reference. Verify host-key or certificate prompts instead of accepting an unexpected identity.
Start in **Ask** mode or use a read-only diagnostic in **Default** mode. Confirm the attached context and inspect the activity stack before granting broader access.
## Add another workstation
Sign in with the same account and organization membership. Organization resources and supported workspace state synchronize according to their visibility. Local reachability, OS permissions, live sessions, and other device-specific state must be configured on each workstation.
Personal credentials remain associated with the member, while organization-managed shared credentials follow the policy configured by an administrator. Do not assume that every local or sensitive artifact automatically becomes available on another device; verify its visibility from the destination workstation.
## Next steps
Walk through the sidebar, channels, conversation surface, artifact area, tabs, and activity stack.
Build inventory, attach protocols, and use the correct credential mode.
Configure modes, models, context, approvals, and slash commands.
Understand credentials, sharing, browser access, Computer Use, apps, and paired phones.
# Keyboard shortcuts
Source: https://altostrat.io/docs/studio/en/keyboard-shortcuts
Current Studio shortcuts for new chat, search, the artifact workbench, tab groups, terminal panes, settings, and procedure triggers.
`Mod` means Command on macOS and Ctrl on Windows. Some terminal shortcuts override a global shortcut while the terminal has focus.
## Global and navigation
| Shortcut | Action |
| ------------- | -------------------------------------------------------------------------------- |
| `Mod+N` | Start a new chat in the current channel. The in-app accelerator is configurable. |
| `Mod+K` | Open unified search when a terminal-specific handler does not own the keystroke. |
| `Mod+,` | Open Settings. |
| `Mod+Shift+K` | Open Key Chain. |
| `Mod+Shift+U` | Open Usage. |
| `Mod+Shift+B` | Toggle the artifacts workspace. |
| `Mod+J` | Toggle the bottom panel. |
| `F11` | Toggle full screen. |
## Configurable new-chat shortcuts
Open **Settings → Workspace** to configure:
* **New Chat** — a system-wide shortcut that can open Studio from another app. It is disabled by default so Studio does not take another application's New command.
* **New Chat (with App Context)** — starts a chat with the foreground app, screenshot, and Computer Use context.
If a system-wide accelerator fails to register, Studio shows its registration state in Settings. Choose another accelerator that is not reserved by macOS, Windows, or another application.
New Chat with App Context captures information from the foreground application and screen. Do not use it while a secret, private message, or unrelated customer surface is visible.
## Tabs and editor groups
| Shortcut | Action |
| --------------------------- | -------------------------------------- |
| `Mod+Tab` | Next most-recently-used editor. |
| `Mod+Shift+Tab` | Previous most-recently-used editor. |
| `Mod+PageDown` | Next editor in the group. |
| `Mod+PageUp` | Previous editor in the group. |
| `Mod+Shift+PageDown` | Move the active editor right. |
| `Mod+Shift+PageUp` | Move the active editor left. |
| `Mod+W` | Close the active editor. |
| `Mod+K`, then `Mod+W` | Close all editors in the active group. |
| `Mod+Shift+T` | Reopen the last closed editor. |
| `Mod+K`, then `Enter` | Keep a preview editor open. |
| `Mod+K`, then `Shift+Enter` | Pin or unpin the active editor. |
| `Mod+1` through `Mod+4` | Focus editor group 1 through 4. |
| `Mod+\` | Split the active editor right. |
| `Mod+K`, then `Mod+\` | Split the active editor down. |
| `Mod+K`, then `Mod+M` | Maximize or restore the active group. |
| `Mod+K`, then `Mod+L` | Lock or unlock the active group. |
## Terminal
These bindings apply while the terminal handles the key event and can be changed by Studio's terminal keybinding system.
| Shortcut | Terminal action |
| --------------- | ---------------------------- |
| `Mod+D` | Split terminal vertically. |
| `Mod+Shift+D` | Split terminal horizontally. |
| `Mod+W` | Close terminal pane. |
| `Mod+Alt+Right` | Focus next pane. |
| `Mod+Alt+Left` | Focus previous pane. |
| `Mod+Alt+Up` | Focus the pane above. |
| `Mod+Alt+Down` | Focus the pane below. |
| `Mod+F` | Search terminal output. |
| `Mod+Shift+F` | Filter terminal output. |
| `Mod+K` | Clear the terminal. |
| `Mod+Shift+T` | Toggle timestamps. |
| `Mod+Shift+P` | Open the AI command palette. |
| `Mod+I` | Open saved commands. |
| `Mod+R` | Open command history. |
Copy and paste continue to use the normal platform shortcuts. In a terminal, copy requires an active selection; otherwise the underlying shell or application may receive the keystroke.
## Editors, files, and diagrams
| Shortcut | Action |
| ------------------------- | ----------------------------------------------------- |
| `Mod+S` | Save an editable document, procedure, or remote file. |
| `Mod+Z` / `Mod+Shift+Z` | Undo / redo in supported editors. |
| `Mod+A` | Select all in the active editor or diagram. |
| `Mod+C`, `Mod+X`, `Mod+V` | Copy, cut, and paste in supported editors. |
| `Mod+D` | Duplicate a selected diagram element. |
| `Mod+0` | Fit a diagram to the viewport. |
| `F2` | Edit the selected diagram label. |
The focused surface wins when two actions share a chord. For example, `Mod+D` splits a focused terminal but duplicates a selected diagram element.
## Procedure shortcut triggers
A procedure can have a local shortcut trigger. Choose a chord in the procedure trigger editor or ask Copilot to add a shortcut trigger. If you do not specify a chord, Studio assigns the next available `CommandOrControl+Alt+Shift+number` accelerator.
Treat a procedure trigger like an executable shortcut. Review the procedure, arguments, host binding, and required approvals before enabling it globally.
## Queue and steer
While Copilot runs, Enter follows **Settings → AI → Follow-up behavior**. `Command+Enter` on macOS or `Control+Enter` performs the opposite action:
* Queue preserves the run and delivers the message later.
* Steer injects the correction into the active run.
## Related
See where navigation, channels, conversations, artifacts, and activity live.
Configure manual, shortcut, app, host, and scheduled procedure entry points.
# Local shell and code tools
Source: https://altostrat.io/docs/studio/en/local-shell-and-code-tools
Run commands on the Studio workstation, keep an interactive local terminal, and let Copilot inspect or change a grounded repository with structured code tools.
Studio distinguishes a remote device terminal from work performed on the local workstation:
* A **host terminal** connects to an inventory host over SSH, Telnet, or serial.
* A **local shell command** runs through a real shell selected for the workstation.
* An **interactive local terminal** stays open when a command needs persistent state, visibility, or input.
* **Code tools** inspect and change files inside a grounded repository with operations designed for source work.
Always confirm which boundary a command targets. `show interfaces` in a router terminal and `git status` in a local repository can appear in the same conversation but affect different systems.
## Choose the execution path
| Need | Preferred path |
| --------------------------------------------------------------- | ---------------------------------------------------------------------- |
| Inspect or change a managed device | Open its tracked host terminal. |
| Run one local command, test, formatter, build, or Git operation | Local shell command. |
| Maintain an interactive process or visible prompt | Interactive local terminal. |
| Locate, read, diff, or edit repository files | Structured Code tools, with local shell for the test or build. |
| Inspect OS configuration without clicking through UI | Native inspection tools when available. |
| Operate a graphical application | Direct CLI or structured tool first; Computer Use only when necessary. |
This routing keeps repository reads precise and prevents a local shell command from being mistaken for a command on the active network device.
## Local shell commands
For one-shot work, Copilot uses the local shell tool. The selected shell depends on the workstation:
* On macOS, Studio uses an available `zsh` or `bash` path with the appropriate shell syntax.
* On Windows, Studio selects from PowerShell 7, Windows PowerShell, Git Bash, and `cmd` according to availability.
The command can run in a chosen working directory. Long-running commands can continue as background jobs; Studio can read new output, report exit state, or terminate the job.
Examples:
* “Run the tests for this repository and summarize only the failures.”
* “Show the Git status and diff without changing anything.”
* “Start the development server in the background and tell me when it is ready.”
* “Stop the background job that is still listening on the test port.”
Local shell execution is approval-gated according to the current mode and session approval state. Autopilot can remove the per-call prompt, so keep it off when the working directory or command is not already verified.
## Interactive local terminal
Use the local Terminal surface when you need to watch output, answer a prompt, maintain shell state, or interact with a process directly. Open it from the Terminal launcher or ask Studio to show the local terminal.
By default, Copilot can prepare a local terminal in the background and return command details in the conversation. Ask it to show the panel when you need to see or control the session.
On Windows, the persistent Terminal can use Studio's portable built-in shell. It supports common file, text, network, pipeline, redirection, history, and completion operations, but it is not a complete PowerShell or POSIX scripting environment. Use a real local shell command for a script, build tool, Git workflow, or platform-specific command.
## Ground a repository
When your prompt clearly refers to a local repository or codebase, Studio can activate the Code domain for that workspace. State the repository path or attach the relevant workspace context when more than one repository is plausible.
The structured workflow is:
1. Map the repository at a useful level.
2. Locate paths with file matching and symbols or text with code search.
3. Read only the relevant ranges.
4. Inspect the repository diff before and after a change.
5. Use the local shell for tests, builds, formatters, and Git operations.
This is more reliable than reconstructing every file operation through a shell pipeline and keeps large repositories from flooding the model context.
## Code tabs and source files
Studio can open generated code or configuration in a Monaco editor tab. A code tab is useful for review, syntax highlighting, comparison, and iteration. It is not automatically the source file in a repository.
Before asking Studio to edit code, make the destination explicit:
* **Repository edit** — change the named file in the grounded workspace and verify the diff.
* **Generated snippet** — create or update a Studio code artifact without touching the filesystem.
* **Remote file** — edit the named path through the host's SFTP connection.
Confusing these destinations is a common cause of “the code looks changed, but the application did not change.”
## Review local changes safely
Before approving a local write or command:
1. Confirm the workstation, repository root, and working directory.
2. Inspect existing uncommitted and untracked work.
3. Read the exact command or patch and its targets.
4. Keep unrelated user changes intact.
5. Run the narrowest relevant validation.
6. Inspect the final diff and generated files.
7. Do not commit, push, publish, install software, or delete work unless that action is part of the stated task.
A local command can read workstation files, start processes, reach the network, change source, or delete data with the current user's permissions. “Local” describes where it runs, not how safe it is.
## Secrets and output
* Keep tokens and passwords in Key Chain or the platform's approved secret path.
* Do not put a secret in a command argument when it will appear in the transcript, process list, shell history, or telemetry.
* Treat build logs and test output as possible model context once returned to the conversation.
* Stop background jobs and local servers when their task ends.
* Verify generated configuration against the target version and environment before deployment.
## Troubleshooting
| Symptom | What to check |
| ------------------------------------------- | ------------------------------------------------------------------------------------------------- |
| Command ran in the wrong folder | State the absolute working directory and verify it before retrying. |
| Studio used a shell instead of Code tools | Attach or name the repository and ask it to inspect with structured Code tools first. |
| A generated code tab did not change the app | Confirm whether the tab was an artifact or a saved repository file. |
| Windows syntax fails | Check which real shell Studio selected; PowerShell, Git Bash, and `cmd` use different syntax. |
| A command is still running | Ask for background-job status, read the latest output, or terminate the named job. |
| Code tools are missing | Check organization and channel tool policy, then discover or enable the Code domain if permitted. |
## Related
Connect to tracked devices and review staged remote commands and replays.
Distinguish generated artifacts, remote SFTP files, replays, and saved work.
Prefer structured and command-line paths before graphical control.
Understand local execution, secrets, approvals, and recordings.
# Memories and search
Source: https://altostrat.io/docs/studio/en/memories-and-search
Store useful operational facts, understand organization work-product memory, and retrieve Studio content with unified search.
Studio has two related memory layers:
* **Operational memories** are facts you or Copilot save for later recall.
* **Organization memory** records durable organization facts and work products such as generated apps, artifacts, repositories, deployments, or services.
Unified search finds these alongside hosts, files, conversations, procedures, dashboards, connectors, and commands.
## Operational memories
A useful memory changes how the next person approaches the work. It is specific, scoped, and understandable without the original transcript.
| Strong memory | Weak memory |
| ------------------------------------------------------------------------------------------ | ----------------- |
| "Site MEL core management address is `10.12.0.1`; verify the HA peer before maintenance." | "MEL switch." |
| "Customer A's legacy VPN still requires IKEv1 until change `CHG-123` closes." | "VPN is unusual." |
| "Check carrier incident status before changing local BGP when neighbor `192.0.2.7` flaps." | "BGP flapped." |
Save a memory from chat by asking Copilot, or create and edit one from the memory surface when available through search and AI settings. Update a fact when reality changes instead of adding a contradictory duplicate.
## Categories and tags
Operational memories can use categories such as general, topology, procedure, credential hint, incident, and configuration. Tags add cross-cutting retrieval for a customer, site, ticket, protocol, migration, or time period.
A credential memory may say which named credential to use. It must never contain the credential value.
## Organization memory
Organization memory stores a durable record with a stable subject identity. Copilot can create or update records for:
* Organization facts.
* Applications and dashboard apps.
* Artifacts and documents.
* Repositories and workspaces.
* Deployments and services.
A work-product record can include a title, summary, last-known state, locator, source host, source session, workspace reference, revision, framework, process, port, and searchable tags.
Studio strips credential-like metadata before persistence, but you must still avoid placing secrets in the title, summary, locator, tags, or metadata.
Organization memory is last-known state, not live proof. Always verify a process, deployment, service, file, or URL before changing it or claiming it is currently available.
### Stable subject IDs
When a work product changes, update the existing record using the same stable subject identity. For a machine-built app, the absolute workspace path is a strong identity. Creating a new record for every edit produces duplicates and makes later retrieval ambiguous.
## What not to store
Do not store:
* Passwords, tokens, private keys, recovery codes, or session cookies.
* Short-lived values that should come from a live system.
* Unverified AI conclusions stated as fact.
* Large transcripts that belong in a conversation, replay, or artifact.
* Personal or performance information unrelated to operations.
Use Key Chain for secrets, the active tool for live state, and a dated artifact for a complete record.
## Unified search
Press `Mod+K` to search Studio. Results can include content and registered commands. Search uses names, text, metadata, and semantic relevance, so related terms can surface an item even when the exact phrase differs.
Search before creating a new object. Reusing the existing host, procedure, dashboard, memory, or app preserves ownership, history, and stable identity.
### Search patterns
| Goal | Search for |
| ------------- | ---------------------------------------------------------------------- |
| Find a target | Hostname, IP, site code, service, or customer. |
| Resume work | App name, artifact title, repository, workspace path, or incident. |
| Find a method | Procedure name, protocol, vendor, or outcome. |
| Navigate | A command such as `settings`, `usage`, `key chain`, or `split editor`. |
## Retrieval in Copilot
Ask Copilot to search before answering when prior context matters:
* "Find the latest verified memory for this site's VPN before troubleshooting."
* "Locate the existing dashboard app for WAN capacity and verify its current revision."
* "Search for the procedure and incident report from the last carrier outage."
* "Update the existing organization record after verifying the deployment."
When a memory directly affects a recommendation, Copilot should identify the remembered fact and distinguish it from live evidence.
## Memory hygiene
* Include scope: organization, customer, site, host, interface, or service.
* Record when the fact was verified and by what evidence when that matters.
* Use one stable record per work product.
* Update or archive stale records.
* Separate historical findings from current state.
* Review shared memories before teammates depend on them.
## Related
Reopen artifacts and verify durable work-product locators and revisions.
Keep credentials out of memories, artifacts, context, and prompts.
# Network diagrams
Source: https://altostrat.io/docs/studio/en/network-diagrams
Draw and edit network maps with Cisco and cloud service shape libraries, auto-layout, multi-page support, draw.io round-trip, and one-click generation from hosts or Copilot topology evidence.
Studio diagrams are editable maps, not static images. You open a diagram as a tab, drop shapes from the library, connect them, and save — and the file sits alongside the rest of your work, indexed by search, stored in the draw\.io format so you can round-trip it through any external tool that understands `.drawio`.
What makes diagrams in Studio different is how they start. You rarely begin with a blank page. You generate a map from your host inventory, hand Copilot a terminal with LLDP output, or convert a Mermaid topology someone sketched into a report. The editor is fast once you're in it, but the first 80% of the work is usually already done before you pick up the mouse.
A single diagram is a multi-page document. LAN on page one, WAN on page two, data center on page three — each page with its own grid, zoom, and layout. The editor theme follows Studio's, with semantic colors per device type so routers, switches, firewalls, and endpoints read at a glance.
## Diagram lifecycle
Most useful diagrams move through three stages:
1. **Draft from evidence.** Generate from hosts, LLDP/CDP output, a written topology, or a Mermaid sketch.
2. **Normalize by hand.** Rename devices, group sites, align links, add missing labels, and remove noisy discovery edges.
3. **Keep with the work.** Save it as an artifact, attach it to the relevant conversation or procedure, and update it when the investigation changes the known topology.
The first draft is allowed to be imperfect. The point is to get topology into an editable form quickly, then let an engineer clean it into a diagram the team can trust.
## Ways to create a diagram
| Method | When to use it |
| ------------ | --------------------------------------------------------------------------------------------- |
| Blank canvas | You want to draw from scratch. |
| From hosts | Generate a map from your inventory — Studio positions devices by folder and type. |
| From Copilot | Ask Copilot to build a map from described topology, an attached terminal, or LLDP/CDP output. |
| From Mermaid | Convert a Mermaid topology inside a markdown artifact into an editable Studio diagram. |
| Import | Open a `.drawio` file you already have. |
## Editor basics
The canvas works the way you expect. Pan with middle-click or space-drag. Scroll to zoom. Shapes snap to the grid when you want them to, and ignore it when you don't. Multi-select with a marquee or with `Shift`-click, then align, distribute, or group.
| Control | What it does |
| ------------------------- | ---------------------------------------- |
| Shape picker | Browse and drop shapes from the library. |
| Zoom and fit | Keyboard shortcuts or the toolbar. |
| Grid toggle | Show or hide alignment grid. |
| Select, move, group, lock | Standard editing operations. |
| Align and distribute | Tidy up positions quickly. |
| Undo / redo | Unlimited history while the tab is open. |
## Making diagrams readable
* Put traffic flow in one primary direction: top-to-bottom for hierarchy, left-to-right for path diagrams.
* Label links with the thing operators troubleshoot: interface, circuit ID, VLAN, VRF, provider, or bandwidth.
* Use containers for sites, racks, VPCs, VRFs, or security zones.
* Keep management links visually distinct from data-plane links.
* Split a crowded diagram into pages rather than shrinking everything until labels disappear.
* Use color sparingly for meaning: critical path, degraded link, active/standby, or ownership.
## Shape libraries
The shape picker groups shapes by library. The libraries cover the shapes network engineers actually reach for, including the full Cisco icon set and a cloud service architecture icon set for mixed on-prem and cloud diagrams.
| Library | Includes |
| ----------------- | ------------------------------------------------------------------ |
| General | Basic shapes, arrows, containers. |
| Cisco routers | Router and WAN-oriented icons. |
| Cisco switches | Switch, Ethernet, and LAN icons. |
| Security | Firewall, IDS, IPS, VPN. |
| Wireless | Access points and wireless controllers. |
| Servers & storage | Servers, storage arrays, SAN, NAS. |
| Endpoints & WAN | Workstations, phones, modems, gateways, controllers. |
| Cloud services | Cloud architecture icon set for hybrid on-prem and cloud diagrams. |
## Auto-layout
Two algorithms, each suited to a different kind of network. Hierarchical is the right pick for tree-like topologies — core down to distribution down to access — where you want a clean top-to-bottom flow. Organic is better for meshy networks, where nodes push against each other and settle into natural positions based on how they're connected. Both run on the active page, so you can lay out one page without disturbing the others.
## Multi-page diagrams
A single diagram can hold multiple pages. LAN, WAN, DC, DR site — each is its own page with independent grid and zoom. Page tabs along the bottom of the editor let you switch between them. When you share or export, you pick whether to send the active page or the whole document.
## Import and export
`.drawio` XML is the round-trip format, so anything you make in Studio opens in any draw\.io-compatible tool and vice versa. SVG gives you a clean vector for documents and slides. PNG is the practical choice for email and chat where a flat image is easier.
## Theme integration
Diagrams adapt to light and dark themes automatically, and device types use semantic colors so the same router reads as a router regardless of the background. If you paste a diagram into a light-mode doc and a dark-mode deck, you won't get mismatched exports.
## Copilot examples
Copilot is often the fastest way to a first draft. Start with the evidence you already have in another tab and let it do the layout.
* "Create a WAN topology from these hosts and the LLDP output in the active terminal."
* "Open a host map for the current inventory and connect the core switches to the firewall."
* "Style the client devices blue and highlight critical links in amber."
* "Convert the Mermaid diagram in this report into an editable Studio map."
## Diagrams and procedures
Diagrams are strongest when they sit next to a repeatable workflow. A procedure can tell an operator what to check; the diagram shows where the check fits in the topology. For failover, migration, or incident response procedures, link the diagram in the procedure body and tell Copilot which page represents the active path.
## Related
Ask Copilot to build a diagram from hosts, terminal output, or a described topology.
Diagrams live alongside reports, tables, and other generated artifacts.
# Organization administration
Source: https://altostrat.io/docs/studio/en/organization-administration
Administer organization identity, members, context, channels, integrations, credentials, and tool policy from Studio's control plane.
The Studio administration console is the organization control plane. Owners and admins use it to define who belongs to the organization, what shared context grounds Copilot, which integrations and tools are available, and how access is narrowed for each member and channel.
Open the organization menu and choose the administration action. The console is organization-scoped; verify the organization name before making a change.
## Administration areas
| Area | Purpose |
| -------------------- | --------------------------------------------------------------------------------------- |
| Overview | Read-only organization snapshot and links to administrative areas. |
| Organization | Name, slug, and logo. |
| Partner | Referral and partner program information when available. |
| Members | Invitations, roles, member context, preloaded tools, effective access, and offboarding. |
| Organization context | Shared grounding attached to organization AI work. |
| Teams | Groups of members used for organization and sharing. |
| Channels | Shared channels and their membership. |
| Integrations | Organization connector and MCP definitions, credentials, tool catalogs, and policy. |
| Workers | Owner-gated digital workers and their staged pipelines. |
Administrative access does not reveal every personal credential. Policy controls availability; credentials remain in their configured personal or shared scope.
## Members and roles
The **Members** page lists active members and pending invitations. Owners and admins can invite by email, change roles, revoke invitations, open a member record, and remove access.
| Organization role | Typical access |
| ----------------- | --------------------------------------------------------------------------------------------- |
| Owner | Full organization lifecycle and billing authority. |
| Admin | Member, context, channel, integration, and policy administration allowed by the organization. |
| Member | Uses Studio resources and manages their own profile and personal credentials. |
Pending invitations do not have member context or preloaded-tool settings until the invite is accepted.
### Member context
Member context describes a person's role, scope, responsibilities, and working preferences to organization-scoped AI. An admin can set one of two policies:
* **Self-edit** — the member can update their context from **Settings → Profile**.
* **Admin-managed** — the member can see the context but only an admin can change it.
Use member context for durable operating information, not performance notes or secrets. For example:
> Senior network engineer responsible for EMEA production. Prefer read-only evidence before a change plan. Escalate firewall policy decisions to the security team.
### Preloaded tools
Preloading makes selected built-in domains, connectors, or MCP tools discoverable at the start of a member's new conversations. It does not bypass organization or channel restrictions and does not provide a credential.
Preload tools that a member uses routinely. Leave one-off or high-risk tools discoverable on demand so the initial context stays focused.
### Effective access
The member detail view includes a read-only effective-policy preview. Use it to answer:
* Which built-in domains and tools can this member use?
* Which organization connectors and MCP tools remain available after member policy?
* Which credentials are ready, missing, personal, or shared?
* Which tools are merely preloaded versus actually permitted?
The active channel can narrow this result further. Test a real conversation in the intended channel before declaring a rollout complete.
## Organization context
Organization context is shared grounding applied to organization AI work. The current editor supports up to 32,000 characters.
Include stable rules and definitions:
* Trust boundaries, environment names, and customer terminology.
* Required approval and change-management practices.
* Default escalation contacts or team names.
* Evidence and reporting conventions.
* Organization-wide exclusions, such as systems Copilot must never mutate.
Keep volatile incident state in a channel, conversation, artifact, or memory instead. Never place credentials in context.
## Teams and channels
Teams group members for organizational and sharing purposes. Channels are the active operating boundary for conversations, context, tool policy, and workers.
Use teams to represent stable groups such as NOC, field engineering, or security. Use channels for a workstream such as a customer, service, incident queue, or project. See [Channels and the chat board](./channels-and-chat-board) for channel roles and settings.
## Integrations
The **Integrations** page is the organization catalog for connectors and MCP servers. An admin can create or edit definitions, inspect a published MCP tool catalog, set organization availability, and choose how credentials are supplied.
### Definition and credential scope
Separate the shared definition from the credential used to call it:
| Mode | Definition | Credential |
| -------- | --------------------------------------- | ------------------------------------------------------------------------- |
| Personal | Organization or personal catalog entry. | Each member connects their own account in a private Key Chain entry. |
| Shared | Organization catalog entry. | An authorized administrator provisions a credential for organization use. |
Use personal credentials when the external system must attribute actions to an individual. Use a shared credential for a service identity whose access and audit ownership are intentionally organization-wide.
OAuth authorization-code credentials are stored as private per-member entries unless an explicitly supported shared-service flow is configured. Studio surfaces missing-account markers without exposing the token to an admin.
### Tool availability
For MCP servers, Studio can publish the server's tool catalog to the administration console. An admin can disable the entire integration or individual tools. Runtime enforcement uses the integration ID and tool name, so a hidden or disabled MCP tool is rejected even if an old conversation still references it.
For connectors, document each endpoint's side effects and keep write operations disabled until the request and approval are reviewable.
## The connect-your-accounts checklist
Members see account tasks in **Settings → Profile** when an allowed integration requires a personal credential. The checklist can deep-link to the correct OAuth or Key Chain flow. Completion means the required private entry is present; it does not expose the secret to the organization admin.
Use the member credential-status markers to identify readiness gaps, then ask the member to complete their own account connection.
## Offboard a member
Before removal:
1. Transfer ownership of channels, procedures, dashboards, and work that must continue.
2. Review personal-credential dependencies and provision a replacement owner or service credential.
3. Reassign open conversations and worker human gates.
4. Remove the organization membership.
5. Confirm the member profile and organization access are cleared.
6. Rotate any external shared credentials the person could access outside Studio.
Removing a member is not a substitute for rotating a shared secret in the external system.
## Policy rollout checklist
* Test with a non-admin member, not only an owner account.
* Test inside the actual target channel.
* Verify both tool discovery and runtime dispatch.
* Confirm personal-account tasks appear for members who need them.
* Confirm shared credentials work without revealing them in chat or admin views.
* Record the intended owner and review date for every shared integration.
## Related
Define endpoints, transports, authentication, and safe descriptions.
Model trust boundaries, roles, visibility, teams, and channels.
# Procedures
Source: https://altostrat.io/docs/studio/en/procedures
Promote a successful chat into a parameterized runbook — markdown with arguments, allowed tools, success criteria, and a controlled run loop.
When a troubleshooting session ends well, you usually want to run it again — against a different host, a different interface, a different incident. Procedures are that. They capture the successful path as markdown with fixed metadata — title, description, arguments, allowed tools, a maximum turn budget, success criteria, and the steps themselves.
You author a procedure once and run it as many times as you need. Each run substitutes your argument values into the body, restricts Copilot to the allowed tools, and executes as a single controlled loop with progress, token accounting, and a full transcript.
Procedures are the bridge between one-off investigation and a repeatable operating practice. The good ones start as a chat that worked.
## Creating a procedure
The fastest way to build a procedure is to promote a conversation that already succeeded. Studio reads the successful path out of the conversation, drafts the metadata, and drops you into the procedure editor for review.
You can also start from the Procedures activity. If your library is empty, the sidebar shows **Create Procedure**; selecting it seeds Copilot with a `Create a procedure...` prompt so you can describe the runbook you want in natural language.
That empty state is deliberate. Studio treats procedure authoring as a conversation first because the best procedure usually needs context: what device family it targets, which checks are safe, what success looks like, and which inputs should become arguments.
Find the source conversation in the chat sidebar and open its context menu.
Studio extracts the successful path from the conversation and opens a draft.
The editor shows the title, description, arguments, allowed tools, success criteria, and the step body as markdown.
Tighten the title and description, add or rename arguments, narrow the allowed tools, and state the success criteria in terms you can check.
**Run** becomes available once everything is saved.
You can also create a procedure from scratch. Start blank, write the steps as markdown `##` headings, and define the arguments and allowed tools that make sense for the work.
When you are starting from scratch, describe the operational goal, target device type, required arguments, and safety constraints in the Copilot prompt. A useful first prompt is: "Create a procedure for checking BGP adjacency health with arguments for hostname, neighbor IP, and VRF. Use read-only checks only."
## From prompt to runbook
When you use **Create Procedure** from the sidebar, describe the operation the way you would brief another engineer:
* The operational goal.
* The target type, such as Cisco IOS-XE edge routers or Linux jump hosts.
* Required arguments, such as `hostname`, `interface`, `neighbor_ip`, `vrf`, `ticket_id`, or `maintenance_window`.
* Tools that are allowed and tools that are out of scope.
* Commands or checks that must stay read-only.
* The evidence that proves the run succeeded.
Copilot drafts the procedure from that prompt, but you still own the final shape. Review the allowed tools carefully, replace vague steps with explicit checks, and keep destructive or configuration-changing actions behind a clear approval point.
## Procedure fields
| Field | Purpose |
| ---------------- | ------------------------------------------------------------------------------------------------ |
| Title | Name shown in the library, sidebar, and run tab. |
| Description | One-paragraph summary of what it does. |
| Arguments | Named values substituted into the procedure at run time (`{{hostname}}`, `{{interface}}`, etc.). |
| Allowed tools | `*` for all available, or a specific list. Narrow this for production procedures. |
| Default model | Optional installed-model override; otherwise use the current chat model. |
| Maximum turns | Upper bound for the run. The editor summary defaults to 60 when unset. |
| When to use | Guidance for operators choosing between procedures. |
| Success criteria | Conditions the run should satisfy before stopping. |
| Steps | Markdown `##` sections forming the ordered body. |
| Status | Draft, active, or archived. |
## A good procedure shape
Use this structure when you are writing by hand:
```md theme={null}
## Confirm scope
State the host, interface, VRF, ticket, or incident context the run will use.
## Gather read-only evidence
Run commands or connector calls that cannot change state.
## Interpret the evidence
Summarize findings and decide whether the procedure should continue.
## Stage any change
Prepare commands or API calls, but keep execution behind approval.
## Validate
Run the post-checks that prove the expected state is present.
## Report
Return the final finding, evidence, and follow-up actions.
```
Not every procedure needs every section. The pattern matters because it keeps the run auditable: scope first, evidence before action, validation after action, report at the end.
## Running a procedure
Pick the procedure from the sidebar, supply values for its arguments, and Studio opens a run tab. The bottom panel streams live progress — turn count, token usage, tool calls, and output — and the transcript is preserved for later review. You can stop a run at any point if you've seen enough.
| Status | Meaning |
| --------- | ----------------------------------------- |
| Pending | Queued, hasn't started yet. |
| Running | In progress. |
| Completed | Finished successfully. |
| Failed | Hit an error or exceeded the turn budget. |
| Cancelled | You stopped it. |
## Triggers and schedules
A procedure can run manually or from a local trigger. The editor groups triggers into **Schedule**, **Apps**, **Hosts**, and **Shortcuts**.
| Trigger | Starts when |
| ------------ | -------------------------------------------------------------------------------------------------------- |
| Schedule | The configured recurring schedule becomes due. |
| App focus | A selected local application or matching window becomes active, after the configured delay and cooldown. |
| Host opened | A matching Studio host is opened. |
| Host created | A host is added. |
| Host updated | A matching host changes. |
| Host deleted | A matching host is removed. |
| Shortcut | The configured local keyboard accelerator is pressed. |
Triggers are per device and can provide default argument values from the event. Test matching carefully—especially application names, window-title filters, host protocol filters, and cooldowns—before leaving a trigger active.
If you ask Copilot to add a shortcut trigger without specifying a chord, Studio assigns the next available `CommandOrControl+Alt+Shift+number` accelerator.
A trigger can start operational work without a person opening the procedure first. Keep tool grants narrow, preserve approval points, and disable the trigger before changing its matcher or run semantics.
## Authoring guidance
* Extract procedures from working conversations whenever possible — replay is more reliable than recall.
* Keep steps linear. Describe decisions inside a step rather than branching.
* Use specific arguments (`hostname`, `interface`, `vrf`, `site`, `change_ticket`) over vague ones.
* Put read-only validation before any command that changes state.
* Write success criteria you can check from evidence, not just intent.
* Don't include exploratory dead ends from the source conversation.
* Avoid `*` allowed tools for production procedures unless the operator will pick at run time.
* Prefer **Ask** or **Planning** while drafting production procedures, then run in a controlled scope before marking active.
* Archive procedures you no longer trust rather than leaving stale runbooks in the main library.
* Review triggers and schedules whenever a host, application, credential, or team ownership model changes.
## Run history
Every run stores its arguments, messages, tool summaries, token usage, final output, and the full transcript. Past runs are searchable and shareable — so you can compare two executions of the same procedure, link a run to a change ticket, or hand a transcript to a colleague for review.
## Reflection and repair
When a run fails or finishes outside its success criteria, Copilot can reflect on the transcript — what was attempted, what evidence was gathered, where the run diverged — and propose a repair to the procedure body or the allowed tools. Reflection is a separate step from the run itself: it generates a diff against the procedure, you review it, and you decide whether to apply it. The original run transcript stays intact as evidence either way.
Use reflection sparingly. A procedure that needs reflection often is a procedure that's trying to do too much in one runbook. The healthier response is usually to split it.
## Related
The conversation surface that produces the best procedures.
Keep the facts procedures rely on close to the work.
Use an owner-gated cloud pipeline when work must run independently of a particular desktop.
# Remote desktop
Source: https://altostrat.io/docs/studio/en/remote-desktop
Open Windows hosts over RDP in a Studio tab — a live streamed desktop with full keyboard and mouse control, fullscreen, and a Copilot that can read and drive the screen.
Some work only happens on a graphical desktop — a Windows service console, an installer, a management tool with no command line. Studio's remote desktop brings that Windows host into a tab, next to your terminals, diagrams, and Copilot, so a quick GUI task doesn't pull you out of the workspace.
The session is a live desktop. Frames stream as the screen changes, your clicks and keystrokes go straight to the host, and you can take it fullscreen for detailed work. It opens from the host's protocol list — the same way you open a terminal — and signs in from the Key Chain entry attached to the protocol.
Copilot can work the desktop alongside you. It reads the screen, finds the buttons, fields, and menus, and acts on them by element rather than guessing at coordinates — so "open Services and restart the print spooler" is something you can hand off instead of clicking through yourself.
## Opening a session
From the Hosts activity, open a Windows host and pick its RDP protocol from the protocol list.
The tab takes focus and the connection starts immediately. A progress indicator shows the negotiation stages while the desktop comes up.
The session authenticates with the username, password, and domain on the protocol, resolved from its attached Key Chain entry. See [hosts and credentials](./hosts-and-credentials) for how protocols and Key Chain entries fit together.
Once connected, the desktop is live and interactive.
Hosts that require Network Level Authentication need the Windows **domain** set on the RDP protocol. If sign-in fails on an otherwise reachable host, check the domain first.
## The live desktop
The desktop streams as a live image, and only the regions that change are sent — so interaction stays responsive even on a busy screen. Click and move the pointer directly on the desktop, focus it and type, and use key combinations like `Ctrl+A` or `Alt+F4` — they pass through to the remote session. The toolbar expands the desktop to fullscreen for detailed work.
A session indicator in the status bar shows while a remote desktop is live. Closing the tab ends the session.
## Copilot on the remote desktop
Copilot can see and operate a remote desktop the same way it works with your terminals.
To read the screen, Copilot captures the desktop and detects the interactive elements on it — buttons, text fields, menus, list items — and numbers them. It then acts on those elements directly: click the **OK** button, type into the search field. Working by element is far more reliable than raw coordinates, because the element is located again each time the screen changes.
This works automatically. Screen reading uses the same AI that powers the rest of Copilot — there is nothing to switch on and no separate credentials to set up. As long as you're signed in to Studio, Copilot can read any RDP session you open.
Approvals work exactly as they do elsewhere in Copilot. Reading the screen is read-only; clicks and keystrokes that change the host follow the approval rules of your current mode. On an unfamiliar host, start in **Ask** or **Planning** — see [AI Copilot](./ai-copilot) for modes and approvals.
## Related
Add a Windows host, configure its RDP protocol, and attach a Key Chain entry.
Modes, approvals, and how Copilot works alongside your sessions.
# Security and privacy
Source: https://altostrat.io/docs/studio/en/security-and-privacy
Understand Studio's trust boundaries, credential scopes, tool approvals, local desktop controls, generated-app grants, remote access, and sensitive recordings.
Studio combines local device access, organization-synchronized context, cloud AI, external integrations, and optional remote control. Security depends on keeping each action inside the correct organization, channel, credential, tool, and human-approval boundary.
## Security model
* The desktop and local helper reach hosts and the workstation's network from the machine running Studio.
* Altostrat organizations isolate administration, shared context, policy, and synchronized resources.
* Personal credentials and explicitly managed shared credentials have different scopes.
* Copilot tool availability is narrowed by organization, member, channel, and worker policy.
* State-changing, destructive, and unknown actions pause for review unless a high-trust setting bypasses it.
* Browser, Computer Use, generated apps, and Studio Remote add separate control surfaces that must be enabled and reviewed deliberately.
## Trust boundaries
| Boundary | Verify before acting |
| ------------ | ---------------------------------------------------------------------------------------- |
| Organization | Correct customer or business unit, membership, and billing context. |
| Channel | Correct members, grounding, tools, and operating stream. |
| Target | Host, URL, application, file path, tenant, number, or external object. |
| Credential | Personal identity or intended organization service identity. |
| Tool | Effective policy, side effects, and approval scope. |
| Output | Whether a transcript, replay, artifact, memory, or dashboard can contain sensitive data. |
## Credentials and Key Chain
Use Key Chain references instead of placing secrets in prompts, procedures, connector definitions, memories, artifacts, or channel context.
Studio supports:
* **Personal credentials** — private to the member and appropriate for user-attributed host or integration access.
* **Shared credentials** — an explicitly provisioned organization/service identity for allowed members and tools.
Sharing a host, connector, or MCP definition does not automatically share a personal credential. An admin can see a member's credential readiness marker without seeing the private value.
Shared credentials require an owner, external rotation process, and least privilege. Removing a member from Studio does not rotate a shared password, token, or key in the external system.
## Keep secrets out of AI context
Studio resolves supported credential references at execution so Copilot does not need the raw value in its normal tool-planning context. This protection is strongest when the value stays in Key Chain.
Anything you paste directly into chat, a context field, a file, a transcript, or a tool result can become model context or synchronized work. Never paste a secret as a workaround for a missing credential flow.
Do not store credentials in:
* Organization, member, or channel context.
* Operational or organization memory.
* Generated app source or app state.
* Dashboard variables.
* Procedure Markdown or default arguments.
* Artifacts, recordings, or transcripts.
## Tool policy and approvals
Tool policy controls availability; approvals control a proposed call. They solve different problems.
Organization policy sets a maximum. Member and channel policy can narrow it. A digital-worker stage can narrow its grants again. Runtime dispatch re-checks this effective policy, so a stale tool reference is not enough to bypass a later restriction.
Review an approval as if you were performing the action manually:
1. Confirm organization and channel.
2. Confirm target and credential scope.
3. Read the exact command, request, fields, or click/type action.
4. Check side effects, rollback, and whether the call is idempotent.
5. Prefer one-time approval over **Allow for session** when the scope may change.
Autopilot and browser autopilot bypass approvals in their scope. They are appropriate only for bounded, pre-verified work.
## Browser and Computer Use
Browser sessions expose a live view, proposed intent, and **Take over/Release** control. The browser's autopilot toggle can auto-approve website actions for that session.
Computer Use requires macOS Screen Recording to observe and Accessibility to control. Read-only observation is distinct from clicking, typing, scrolling, or opening an app. State-changing desktop actions normally require approval.
Prefer a terminal, connector, MCP tool, or other structured operation over pixel control when available.
## Sandboxed dashboard apps
Generated dashboard apps run in a sandbox. External capabilities are disabled until you grant the exact requested set. Grants are per user and bound to a capability hash; a changed capability request must be reviewed again.
Limit resource origins, inspect the app's purpose and revision, and test with capabilities disabled before granting network or mutation access.
## Studio Remote
A paired iPhone can read supported conversation state, send messages, and respond to approval requests while the desktop remains the execution bridge. Protect the phone with device authentication and notification privacy.
Revoke a pairing from **Current connections** when the phone is lost, replaced, shared, or no longer needed. Generate a new pairing code if the displayed code may have been exposed.
Do not approve an action from a notification preview alone.
## Recordings, calls, and transcripts
Terminal replays, shared-session output, call media, Audio Use transcripts, and generated summaries can contain sensitive operational data. Tell participants when recording or transcription is active and follow applicable consent and retention rules.
Transcription can be wrong. Confirm names, numbers, credentials, and commands against the live source before executing or distributing them.
## Organization memory and search
Organization memory removes credential-like metadata before persistence, but the user-controlled title, summary, locator, and tags must still be non-secret. It records last-known state and must not be used as proof that a deployment or service is currently running.
Search respects the current Studio scope, but a shared artifact or memory can still expose what its author placed inside it. Review content before changing visibility.
## Sign out and offboarding
Sign out before transferring or servicing a workstation. It ends the authenticated Studio session and removes the current user's active access from the app; synchronized organization data remains governed by the organization.
For offboarding, also transfer owned resources, remove membership, revoke Studio Remote connections, replace personal-credential dependencies, and rotate any external shared credentials the person could use.
## Reporting a security issue
Use Altostrat's support or security contact from your account surface. Include the Studio version, operating system, organization ID, time of the event, affected surface, and a redacted reproduction. Never attach live secrets.
## Related
Configure members, context, integrations, credentials, and effective policy.
Review identity, data flow, local runtime, audit, and extension risk in depth.
# Settings
Source: https://altostrat.io/docs/studio/en/settings
Configure Studio's workspace, profile, appearance, terminal, AI, Computer Use, Audio Use, calls, firmware staging, updates, Billing, and Key Chain.
Open Settings with `Mod+,`. Settings is organized into ten in-page sections plus links to Billing and Key Chain.
| Section | Purpose |
| ---------------- | ------------------------------------------------------------------------------------------------ |
| Workspace | Global new-chat shortcuts, tab titles, editor groups, and status-bar behavior. |
| Profile | Connect required accounts, view or edit member context, and inspect preloaded tools. |
| Appearance | Theme, colors, contrast, and UI or code font sizing. |
| Terminal | Display, behavior, AI features, network, session, safety, quake mode, and keyword rules. |
| AI | Default model, context window, region, Autopilot, queue/steer, turns, suggestions, and memories. |
| Computer Use | macOS Screen Recording and Accessibility permissions. |
| Audio Use | Microphone and system-audio capture permissions. |
| Calls | Automatic call workspace and transcription behavior. |
| Firmware staging | Local TFTP server for firmware files. |
| About | Version, platform, update state, and update actions. |
| Billing | External settings destination for plan and payer administration. |
| Key Chain | External settings destination for personal and managed credentials. |
## Workspace
Workspace settings include a configurable new-chat accelerator inside Studio and optional global shortcuts that work from another application.
* **New Chat** can be registered globally, but is disabled by default so Studio does not take another application's New shortcut.
* **New Chat (with App Context)** starts a prompt with the foreground application, a screenshot, and Computer Use context.
* Choose condensed or full tab titles.
* Highlight tabs with unsaved changes.
* Enable splitting by dragging a tab to an editor edge.
* Show or hide the status bar and control its behavior in focused layouts.
Use a global app-context shortcut carefully: it captures the foreground application and screen state into a new Studio prompt.
## Profile
The connect-your-accounts card lists organization integrations that require your personal credential. Use its action to complete OAuth or create the required private Key Chain entry.
The Profile card shows your organization member context and preloaded tools. If context policy is **Self-edit**, you can update your description. If it is **Admin-managed**, ask an organization admin to change it.
Preloaded tools appear at the start of new conversations but remain subject to organization and channel policy.
## Appearance
Choose light, dark, or system mode; apply a preset or custom theme; tune contrast; and set UI and code font sizes. Themes can be imported, exported, and reset.
Test custom themes in terminals, approvals, alerts, tables, and a screen share. A theme that looks good in an editor may still hide a warning state.
## Terminal
Terminal settings cover rendering, selection and paste behavior, scrollback, connection behavior, recording, reconnection, AI helpers, safety, quake mode, and keyword highlighting.
Keep team-critical safety and recording expectations documented. Terminal settings are personal, so another operator may not have the same paste warning, history, or visual rules.
## AI
| Setting | Behavior |
| ------------------------- | ---------------------------------------------------------------------------------------------------------- |
| Default model | Used for new chats and standalone AI workflows. **Auto (recommended)** chooses Sonnet or Opus per message. |
| Default context window | For supported models, choose 200K recommended or 1M extended. |
| Bedrock region | Selects the AWS region used by supported AI, vision, OCR, and transcription work. |
| Autopilot | Auto-approves tools and removes turn limits. |
| Follow-up behavior | Makes Enter queue or steer while Copilot runs; `Command/Ctrl+Enter` does the opposite. |
| Max agent turns | Limits agentic turns from 1 to 500. The default is 30. |
| Chat suggestion threshold | 0 is eager and 5 is strict. |
| AI memories | Opens memory management. |
Changing region resets per-conversation prompt cache. The next turn pays the full input once. Cape Town keeps OCR and voice local to the region but routes Claude chat, titles, summaries, and vision through Frankfurt when the selected Claude model is unavailable locally.
Autopilot is a high-trust permission, not a performance setting. Leave it off unless the target and external effects are bounded and verified.
## Computer Use
On macOS, grant **Screen Recording** so Studio can observe the desktop and **Accessibility** so approved actions can move the pointer and type. Select **Re-check** after a change and restart Studio if macOS retains the old state.
See [Browser and Computer Use](./browser-and-computer-use) for the approval and takeover model.
## Audio Use
Grant microphone access for your side of a call and system-audio access for remote speakers or application output.
* macOS labels system audio as **System Audio / Screen Recording**.
* Windows may require Stereo Mix or a virtual audio device; use **Sound settings** from Studio.
* Select **Re-check** after changing OS privacy settings.
## Calls
* **Open call workspace automatically** opens controls, transcript, and live diagnostics after a call connects.
* **Transcribe calls by default** starts real-time transcription when the connected call workspace opens.
Both can be overridden manually during a call.
## Firmware staging
Firmware staging runs a local TFTP server from a selected root directory. Choose the root, port, and run state, then monitor transfers.
TFTP has no authentication. While it runs, devices on the reachable LAN can read files inside the selected root. Studio binds to a private RFC 1918 address and rejects path traversal, but you must still use a dedicated directory and stop the server after the transfer.
Windows defaults to UDP port 69. macOS and Linux-like environments default to 6969 because ports below 1024 normally require elevated privileges. Configure the device's TFTP client to use the displayed port.
## About and updates
About shows the installed version, platform, and updater state. Studio checks in the background and asks you to restart when an update is ready. Use the manual check before a maintenance window or when support requests the exact version.
## Billing and Key Chain
Billing and Key Chain open as their own workspace destinations.
* Billing covers Plan, Billing details, Payment methods, Tax IDs, and Invoices.
* Key Chain stores personal credentials and supports organization-managed credential flows without exposing secrets in chat.
## Related
Inspect AI, call, transcription, per-chat, model, and limit data.
Review OS, network, permission, and local-helper requirements.
# Shared sessions
Source: https://altostrat.io/docs/studio/en/shared-sessions
Collaborate inside a terminal with owner, co-worker, and viewer roles, invite guests by link, escalate to voice and video without leaving Studio, and see team presence in real time.
Collaboration in Studio escalates without switching apps. You start solo in a terminal. When a teammate needs to see what you're seeing, you share it. When typing isn't enough, you open a call inside the same session. The context — the device, the output, the conversation with Copilot — travels with you.
Every shared surface is explicit about who can do what. A viewer watches. A co-worker types alongside you. The owner holds the keys. And when the session ends, the recording and the conversation are still there for the next person who needs to catch up.
## When to share
Share a session when the live context matters more than a pasted transcript:
* A second engineer needs to verify output before a change.
* A vendor needs to see the device response in real time.
* A field tech is on-site and you need one shared view of the console.
* An incident commander needs visibility without keyboard control.
* A teammate is taking over and needs the scrollback, current prompt, and Copilot context together.
## Sharing a terminal
Any open terminal can be shared from the session toolbar. You pick a role for each person you invite, and you can change roles mid-session as the situation evolves.
| Role | What they can do |
| --------- | ---------------------------------------------------------------------------------- |
| Owner | Full control. Type, disconnect, end the session, adjust roles, invite more people. |
| Co-worker | Type alongside the owner. Typing indicator shows who's at the keyboard. |
| Viewer | Read-only view. See output, copy text, ask questions — cannot type. |
Participant avatars sit in the session header so you always know who's present. A typing indicator tracks the active hand on the keyboard, which matters when two people are in the same buffer. Handoff is a right-click on the participant — the owner can promote a viewer to co-worker during the session, or pull control back when it's time to close out.
## Handoff pattern
Use a clean handoff when control changes:
1. The current operator stops typing and says what state the session is in.
2. The new operator confirms the target host, privilege level, and next intended command.
3. The owner promotes the new operator to co-worker or owner-level control.
4. The previous operator stays as viewer until the next prompt or validation check.
It feels formal, but it prevents two people from typing into the same production shell with different assumptions.
## Inviting guests
Not everyone you need to pull in has an Altostrat account. Copy a guest invite link and send it to the vendor, the field tech, or the external responder on the incident call. The link drops them into the session with the role you chose, so they land exactly where you want them. Guest access ends when the session closes — there's no lingering grant to clean up afterward.
## Voice and video
When two or more people are in a shared session, a Call button appears in the session toolbar. It opens a call inside the workspace, right next to the terminal everyone's already watching.
The call view has a responsive participant grid that adjusts from 1 tile up through 2, 4, 6, and 9 tiles depending on who's on. Screen share lets you pull in a dashboard, a ticket, or a piece of a diagram that isn't in Studio. Audio and video pickers let each participant choose their microphone, speaker, and camera without leaving the call.
The terminal keeps running, the conversation remains available, and the call stays attached to the operational workspace.
## Working with Copilot while shared
Shared sessions and Copilot complement each other. Use Copilot to summarize long output, draft a plan, or turn the session into an artifact while humans keep control of judgment and approvals.
Good shared-session prompts:
* "Summarize the last 200 lines for the teammate who just joined."
* "List the commands that have changed state in this session."
* "Draft the handoff note with current hypothesis, evidence, and next checks."
* "Turn this successful investigation into a procedure draft after we finish validation."
## Team presence
A status dot next to each teammate in your organization shows online, away, or offline. Presence updates continuously while you're signed in, so you can see who's around before you ping them — and see when someone you're waiting on comes back.
## Session recording
Every shared terminal is recorded alongside the individual session recording. Tell participants before sensitive work. Recording can be paused, but the considerate move is to disclose before you do anything that shouldn't be captured.
Recordings preserve the full buffer, the typing order, and the timeline so you can replay exactly what happened. This is the same mechanism that makes solo sessions replayable — sharing doesn't change what's captured, only who can see it later.
Local recording files are sensitive endpoint data. Archiving a replay as a Studio file gives it a Studio visibility scope, but does not make an exported or separately copied recording safe. See [Agent and local runtime](./ai-safety/agent-and-local-runtime#terminal-recordings).
## Privacy and visibility
| Data type | Who sees it |
| -------------------- | --------------------------------------------------------- |
| Terminal output | Everyone in the session, in real time. |
| Your typing | Co-workers see keystrokes as they happen. |
| Your voice and video | Everyone on the call, for the duration. |
| Recording | Anyone who can open the session recording after the fact. |
Treat a shared terminal like shared production access, not a passive screen share. Everyone in the room has the same view of the device.
## After the session
Close the loop before everyone leaves:
* Save or share the recording if it is needed for review.
* Create an artifact with the final summary, evidence, and commands run.
* Save durable findings as memories.
* Promote repeatable work into a procedure.
* Remove any guest access by ending the session.
## Related
Start a terminal session before you share it.
Organization scoping, roles, and how shared resources reach teammates.
# Studio Remote
Source: https://altostrat.io/docs/studio/en/studio-remote
Pair Studio Remote on iPhone, iPad, or Android with a Studio desktop to continue conversations, add on-site context, and handle approvals away from your desk.
Studio Remote is the mobile companion to Altostrat Studio. Pair an iPhone, iPad, or Android device with one running Studio desktop, then continue conversations, send context from the field, follow active work, and respond to supported approval requests away from your desk.
The paired desktop remains the execution bridge to local hosts, tools, sessions, and stored credentials. Studio Remote gives you a focused chat and approval surface; it does not recreate the full desktop workspace on your phone or tablet.
Studio Remote is available for both Apple and Android devices:
* [Download for iPhone and iPad from the App Store](https://apps.apple.com/us/app/altostrat-remote/id6786571787)
* [Download for Android from Google Play](https://play.google.com/store/apps/details?id=io.altostrat.studio.remote)
## Before you pair
* Update Studio to the current production release.
* Sign in to the correct Altostrat organization on the desktop.
* Keep the desktop awake, online, and connected to the networks its tools need.
* Install Studio Remote on your Apple or Android device.
* Treat every paired mobile device as an authenticated control surface for that Studio desktop.
## Pair a mobile device
Select the phone control in Studio's status bar. The pairing panel opens.
Select **iPhone** or **Android** in the pairing panel if Studio Remote is not already installed.
Studio shows a QR code and a short text code. If a code expires or is exposed, select **New code**.
In Studio Remote, scan the QR code or enter the displayed code. Wait for the desktop to list the new current connection.
Confirm the paired desktop, available channels, and recent conversations on the mobile device before using it for live work.
## What you can do remotely
After pairing, Studio Remote can:
* Switch between personal and shared channels, browse recent conversations, continue a chat, or start a new one.
* Follow running conversations, use prompt suggestions, and queue or steer a follow-up while Copilot is working.
* Send prompts with slash commands and mentions for existing hosts, connectors, procedures, files, and tools.
* Add on-site context from files, the photo library, or the camera.
* Dictate prompts with the device microphone.
* Read conversation messages, generated-artifact references, and usage details.
* Pin, rename, archive, and update the status of a conversation.
* Approve once, allow for the session, or reject supported tool requests when those choices are offered.
* Receive notifications when an approval needs attention or a chat completes.
* Request that a specific paired desktop wake and claim the mobile work.
Availability can differ by conversation state and desktop capability. If the desktop cannot execute a tool locally, pairing does not make that tool available.
## What stays on the desktop
Studio Remote is deliberately execution-focused. Use the desktop app for:
* Signing in, switching organizations, and managing account settings.
* Opening terminals, remote desktop sessions, procedure runs, diagrams, files, and full generated-artifact panels.
* Creating and managing hosts, credentials, connectors, procedures, and other workspace resources.
* Any task that needs the desktop's local network path, helper process, or stored credentials.
The mobile app stores a scoped delegated token in secure device storage. It does not copy your desktop credentials to the mobile device.
## Approvals from a mobile device
An approval has the same operational consequence whether accepted on the desktop or a mobile device. Before approving remotely:
1. Read the tool name, target, detail, and proposed action.
2. Confirm the desktop is connected to the expected organization and network.
3. Prefer a one-time approval over **Allow for session** when you cannot see the full desktop state.
4. Reject ambiguous actions and continue from the desktop.
Do not approve a state-changing action from a lock-screen preview or notification alone. Open Studio Remote and inspect the full request.
## Manage connections
Open the Studio Remote status-bar panel on the desktop to see **Current connections**. Refresh the list to update status. Select the remove control beside a connection to revoke access immediately.
Revoke a connection when:
* A mobile device is lost, replaced, repaired, or handed to another person.
* You paired a temporary or test device.
* The displayed connection is unfamiliar.
* The current desktop session should no longer accept remote actions.
Generate a new pairing code if a code was copied or displayed where someone else could use it. A new code does not replace the need to revoke an already-established connection.
## Troubleshooting
| Symptom | What to check |
| ---------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| The phone control does not appear | Confirm you are using the current production desktop app, not Studio in a browser or a staging build. |
| A pairing code fails | Generate a new code and confirm both devices have network access. If the QR code points to a private Studio endpoint, connect the mobile device to the same network or VPN. |
| Chats are visible but tools fail | Keep the paired desktop awake, signed in, and connected to the target network. |
| A file or photo is not included in full | Try a smaller supported file. Large or unsupported attachments may be sent as metadata only. |
| Notifications do not appear | Allow notifications for Studio Remote in the device settings, then reopen the app while paired. |
| An approval never appears on mobile | Refresh the conversation and current connections; handle the request on the desktop if it is time-sensitive. |
| A mobile device should no longer connect | Revoke it from **Current connections** on the desktop. |
## Related
Review the modes and tool approval model that Studio Remote carries to mobile.
Review credential boundaries and connection-revocation practices.
# System requirements
Source: https://altostrat.io/docs/studio/en/system-requirements
Supported Studio desktop platforms, network paths, OS permissions, local-helper access, and feature-specific requirements.
Studio is a signed desktop application with a bundled local helper. The desktop must reach both Altostrat's cloud services and the hosts, APIs, browsers, or local applications you want Studio to operate.
## Supported desktop platforms
| Platform | Support |
| -------------------------------- | -------------------------------------------------------- |
| macOS 13 or newer, Apple Silicon | Supported and primary macOS target. |
| macOS 13 or newer, Intel | Supported x64 build. |
| Windows 10 or 11, 64-bit | Supported x64 build. |
| Linux desktop | Not currently distributed as a supported Studio release. |
Install the build matching the workstation architecture. Keep automatic updates enabled unless your organization distributes pinned releases through its own software-management process.
## Cloud and local network access
Studio needs:
* HTTPS access for sign-in, organization sync, Bedrock and supported AWS services, updates, billing, Studio Remote relay, and configured cloud integrations.
* Direct or routed reachability from the workstation to managed hosts.
* A VPN or jump host when the management network is not directly reachable.
* Protocol ports required by the configured host, such as SSH, Telnet, RDP, HTTPS, VNC, serial, SNMP, or vendor-specific services.
* Access to connector and MCP server URLs, including OAuth authorization and callback endpoints.
Studio does not provide a network path the workstation lacks. Test a target from the same workstation and network context before diagnosing it as a Studio failure.
## Local helper
The bundled helper provides terminals, network diagnostics, file transfer, browser runtime coordination, Computer Use, firmware staging, and other local operations. It starts with Studio and listens on local application paths rather than as a separately administered server.
Endpoint controls must allow the signed Studio app and its bundled helper binaries to run. If a local tool disappears after an EDR or antivirus policy change, inspect the security product before reinstalling Studio.
## OS permissions
Grant only the features your operators use.
| Capability | Permission or prerequisite |
| -------------------------------------------- | ------------------------------------------------------------------------- |
| Computer Use observation on macOS | Screen Recording. |
| Computer Use click and type on macOS | Accessibility. |
| Audio Use microphone | Microphone. |
| Audio Use system audio on macOS | Screen Recording. |
| Audio Use system audio on Windows | Stereo Mix or a virtual audio route when loopback capture is unavailable. |
| Built-in calls | Microphone; camera for video; screen capture for screen sharing. |
| Packet capture and protected network changes | Administrator, sudo, or the required capture capability. |
| Serial console | Permission to open the attached serial device. |
| Local discovery | Firewall and local-network access to the relevant segment. |
After granting a macOS privacy permission, use **Settings → Computer Use/Audio Use → Re-check**. Restart Studio if macOS retains the previous state.
## Computer Use availability
The documented Computer Use permission and secondary-cursor workflow is for the macOS desktop app. Prefer a structured terminal, connector, MCP, or browser tool when possible; Computer Use is for native graphical surfaces with no safer structured route.
## Browser runtime
Studio packages the browser assets required by headless browser sessions. Endpoint security must preserve the application bundle's browser files and symlinks. Browser sessions also need outbound access to the target site and its authentication endpoints.
## Firmware staging
The TFTP firmware server binds to a private RFC 1918 address and serves a selected local root directory.
* Windows defaults to UDP 69.
* macOS/Linux-like helper environments default to UDP 6969 because privileged ports normally require elevation.
* The target device must reach the displayed workstation address and port.
* Host firewall rules must allow the selected UDP port.
TFTP has no authentication. Use a dedicated directory, place only the required firmware file inside it, and stop the server after transfer.
## Studio Remote
Studio Remote requires:
* The current **production** Studio desktop app running in Electron.
* A signed-in desktop with the remote relay enabled for the release.
* Altostrat Remote on iPhone. Android is currently shown as coming soon.
* Network access from both devices to the relay services.
The phone does not replace local reachability. The desktop must stay awake, signed in, and connected to target networks for local tools to run.
## Calls and media
Allow WebRTC and the required media paths through proxies and firewalls. Select the correct microphone, camera, and speaker in the call preview or device settings. Audio Use and call transcription also require available usage allowance and no applicable hard limit.
## Resource planning
Long chats, multiple live browser or RDP sessions, large terminal buffers, dashboards, local embeddings, media calls, and packet capture all consume workstation resources. Close unused live surfaces and keep enough disk space for updates, files, recordings, and cached application assets.
For large rollouts, validate one representative managed workstation with the organization's VPN, proxy, EDR, firewall, OAuth, and device protocol policies before broad deployment.
## Related
Install the signed desktop build and select the correct organization.
Work from scope, helper, permissions, policy, credentials, and external reachability.
# Teams and organizations
Source: https://altostrat.io/docs/studio/en/teams-and-organizations
Model Studio trust boundaries with organizations, teams, channels, roles, visibility, and personal or shared credentials.
An Altostrat organization is Studio's primary trust and administration boundary. Organization context, members, teams, channels, integrations, policy, billing, and shared resources all live inside that scope.
Use separate organizations when two populations must not share administration, inventory, context, integrations, or billing. Do not use a channel as a substitute for a true customer or regulatory boundary.
## Choose an organization model
| Scenario | Recommended boundary |
| ----------------------------------------------- | ------------------------------------------------------------------------------------------------------------- |
| One internal operations team | One organization with teams and channels. |
| Consultancy serving unrelated customers | One organization per customer, plus an internal organization. |
| Production and lab with the same admins | One organization can work if channels and policy are sufficient; split when secrets or compliance require it. |
| Business units with different owners or billing | Separate organizations. |
| One external responder for a call or terminal | Guest link for the specific session, not organization membership. |
Switching organization re-scopes cloud and local organization data. Always verify the displayed organization after a switch and before approving a state-changing operation.
## Organizations, teams, and channels
| Layer | What it represents |
| ------------ | --------------------------------------------------------------------------------------------------------- |
| Organization | Trust, administration, billing, context, and maximum tool availability. |
| Team | Stable grouping of members for organization and sharing. |
| Channel | An operating stream with conversations, members, context, tool policy, work status, and optional workers. |
Use a team for "NOC" or "Security Engineering." Use a channel for "Customer A," "Core network incidents," or "Q3 migration."
## Organization roles
| Role | Responsibility |
| ------ | ----------------------------------------------------------------------------------------- |
| Owner | Organization lifecycle, responsible billing, and owner-gated features. |
| Admin | Member, context, channel, integration, and policy administration as allowed. |
| Member | Uses resources, maintains personal profile and credentials, and participates in channels. |
Channel roles—owner, admin, and member—are separate from organization roles. They determine who can maintain that channel's members, settings, context, and tool ceiling.
## Visibility
Studio resources can be private, organization-shared, or shared with selected members where the surface supports it. The exact control appears on the resource or Share dialog.
Keep drafts and personal investigations private. Share reviewed procedures, dashboards, hosts, diagrams, and work products when another operator should rely on them.
Resource visibility and credential scope are independent. Sharing a host, connector, or MCP definition does not automatically share your private credential.
## Credentials
Studio supports both personal and explicitly managed shared credential modes.
* **Personal** credentials live in the member's private Key Chain and are appropriate for user-attributed external access.
* **Shared** credentials represent an organization service identity and require deliberate provisioning, ownership, rotation, and policy.
An admin may see whether a member is ready to use a required personal integration, but not the member's secret. If an account is missing, the member completes the connect-your-accounts checklist in **Settings → Profile**.
Never paste credentials into organization context, channel context, member context, memories, artifacts, or chats.
## Context layers
Organization context defines stable shared rules. Member context describes a person's role and preferences. Channel context narrows the operating stream. A conversation adds live history and explicit attachments.
Keep each fact at the narrowest correct scope. A customer-only rule belongs in that customer's channel, not organization context. A personal working preference belongs in member context, not the channel.
## Presence and collaboration
Studio shows teammate presence and activity in the workspace and on shared surfaces. Shared terminal sessions, calls, guest links, chat board status, and Studio Remote support real-time handoff without changing the underlying organization boundary.
Presence is an availability hint, not authorization. Use the explicit role, share, and approval controls for access.
## Member lifecycle
When inviting a member:
1. Assign the minimum organization role.
2. Add only the necessary teams and shared channels.
3. Set or delegate member context.
4. Preload routine tools without widening policy.
5. Have the member connect required personal accounts.
6. Test effective access in the target channel.
When offboarding, transfer owned work, replace credential dependencies, reassign gates, remove membership, and rotate external shared secrets the person could access.
## Related
Manage identity, members, context, integrations, policy, and offboarding.
Configure channel roles, context, tools, and conversation status.
# Terminal
Source: https://altostrat.io/docs/studio/en/terminal
Open network-aware terminal sessions with clickable IPs and interfaces, selection-to-Copilot actions, staged commands, live error detection, and full recording and replay.
Studio's terminal is fast like a good xterm and aware like a network tool. When you connect, it detects the device vendor and OS in the background, turns IPs, interfaces, and AS numbers into clickable objects, and keeps a selection toolbar one click away so anything you highlight can go straight to Copilot.
This page covers terminals connected to managed hosts. For commands that run on the Studio workstation or against a local repository, see [Local shell and code tools](./local-shell-and-code-tools).
The surface is built for live operations. A staging panel can hold proposed command sets for review. A color-coded strip flags BGP, OSPF, interface, spanning-tree, HSRP, and authentication errors as they scroll past. Every SSH and Telnet session records automatically, and you can replay it later with timing preserved.
None of this replaces the device CLI. It wraps it with the context and safety net you'd build yourself if you had the time.
## Opening a session
From the Hosts activity, open the host and choose SSH, Telnet, or another protocol from its protocol list.
The tab takes focus and the terminal starts connecting immediately.
If the referenced credential isn't cached, Studio prompts once and caches it for the session.
Vendor, OS, and software version appear in the status bar when detection completes. Copilot uses this to tailor its suggestions.
## Clickable network objects
IPv4 and IPv6 addresses, MAC addresses, interface names, and AS numbers are interactive in the terminal. Click to copy. Right-click to open a menu of diagnostic commands shaped to the detected vendor — a ping from the device, a traceroute, a show command scoped to that interface, an ARP lookup, a whois on an AS number.
## Selection toolbar
Highlight any output and a small toolbar appears above the selection. Most day-to-day interactions with Copilot start here.
| Action | What it does |
| ----------- | --------------------------------------------------- |
| Explain | Send the selection to Copilot for an explanation. |
| Ask Copilot | Open a Copilot prompt prefilled with the selection. |
| Copy | Copy to clipboard. |
| Edit | Open the selection in a Monaco editor tab. |
## Staged commands
When Copilot prepares a staged command set, it opens beside the terminal with commands tagged by intent—Add, Remove, or Modify—and a checkbox for each item. You can reorder, edit, remove, or approve individual commands before dispatch.
Studio can also propose a direct terminal tool call. Its execution follows the current policy, classification, and trust posture. In supervised use, review the exact command before approving it. Autopilot can bypass that per-call prompt, so do not enable Autopilot merely to make a staged change run faster.
## Real-time error detection
Studio scans output as it streams. BGP neighbor drops, OSPF adjacency loss, interface errors, spanning-tree topology changes, HSRP state changes, and authentication failures are recognized and added to an error strip along the edge of the tab. Each entry is color-coded by severity. Click an entry to jump to the matching line in the scrollback.
## Session recording and replay
Every SSH and Telnet session records automatically. Replay preserves timing—you see the session the way it happened, at the speed it happened—and you can search within the transcript to find the exact moment a command ran or an error landed. An archived replay can be shared according to the file's visibility; it is not automatically visible to every organization member. See [files and artifacts](./files-and-artifacts) for how artifacts move between people.
## Picture-in-picture
Pop a terminal out into a floating mini-window for side diagnostics while you work in another tab. A continuous ping, a traceroute you want to keep watching, a `show interface` you want on screen during a maintenance. Picture-in-picture windows stay on top, resize cleanly, and can be minimized when you need the space.
## Serial consoles
For out-of-band work, open a serial console from the terminal tooling and choose the local serial port and baud rate — 9600, 19200, 38400, 57600, or 115200. Parity and stop bits are configurable for the session. A send-break action is available for password recovery on devices that require it.
Send-break and password-recovery sequences can take a device offline. Confirm you have the right console before triggering them.
## Sharing a terminal
You can share any terminal session with teammates — owner, co-work, or viewer roles — and promote a share into a voice or video call when a second operator joins. See [shared sessions](./shared-sessions) for the roles, presence indicators, and handoff flow.
## Related
Run workstation commands and inspect or change a grounded repository.
Modes, approvals, context attachment, and how Copilot works with your terminal.
Bring someone into your terminal with the right role and promote to a call.
# Tour the workspace
Source: https://altostrat.io/docs/studio/en/tour-the-workspace
Learn Studio's channel-aware sidebar, conversation surface, artifact workbench, activity stack, tabs, search, and status bar.
Studio keeps a conversation, the operational surfaces it uses, and the work it creates in one desktop workspace. Navigation and channels live on the left. The active conversation stays central. Terminals, files, dashboards, procedures, settings, and other artifacts open in a tabbed workbench beside it. Live tasks and account state remain visible around the edges.
## The left sidebar
The fixed navigation at the top of the sidebar contains:
| Item | Opens |
| ---------- | ------------------------------------------------------------------------ |
| New chat | A new conversation in the selected channel. Default shortcut: `Mod+N`. |
| Search | Unified search for content, navigation, and commands. Shortcut: `Mod+K`. |
| Hosts | Inventory, protocols, folders, and host actions. |
| Files | Generated artifacts, session replays, and remote host files. |
| Connectors | Personal and organization connectors and MCP servers. |
| Procedures | Markdown runbooks, triggers, schedules, and run history. |
Below the fixed navigation, Studio shows recent dashboards, the channel switcher, and the conversation list. The lower sidebar surfaces running activity and your organization/account controls.
`Mod` means Command on macOS and Ctrl on Windows.
## Channels and conversations
The channel switcher controls which conversations, grounding, members, and tool policy apply to new work. The organization switcher controls the larger trust boundary. They are different scopes.
The chat list supports pinning, renaming, archiving, and work status. Open the channel menu for the chat board, which groups conversations into **Processing**, **In progress**, **Cancelled**, and **Done**.
When you start a chat, the composer displays the selected channel and gives you:
* A plus menu for attachments and context.
* `@` mentions for hosts, files, procedures, connectors, MCP servers, and tools.
* Default, Ask, and Planning modes.
* The optional Autopilot permission.
* Model selection for the conversation.
* Queue or steer behavior while Copilot is already running.
## Conversation and artifacts workspace
The conversation is the operating thread. Tool calls, approvals, plans, sub-agent progress, generated UI, cost details, and completion state all stay in its transcript.
Studio opens the things a conversation works with in the artifacts workspace: terminals, host editors, browser sessions, remote desktops, files, reports, code, dashboards, generated apps, procedures, settings, calls, and usage.
Toggle the artifacts workspace with `Mod+Shift+B`. Toggle the bottom panel with `Mod+J`.
## Tabs and editor groups
Tabs can open as previews, stay open, be pinned, or move between groups. Split the workbench right or down when two surfaces need to remain visible.
| Shortcut | Action |
| ----------------------------- | ------------------------------------- |
| `Mod+W` | Close the active editor. |
| `Mod+Shift+T` | Reopen the last closed editor. |
| `Mod+Tab` / `Mod+Shift+Tab` | Move through recently used editors. |
| `Mod+PageDown` / `Mod+PageUp` | Move to the next or previous editor. |
| `Mod+\` | Split the active editor right. |
| `Mod+K`, then `Mod+\` | Split the active editor down. |
| `Mod+1` through `Mod+4` | Focus editor group 1 through 4. |
| `Mod+K`, then `Mod+M` | Maximize or restore the active group. |
| `Mod+K`, then `Mod+L` | Lock or unlock the active group. |
| `Mod+K`, then `Enter` | Keep a preview editor open. |
| `Mod+K`, then `Shift+Enter` | Pin or unpin the active editor. |
Lock a group when a live terminal, call, or dashboard must not be replaced by the next preview. Pin an editor when it should survive routine navigation.
## Search and commands
Press `Mod+K` to search Studio entities and registered commands. Results can include hosts, conversations, procedures, files, dashboards, settings, and actions. Search the noun when you know the object and the verb when you know the action.
Examples:
* `edge-03` to find a host or conversation mentioning it.
* `billing` to open Billing or Usage.
* `split editor` to find a workbench action.
* `key chain` to open credential management.
Search before creating a duplicate procedure, host, memory, dashboard, or channel.
## Activity and status
The activity stack shows work that continues outside the currently visible surface: agentic chat runs, sub-agents, browser sessions, calls, procedure runs, scheduled wakeups, sync, and other background work. Open an item to return to its owning conversation or workspace.
The status bar exposes current health and account state, including running activity, connectivity, sync, usage balance, Studio Remote, and context-specific session indicators. When a task appears stuck, open its activity detail before retrying.
## Useful global shortcuts
| Shortcut | Action |
| ------------- | --------------------------------------------- |
| `Mod+N` | New chat. This accelerator can be customized. |
| `Mod+K` | Search Studio. |
| `Mod+,` | Open Settings. |
| `Mod+Shift+K` | Open Key Chain. |
| `Mod+Shift+U` | Open Usage. |
| `F11` | Toggle full screen. |
See [Keyboard shortcuts](./keyboard-shortcuts) for the full workbench list and custom procedure triggers.
## A reliable operating loop
1. Confirm the organization and channel.
2. Open or mention the exact host, file, procedure, connector, or dashboard.
3. Start in Ask or Planning when the target is unfamiliar.
4. Gather evidence in the appropriate structured surface.
5. Review approvals in the conversation before state changes.
6. Save the result as an artifact, dashboard, memory, or procedure when it should outlive the chat.
7. Set a conversation status or move its card on the chat board when the work needs tracking.
## Related
Define context and policy, then track conversations by status.
Choose a mode, attach context, review tools, and steer a run.
# Troubleshooting
Source: https://altostrat.io/docs/studio/en/troubleshooting
Diagnose Studio problems by checking scope, activity, local helper, permissions, policy, credentials, usage, and external reachability.
Start with the narrowest boundary that can explain the symptom:
1. Correct organization and channel.
2. Correct host, URL, app, file, tenant, or phone.
3. Current activity or pending approval.
4. Effective tool policy and credential readiness.
5. Local helper and OS permission.
6. VPN, proxy, firewall, external service, or usage limit.
Open the activity stack and status bar before retrying. Repeated retries can duplicate external writes, payments, calls, or background work.
## Sign-in and scope
| Symptom | Check |
| ------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ |
| Sign-in will not complete | Verify internet, system clock, default browser handoff, and whether your account can sign in to the Altostrat web surface. |
| No organizations appear | Confirm the invitation was accepted and has not been revoked. |
| Expected resources are missing | Check the active organization, channel, visibility, and whether first sync is still running. |
| Organization switch looks stale | Wait for scoped data to refresh; if it does not, restart Studio and sign in again. Do not act until the displayed organization is correct. |
## Workspace and search
| Symptom | Check |
| --------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- |
| An editor keeps being replaced | Keep or pin the preview editor, or change preview behavior under **Settings → Workspace**. |
| Artifacts workspace is hidden | Press `Mod+Shift+B`. |
| Bottom panel is hidden | Press `Mod+J`. |
| Search will not open | Press `Mod+K` outside a focused terminal; a focused terminal uses `Mod+K` to clear. |
| Search cannot find an item | Check organization and channel, search a related term, and inspect the dedicated Hosts, Files, Procedures, or Connectors surface. |
| New chat shortcut does nothing outside Studio | Enable and register a global accelerator under **Settings → Workspace**; resolve any conflict shown there. |
## Channels and policy
| Symptom | Check |
| ------------------------------------------ | ----------------------------------------------------------------------------------------------------------------- |
| A shared channel is missing | Confirm channel membership and that the channel is not archived. |
| A member cannot edit channel settings | Only channel owners and admins can edit shared settings. |
| Copilot cannot see a tool in one channel | Compare organization, member, and channel policy. A channel can narrow access. |
| A tool is listed but dispatch is denied | Policy changed after the conversation discovered it. Start a fresh chat or refresh tools after correcting policy. |
| The chat board card is in the wrong column | Update the conversation status or drag it to the intended column. |
## Terminal, RDP, and host access
| Symptom | Check |
| -------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
| A terminal fails before authentication | Verify address, protocol, port, VPN, jump host, firewall, and that the local helper is running. |
| Authentication fails | Confirm the named Key Chain entry, username, key, external account state, and host mapping. |
| SSH host key changed | Stop and verify the new fingerprint through a trusted path before accepting it. |
| RDP opens but input or frames stall | Check credentials, target reachability, session activity, and local helper; close and reopen only after confirming a second session is safe. |
| Remote file save is denied | Check absolute path, remote owner/mode, active credential, and whether the file changed remotely. |
## Copilot
| Symptom | Check |
| ---------------------------------------- | -------------------------------------------------------------------------------------------------------------- |
| Copilot uses the wrong target | Steer immediately, attach the exact object, and restate organization, channel, tenant, and host. |
| Copilot cannot use tools | Check mode, organization/member/channel policy, local helper, and required credentials. Ask mode is read-only. |
| A run stops at 30 turns | Continue explicitly or adjust **Settings → AI → Max agent turns**. The default cap is 30. |
| A long conversation is slow or expensive | Run `/compact` with focus instructions, remove unnecessary attachments, and consider 200K context. |
| Enter queues when you meant to redirect | Use `Command/Ctrl+Enter` for the opposite action or change Follow-up behavior in Settings. |
| Autopilot is on unexpectedly | Disable it from the composer or **Settings → AI** before continuing. |
| Cost details seem wrong | Open **Usage → Per-chat** and inspect model and token records; Auto can use multiple models in one chat. |
## Browser and Computer Use
| Symptom | Check |
| ----------------------------------------- | ---------------------------------------------------------------------------------------------------------------- |
| Browser live view says Reconnecting | Keep the tab open, check local helper and network, then inspect the browser activity item. |
| Copilot is on the wrong website or tenant | Take over, correct the account and URL, release control, and restate the boundary. |
| Browser approval is hidden | Close picture-in-picture and return to the conversation; Studio normally focuses it when an intent needs review. |
| macOS screen cannot be observed | Grant Screen Recording under **Settings → Computer Use**, select Re-check, then restart Studio. |
| macOS click or type fails | Grant Accessibility and confirm the target window has not moved or closed. |
## Connectors and MCP
| Symptom | Check |
| -------------------------------- | ----------------------------------------------------------------------------------------------- |
| Integration shows `needs-auth` | Complete **Settings → Profile → Connect your accounts** or create the required Key Chain entry. |
| 401 or refresh failure | Re-authorize and confirm client configuration and personal/shared credential mode. |
| 403 | Check external permission plus organization, member, and channel policy. |
| MCP connects with no tools | Refresh discovery, inspect the published catalog, and confirm individual tools are enabled. |
| Dashboard calls the wrong tenant | Disable the source until base URL, credential, and channel are corrected. |
## Dashboards and apps
| Symptom | Check |
| --------------------------------- | ------------------------------------------------------------------------------------------------------- |
| Widget stays in loading | Confirm source readiness, authentication, response schema, variables, transforms, and refresh interval. |
| Panels disagree | Compare time window, unit, filter, aggregation, and last refresh. |
| A generated app is disabled | Review its current revision, exact capability request, and allowed origins. |
| An old grant no longer works | The capability hash changed; review and grant the new set instead of reusing the old approval. |
| A recent edit broke the dashboard | Open history and restore the last known-good version. |
## Files and organization memory
| Symptom | Check |
| ---------------------------------------- | --------------------------------------------------------------------------------------------------------- |
| A generated artifact is missing | Search title/content, confirm organization, inspect recent Files, and open the originating chat if known. |
| Copilot finds an app that is not running | Organization memory stores last-known state. Verify host, workspace, process, port, URL, and revision. |
| A replay is empty or incomplete | Confirm the session produced output and completed recording; a replay contains only captured data. |
## Calls and Audio Use
| Symptom | Check |
| -------------------------------------- | ----------------------------------------------------------------------------------------------------- |
| No microphone | Select the correct device and grant microphone permission. |
| Audio Use hears only you | Grant macOS system-audio/Screen Recording or configure Stereo Mix/virtual audio on Windows. |
| Call connected but no workspace opened | Enable automatic opening in **Settings → Calls** or open it manually. |
| Transcription will not start | Check permissions, Calls setting, usage balance, and transcription hard limits. |
| Poor call quality | Inspect the call workspace diagnostics and WebRTC network state, then test another device or network. |
## Usage and billing
| Symptom | Check |
| ------------------------------------------- | -------------------------------------------------------------------------------------------------------------- |
| Top up is unavailable | Confirm the responsible billing owner is signed in. |
| Payment completed but balance is stale | Refresh balance and invoices; finish any Stripe authentication tab. Do not submit again until status is known. |
| Usage is blocked with balance remaining | Inspect hard limits and the active allowance window. |
| Per-chat data is missing for another member | Per-chat drill-down is intentionally self-only. Use authorized aggregate views instead. |
## Firmware staging
| Symptom | Check |
| -------------------------- | ----------------------------------------------------------------------------------------------------------------------- |
| TFTP server will not start | Select a root directory, choose an available port, and use a non-privileged port such as 6969 on macOS unless elevated. |
| Device cannot download | Confirm displayed RFC 1918 address, UDP port, host firewall, same routed network, filename, and device TFTP syntax. |
| Unexpected file exposure | Stop the server immediately and remove unrelated files from the root. TFTP has no authentication. |
## Studio Remote
| Symptom | Check |
| ---------------------------------------- | ---------------------------------------------------------------------------------------------------------------- |
| Phone control is missing | Use the latest production desktop app in Electron; Studio Remote is not exposed in staging/browser environments. |
| Pairing fails | Generate a new code and verify both devices can reach relay services. |
| Mobile chat works but a local tool fails | Keep the paired desktop awake, signed in, and connected to the target network. |
| A phone should no longer have access | Revoke it from **Current connections** on the desktop. |
## Collect support evidence
Include:
* Studio version and operating system.
* Organization ID and channel name, without private content.
* Time and time zone.
* Exact surface, target type, and expected result.
* Activity and status state.
* Redacted log excerpt and reproducible steps.
Remove tokens, passwords, private keys, session cookies, sensitive customer data, and complete credential-bearing URLs before sharing logs or screenshots.
## Related
Review supported platforms, network paths, permissions, and feature-specific needs.
Review workspace, profile, AI, permissions, calls, firmware, Billing, and Key Chain.
# Usage and billing
Source: https://altostrat.io/docs/studio/en/usage-and-billing
Understand Studio usage, per-chat and per-model cost, limits, plans, top-ups, payment methods, tax details, and invoices.
Studio separates operational usage from billing administration. **Usage** explains where AI, calls, and transcription consumption came from. **Billing** manages the organization's plan, payer information, payment methods, tax IDs, and invoices.
The status bar can show the remaining allowance or top-up balance while you work. Open the usage control for the detailed Usage view; use the display preference if you do not want the balance pinned persistently.
## Usage view
| Tab | What it shows |
| ------------- | ------------------------------------------------------------------------------------ |
| Overview | Remaining usage, headline counters, active limits, and current windows. |
| AI | Daily token use, model breakdown, cost context, and usage by member where permitted. |
| Per-chat | Your own conversations with model, tokens, and cost drill-down. |
| Calls | Calling consumption and usage by member. |
| Transcription | Daily transcription minutes and related totals. |
| Limits | Organization and per-user soft or hard limits. |
Per-chat detail is intentionally self-only. Organization aggregate or member summaries do not grant an admin access to another person's chat content.
## Understand AI cost
Studio records input, output, cache, model, and billed usage for AI work. In the model table, use filters to narrow the date, surface, or member and inspect the records behind a total.
The conversation cost view shows the models used in that conversation and a cost breakdown when pricing is available. **Auto** can route individual turns to different models, so one conversation can contain more than one model.
Cost is most affected by:
* Model and context-window choice.
* Large attachments, tool results, and long un-compacted history.
* Browser AI Grounding and image-heavy work.
* Agentic turn count and sub-agent work.
* Repeated polling or retries against an unavailable source.
Use `/compact` with optional focus instructions when a long chat still matters but most history no longer needs to remain verbatim.
## Allowance, top-ups, and windows
Your plan provides an allowance over a defined usage window. The UI shows percentage remaining instead of exposing implementation-level raw credits. Purchased top-up balance is shown separately in currency and can cover additional eligible usage.
Top-up balance carries across plan changes and expires 12 months after purchase. The top-up review shows the exact charge and saved card before payment.
When a rolling allowance window is full, a top-up may let work continue immediately. Otherwise, wait for the window reset or ask an administrator to review the limit.
## Top up safely
Use the persistent balance or a usage-limit prompt. Only an authorized billing owner can complete organization billing writes.
Select a preset or enter the supported amount in currency.
Confirm the amount, organization, saved payment method, and top-up expiry statement.
Some cards require Strong Customer Authentication in a Stripe-hosted flow. Return to Studio after the payment completes.
Confirm the balance updates and open **Billing → Invoices** for the hosted invoice or PDF receipt.
Do not retry repeatedly when payment status is unclear. Refresh invoices and balance first so an in-flight authorization does not become an accidental duplicate attempt.
## Usage limits
Authorized administrators can set soft or hard limits for supported metrics at organization scope and, where supported, user scope.
* A **soft limit** warns while allowing continued use.
* A **hard limit** blocks covered usage when the threshold is reached.
Limits can cover AI spend or tokens, call minutes, transcription seconds, and transcription sessions. Treat a limit as a guardrail, not an accounting report: check the Usage and Billing views for the financial picture.
## Billing pages
| Page | What you manage |
| --------------- | ----------------------------------------------------------------------- |
| Plan | Current tier, upgrade, downgrade, subscription state, and cancellation. |
| Billing details | Legal name, billing contact, and invoice address. |
| Payment methods | Cards saved with Stripe for the organization. |
| Tax IDs | VAT, GST, EIN, and other supported invoice identifiers. |
| Invoices | Stripe-hosted invoices and PDF receipts, including top-ups. |
Plan downgrades take effect at the end of the billing cycle when Studio shows them as scheduled. Confirm the effective date in the Plan view before assuming access or allowance has changed.
## Billing ownership
Billing writes are restricted to the organization's responsible billing owner. Transfer billing ownership before that person leaves the organization. A normal organization admin may be able to inspect usage without being authorized to change the plan or payment method.
## Troubleshooting
| Symptom | What to check |
| --------------------------------------- | ------------------------------------------------------------------------------------------------------------------- |
| Balance did not update after payment | Refresh billing events and invoices; complete any Stripe authentication tab that is still open. |
| Top-up button is unavailable | Confirm you are the billing owner or ask the owner to complete the purchase. |
| A conversation cost seems high | Open **Per-chat**, inspect models and tokens, then check attachments, context window, turns, and browser grounding. |
| Usage is blocked with balance remaining | Check hard limits and the active allowance window, not only top-up balance. |
| An invoice needs corrected company data | Update **Billing details** and tax IDs before the next charge; ask support about an already-issued invoice. |
## Related
Set the default model, context window, turn limit, and follow-up behavior.
Understand models, context, compaction, turns, and Browser AI Grounding.
# Capacity upgrade: 100 Mbps to 1 Gbps transit cutover
Source: https://altostrat.io/docs/studio/en/use-cases/isp/capacity-upgrade
Plan, procure, and cut over a 10x capacity uplift on a regional transit link — LibreNMS growth data, quote approval, cross-connect, BGP session bring-up, graceful traffic shift, customer comms.
LibreNMS shows the Auckland POP's transit link crossing 75 percent 95th-percentile utilization for three months running. Growth is linear; exhaustion is three months out. The ISP plans and executes a 100 Mbps → 1 Gbps upgrade with zero scheduled downtime for subscribers.
## Systems involved
| System | Role |
| --------------------------- | ----------------------------------------------- |
| LibreNMS | Utilization and growth trend data. |
| Transit provider portal | Quote, order, circuit ID, handoff details. |
| Datacenter colo portal | Cross-connect request, rack and panel location. |
| Juniper MX / Cisco ASR core | BGP session, interface bring-up, policy. |
| NetBox | Circuit record, IP allocations, ASN records. |
| Slack `#capacity` | Engineering channel. |
| Gmail | Customer and transit-provider comms. |
| Studio Procedures | `Transit BGP bring-up` runbook. |
## Walkthrough
Copilot pulls LibreNMS graphs for the last 180 days, fits the trend, and estimates the exhaustion date. The artifact is a Markdown case with the 95th-percentile chart, the growth fit, and the recommended upgrade window.
Request quotes from two transit providers with 1 Gbps ports at the Auckland POP. Responses land in Studio; Copilot tables them side-by-side with port cost, commit, overage, MRC, and NRC.
The case artifact and the quote comparison go to the engineering lead and finance. Approved, PO raised, provider chosen.
Through the colo portal connector, order the cross-connect to the new transit port with target date. The colo returns panel and cassette details; they get stored on the new circuit record in NetBox.
Before the circuit date, Copilot drafts the new BGP session config in Juniper syntax: peer ASN, peer IP, prefix limits, BGP TTL, MD5, inbound and outbound policies. The config stages as an artifact; it does not hit the router yet.
The colo confirms the cross-connect is done. SSH to the core router. Bring up the new interface, push the pre-staged BGP config, verify `show bgp summary` shows Established, verify prefix counts match expected.
For 30 minutes, AS-path prepend on the old session. Watch the utilization move. When traffic stabilises on the new path, send graceful shutdown on the old session, then decommission.
Through Gmail, send a post-upgrade note to customers whose SLAs reference the specific POP: upgrade completed, capacity headroom restored, no action required. Status page gets a Completed Maintenance entry even though there was no scheduled outage.
Update NetBox with the new circuit, decommission the old circuit record, update the BGP peer documentation, save memories: the new transit provider's NOC contacts and their change-management preferences.
## Where Studio earns its keep
* The upgrade case is evidence-driven — the finance review isn't a handwave about growth; it's a chart with a fit.
* The BGP config is pre-staged and reviewed in daylight, not composed at 02:00 with the old circuit about to be disconnected.
* The graceful shift via AS-path prepend is visible in the live utilization graph, and the decommission only happens when the numbers confirm it.
* Post-upgrade comms reference the same circuit record and customer list the engineering work did.
## Related
`Transit BGP bring-up` is reusable whenever a new peer comes online.
Update the POP topology with the new upstream.
# CGNAT pool exhaustion: alert to expanded capacity
Source: https://altostrat.io/docs/studio/en/use-cases/isp/cgnat-exhaustion
NetFlow flags CGNAT port-pool exhaustion on a regional aggregator. Add pool capacity, reduce per-subscriber port budget safely, notify abuse partners about the pool changes, and document the new IP plan.
Evening peak brings the CGNAT aggregator at the Wellington POP to 98 percent port-pool utilization. The ISP needs to expand the pool, tune per-subscriber port budgets, keep the abuse-contact registrations current so spam and law-enforcement lookups still work, and document the new IP plan in NetBox.
## Systems involved
| System | Role |
| ------------------------------------------------- | --------------------------------------------------- |
| NetFlow / IPFIX collector | Port-pool utilization. |
| CGNAT platform (A10 / Cisco NAT44 / MikroTik NAT) | Pool configuration, per-subscriber budgets. |
| NetBox / IPAM | IP plan updates. |
| Abuse-contact registries (ARIN / RIPE / APNIC) | Update pool registrations for subpoena cooperation. |
| Splynx | Subscriber counts mapped to pools. |
| Slack `#carrier-ops` | Engineering channel. |
| Gmail | Inter-carrier abuse-contact comms. |
| Studio Procedures | `CGNAT pool expansion` runbook. |
## Walkthrough
Copilot pulls port-pool utilization from the CGNAT platform for the last 14 days. Peak hours hit 98 percent; the distribution of per-subscriber port use is long-tailed — a small number of subscribers drive most of the consumption.
Add a /23 of public IPv4 to the pool. Recalculate ports-per-subscriber with the new capacity and the current subscriber count. Stage a mild reduction of the per-subscriber hard cap so the long-tail subscribers are not disproportionate.
SSH into the CGNAT platform. Copilot drafts the configuration to add the new pool range and the new per-subscriber budget, stages it in the staging panel, and shows the expected effect on pool utilization.
On the edge routers, announce the new /23. Verify the advertisement appears in the looking glass and that the ISP's RPKI ROAs are updated so the prefix is valid.
During the low-traffic window, push the CGNAT config. Monitor for session churn; most sessions continue because the new pool is additive. Only the subscriber-budget change causes a gentle re-NAT cycle.
Update NetBox with the new /23 role, the pool ID, the ASN assignment, and the abuse contact. The IP plan artifact is regenerated and saved to the team drive.
Through the RIR connectors, update the abuse-contact record for the new /23 so that subpoena requests and spam investigations route to the right ISP team. Draft the inter-carrier courtesy note through Gmail to major abuse partners.
Over the next three evenings, Copilot watches the pool utilization and flags the new peaks. Utilization settles at 71 percent with headroom for the projected next six months.
## Where Studio earns its keep
* The exhaustion problem, the expansion plan, and the BGP announcement live in one session, with the subscriber impact visible at every step.
* The RIR abuse-contact update is not a forgotten afterthought — it's in the runbook and it's actually executed.
* NetBox and the ISP's public prefix list stay synchronized without anyone remembering to email the IP coordinator.
* The runbook runs again in six months when the next /23 is needed, with the arguments already shaped.
## Related
`CGNAT pool expansion` with POP and prefix as arguments.
Save CGNAT platform quirks so they're not relearned at 22:30.
# CPE bulk firmware rollout: advisory to verified updates
Source: https://altostrat.io/docs/studio/en/use-cases/isp/cpe-firmware-rollout
A vendor advisory drops mid-week. Stage the firmware through the TR-069 ACS, plan a regional rollout with maintenance windows, notify subscribers, monitor reboot success, and roll back the failures.
Ubiquiti publishes a critical firmware advisory for EdgeRouter X devices. The ISP operates 14,000 of them across residential subscribers. The rollout has to stage firmware centrally, go out regionally with per-region maintenance windows, notify subscribers before each window, watch reboot success rates, and roll back the handful that don't come back cleanly.
## Systems involved
| System | Role |
| --------------------- | --------------------------------------- |
| Vendor advisory | Source announcement and firmware image. |
| TR-069 ACS (GenieACS) | Firmware distribution to CPE fleet. |
| Studio inventory | CPE records tagged by region. |
| Twilio SMS | Subscriber pre-maintenance notice. |
| Gmail | Business-tier subscriber email comms. |
| Atlassian Statuspage | Maintenance windows published. |
| Splynx | Subscriber region and contact lookup. |
| LibreNMS | Reboot and reachability verification. |
| Slack `#cpe-fleet` | Operational channel. |
## Walkthrough
Copilot downloads the firmware from the vendor advisory, validates the SHA against the published hash, and uploads it to the ACS repository. The image appears in the ACS catalogue with the advisory ID.
Split the fleet by region — 14 regions, roughly 1,000 CPEs each. Each region gets a 2-hour window spread over ten nights. Business subscribers are scheduled last so any issues surface on residential first.
48 hours before each regional window, Twilio sends an SMS to residential subscribers: brief outage, window, self-service URL for status. Business subscribers get a personalised email through Gmail.
Statuspage publishes all 14 maintenance windows with the affected regions and the advisory reference. The IVR hold message picks up an automated region-aware notice 30 minutes before each window.
The `CPE firmware rollout` procedure targets Region 1, 10 percent of the CPEs at a time. For each batch, the ACS queues the upgrade. Copilot watches the CPEs come back online against LibreNMS reachability within the expected reboot interval.
Target threshold is 99.5 percent reboot-and-reauth within the window. Region 1 hits 99.7 percent. Seven CPEs didn't come back — Copilot flags each one with the last-known state and queues them for individual attention.
For each failed CPE, Copilot pulls the RADIUS last-accounting record, the ACS session history, and the LibreNMS last-seen. Five come back on the next day's reboot. Two are dispatched for field swap.
Each following night, the rollout procedure runs for the next region. Statuspage and `#cpe-fleet` maintain a running status board. Residential complaints are near-zero because the comms went out ahead.
After all 14 regions, generate the rollout report: fleet coverage, success rate, rollback count, field-swap count, advisory closed. The report is filed to the ISP's security advisory register and the post-mortem is auto-scheduled.
## Where Studio earns its keep
* The rollout is gated — each region only starts when the previous region hits the success threshold, so the first problem is caught on 1,000 subscribers, not 14,000.
* The SMS, the email, and the status page all point at the same regional schedule — there is no gap between "when we said" and "when it happened."
* Failed CPEs are handled individually from the same workspace with the full history available, not marked as errors in a report for someone else to chase next Tuesday.
* The runbook is parameterized by region, so the next advisory from any CPE vendor reuses the same structure.
## Related
`CPE firmware rollout` with advisory ID and region as arguments.
GenieACS, Twilio, and Splynx wired as connectors.
# DDoS mitigation activation and customer comms
Source: https://altostrat.io/docs/studio/en/use-cases/isp/ddos-mitigation
A NetFlow anomaly flags a volumetric attack on a hosted customer. Confirm in FastNetMon, activate upstream mitigation, advertise RTBH where appropriate, and keep the customer informed through the whole event.
FastNetMon detects 38 Gbps of UDP reflection traffic aimed at one of the ISP's hosted customer prefixes. The NOC needs to confirm the attack, activate upstream mitigation with the ISP's transit providers, protect the rest of the subscribers without blackholing the victim unnecessarily, and keep the customer informed so they don't see their own website blackholed and open a panic ticket.
## Systems involved
| System | Role |
| ----------------------------------------------- | ------------------------------------------- |
| FastNetMon | Source detection. |
| NetFlow / sFlow collectors | Confirm pattern, identify attack signature. |
| Core routers (Juniper MX / Cisco ASR) | BGP flowspec, RTBH, policer announcements. |
| Transit provider portals (Cogent, Lumen, Telia) | Upstream scrubbing request. |
| Cloudflare Magic Transit / Arbor TMS | Scrubbing centre diversion. |
| Slack `#security` | Internal channel. |
| Customer portal / Gmail | Customer-facing comms. |
| Splynx / Sonar | Customer record and contact lookup. |
## Walkthrough
FastNetMon raises the alarm. Copilot pulls the NetFlow top-flows, confirms UDP reflection on source ports 123 and 11211, and identifies the destination prefix — a single /28 hosted for a customer named ACME Gaming.
The prefix is hosting live game-matchmaking. RTBH blackholes the customer, which is the attacker's goal. Copilot proposes transit scrubbing first, flowspec policer second, RTBH last-resort — and lists the phone numbers for each transit provider's NOC.
Through the Lumen scrubbing connector, request diversion for the affected /28. Cogent has no connector yet — Copilot drafts the email template with attack signature, prefix, customer identifier, and contact phone.
SSH to the core routers. Stage the flowspec rule: drop UDP/123 and UDP/11211 traffic to the victim prefix. Approval prompt shows the exact match and action. Push and monitor.
Copilot pulls the customer's technical contact from Splynx and drafts a short email through Gmail: attack detected, scrubbing active, their service may see brief rerouting, the NOC is monitoring, next update in 30 minutes. Sent.
Open a Slack thread in `#security` with the timeline, flow samples, scrubbing status, the customer contact state, and the escalation tree. Every action in the incident posts there automatically.
Copilot watches the FastNetMon attack-graph and the core-router interface counters. Scrubbing brings the attack from 38 Gbps to 180 Mbps of legitimate traffic within six minutes.
When the attack falls below the policer threshold for 15 minutes, withdraw the scrubbing diversion, remove the flowspec rule in reverse order, and validate the customer's service is normal. Send the customer the all-clear email.
Generate a Markdown attack-event report: timeline, peak bps and pps, signature, mitigations applied, effectiveness curve, recommendations. Attach to the internal ticket and email to the customer for their records.
## Where Studio earns its keep
* The decision — scrub vs. flowspec vs. RTBH — happens with the customer's service impact visible on the same screen as the attack signature.
* Transit-provider engagement happens from inside the workspace with the exact attack details ready to paste, not from scratch in a browser.
* The customer gets a coherent update before they file a panic ticket, which preserves the relationship.
* The post-event report writes itself from the flow data and the action timeline, which is the artifact insurance and regulators want.
## Related
Keep Planning mode on while DDoS decisions are active — every action deserves a visible approval.
FastNetMon, transit scrubbing portals, and Splynx as connector calls.
# Fiber cut response: OTDR alarm to restored service
Source: https://altostrat.io/docs/studio/en/use-cases/isp/fiber-cut-response
An OTDR fires a fibre-break alarm mid-morning. Identify the segment, dispatch a splicer to the GPS coordinates, notify affected subscribers by SMS, coordinate road access with the municipality, and track the repair to the restoration.
At 11:04 the OTDR on the northern backbone fires a fibre-break alarm 14.3 km from the POP, in a segment that serves 312 residential subscribers. The NOC needs a splicer at the right coordinates within the hour, subscribers informed before they call, and the municipality notified if roadworks are needed.
## Systems involved
| System | Role |
| ----------------------------- | ---------------------------------------------------- |
| OTDR monitoring system | Source alarm with distance-to-fault. |
| Fibre GIS (QGIS / OSPInsight) | Convert distance to GPS coordinates and road access. |
| Google Maps / Routing API | Splicer ETA from current position. |
| Splicer dispatch | Field ops team and equipment. |
| Twilio SMS | Subscriber outbound notifications. |
| Splynx | Subscriber list affected by the broken segment. |
| Local municipality liaison | Road permit / access for trenching. |
| Atlassian Statuspage | Public status page. |
| Slack `#fiber-ops` | Operational channel. |
## Walkthrough
Copilot pulls the OTDR trace, converts 14.3 km along the fibre path into GPS coordinates using the GIS overlay, and places a pin on a map artifact. Two candidate road accesses appear — one is closer by truck, one is closer by foot across a paddock.
Query the GIS + Splynx join: subscribers on the downstream side of the break. 312 households, 8 commercial, 2 on SLA-backed service tiers.
Copilot finds the nearest splicer with a van and OTDR, sends them the coordinates, the access notes, the splice records for that segment, and the two SLA-backed customers to prioritize after restoration. The ETA comes back at 47 minutes.
Twilio connector sends an SMS to the 320 contacts: fibre damage, splicer dispatched, ETA to restoration, status page URL. Cost preview shown, approval, send.
The break is on a council verge. Copilot drafts the incident notice through Gmail to the municipal roads liaison with the coordinates, the expected splicer arrival, and the work that may be needed.
Publish an Identified incident on Statuspage. Open the `#fiber-ops` thread with the map, the subscriber count, the splicer, the ETA.
The splicer confirms the break location via chat, sends a photo to the thread, starts the splice. Copilot tracks elapsed time and posts the progress into `#fiber-ops` and Statuspage.
Splice complete. OTDR re-trace shows clean continuity. Copilot runs ping against a sample of downstream subscriber CPEs through LibreNMS, confirms restoration, fires the all-clear SMS.
Statuspage marked Resolved with the restoration time. `#fiber-ops` gets the incident timeline as a closing note. Post-mortem task auto-created in the PSA for the engineering review.
## Where Studio earns its keep
* OTDR distance becomes GPS coordinates in the same workspace where the splicer is dispatched — no engineer reading off one map and typing into another.
* The SMS list comes from the GIS join, so every subscriber in the affected segment gets told and no one outside it does.
* The municipality and the splicer see the same location evidence, which makes the road-access conversation five minutes instead of thirty.
* The restoration evidence — OTDR trace, sample pings, timestamps — is the post-mortem artifact without anyone writing it.
## Related
OTDR monitoring, GIS, Maps, Twilio, and Splynx as connector calls.
Bring the splicer into the thread with presence and photo sharing.
# New PON deployment: 64 subscribers from site approval to first login
Source: https://altostrat.io/docs/studio/en/use-cases/isp/pon-deployment
Plan, order, configure, and activate a 64-subscriber GPON tree — OLT provisioning, splicer dispatch, subscriber provisioning in BSS and RADIUS, welcome emails, truck-rolls scheduled.
A municipal fiber build opens a new subdivision with 64 pre-sold subscribers. The ISP runs the full deployment inside Studio: OLT configuration, splicer dispatch, subscriber records in the BSS, service profiles on the RADIUS server, install tickets auto-issued, and subscriber welcome emails timed to each install.
## Systems involved
| System | Role |
| ------------------------------ | -------------------------------------------- |
| Studio inventory | The new OLT and per-subscriber ONT entries. |
| Calix / Nokia / Huawei OLT CLI | PON tree provisioning. |
| FAT / splice panel records | Drop-cable assignments per subscriber. |
| Splynx / Sonar BSS | Subscriber record, billing, product mapping. |
| FreeRADIUS / Radiator | Authentication profile per subscriber. |
| Google Calendar | Splicer and install-tech scheduling. |
| Gmail | Welcome email with account and WiFi details. |
| Customer portal | Self-service login. |
| Studio Procedures | `New PON tree provisioning` runbook. |
## Walkthrough
Copilot imports the FAT plan: 2 splitters, 1:32 ratio, 64 planned drop fibres. The OLT and PON port are picked from available capacity. The plan becomes a Studio diagram with subscriber IDs at each drop.
The procurement connector orders 64 GPON ONTs and the splice-on-connector drops. The shipment tracking lands in the project channel.
SSH into the OLT. Copilot stages the PON port config, the splitter entries, and the bandwidth profiles for the service tiers. Stage appears in the staging panel, reviewed, pushed.
Schedule the splicer through Google Calendar with the FAT records attached. The splicer is briefed with which subscribers map to which ports and which fibers are reserved.
Through the Splynx connector, create 64 subscriber records with service product, static IPv4 mapping, IPv6 prefix delegation, and contact details — all from the pre-sale CSV the sales team handed over.
The BSS push writes to RADIUS automatically. Copilot spot-checks five subscribers to confirm the bandwidth rate-limit, the static framed-IP, and the session-timeout match the service tier.
Generate one install ticket per subscriber in the PSA. Each ticket carries the ONT serial, the drop number, the subscriber's contact, the scheduled window, and the install procedure.
As each install tech activates an ONT, Copilot watches the OLT for the ONT registration, marks the ticket in-progress, and when RADIUS authenticates the session, fires the subscriber's welcome email through Gmail with login, portal URL, and WiFi default credentials.
At the end of the go-live week, generate the deployment report: 64 subscribers, first-login rate, install-duration distribution, exceptions. PDF to the project sponsor, and the runbook is saved for the next tree.
## Where Studio earns its keep
* The OLT config, the subscriber records, the RADIUS profiles, and the install tickets all come out of the same source data — no triple-entry between planning, BSS, and ticketing.
* The install tech's ticket tells them the ONT serial, the drop fibre, and the subscriber's preferred activation time in one line.
* Subscriber welcome emails go out the moment RADIUS authenticates, not the next business day when someone pulls a report.
* The deployment report is the artifact the municipality will ask for next quarter — and it's already written.
## Related
OLT and per-subscriber ONT inventory with folder structure.
`New PON tree provisioning` with the tree ID as the argument.
# Subscriber data-usage dispute: RADIUS evidence to credit note
Source: https://altostrat.io/docs/studio/en/use-cases/isp/subscriber-data-dispute
A subscriber disputes their data-usage bill. Pull the RADIUS accounting records, cross-check NetFlow, present the evidence, make the right call, and issue a credit note cleanly.
A subscriber claims their 400 GB bill is wrong — they insist their household used "a fraction" of that. The ISP needs to pull RADIUS accounting, cross-check against NetFlow, present the subscriber with evidence, and — when the facts warrant it — issue a credit note without drama.
## Systems involved
| System | Role |
| ----------------------------------- | ------------------------------------------- |
| Kayako / Freshdesk | Ticket from the disputing subscriber. |
| FreeRADIUS / Radiator | Accounting records with start, stop, bytes. |
| NetFlow / IPFIX collector | Per-flow detail for the subscriber session. |
| Splynx / Sonar | Subscriber record, service tier, data cap. |
| Billing connector (Splynx / Stripe) | Credit note issuance. |
| Gmail | Subscriber-facing evidence and resolution. |
| Studio artifacts | Evidence PDF attached to the resolution. |
## Walkthrough
Copilot pulls the ticket text, the subscriber account ID, the disputed period, and the bill line items.
Query the RADIUS accounting database for the subscriber's username. Aggregate Acct-Input-Octets and Acct-Output-Octets by day across the month. Export to a table artifact.
Pull the NetFlow records for the subscriber's assigned IP range across the same period. The totals match within 1.2 percent — not a counter-rollover issue, not a double-count.
Two days stand out: 87 GB on one Tuesday evening, 124 GB on one Saturday morning. NetFlow shows both hitting a popular streaming CDN and a backup service destination. The pattern is real usage, not a counter bug.
Copilot validates there was no session hijack, no flapping session, and no double-count from a duplicate NAS entry. RADIUS shows a single session per day with normal accounting intervals.
Generate a Markdown evidence artifact: daily totals table, the two anomaly days, top destinations for those days (provider only — redacted for privacy), the service cap, the overage calculation. Rendered to PDF.
Copilot drafts the subscriber email through Gmail: we investigated, here's the evidence, here's what actually used the data, here's what we're willing to do about it — a one-time courtesy credit of the overage on condition of moving to a higher tier. Reviewed by a supervisor before send.
If the subscriber agrees, the billing connector issues the credit note and the tier change. The ticket closes with the evidence PDF and the credit-note number attached.
## Where Studio earns its keep
* The evidence is sourced twice — RADIUS and NetFlow — so the conversation is about the facts, not about whether our logs are trustworthy.
* The anomaly days come out of the data in a sentence, which is easier to discuss than a spreadsheet of bytes.
* The billing action and the customer email reference the same evidence PDF, so the paper trail is one click long.
* The same evidence template is reusable for every future dispute — and the procedure that produced it is saved for next time.
## Related
Generate the subscriber-facing evidence PDF inline in the workspace.
Save `Data usage dispute evidence` as a parameterized runbook.
# Upstream provider outage: bulk customer comms in one workflow
Source: https://altostrat.io/docs/studio/en/use-cases/isp/upstream-outage
Multiple monitoring triggers light up. Confirm the outage is upstream, open a carrier ticket, update the IVR, bulk-SMS subscribers in the affected region, run a status page update, and keep a Slack war room alive.
At 18:47 Zabbix raises 43 subscriber-facing triggers and two core BGP-session-down alerts. The ISP's NOC needs to prove in three minutes that the problem is upstream, open a trouble ticket with the carrier, warn subscribers before the call volume spikes, and run a structured war room until the session is back.
## Systems involved
| System | Role |
| ----------------------------- | -------------------------------------------- |
| Zabbix / LibreNMS | Flood of subscriber and core triggers. |
| BGP looking glass | Confirm the peer outage externally. |
| SSH to core routers | Local state, show bgp summary, neighbor log. |
| Carrier trouble-ticket portal | Open a formal ticket with the upstream NOC. |
| Twilio / Bulk SMS | Subscriber outbound SMS. |
| IVR provider (Asterisk / 3CX) | Update the on-hold message. |
| Atlassian Statuspage | Public status page. |
| Slack `#noc-war-room` | Live operational channel. |
| Splynx / Sonar BSS | Subscriber affected-region lookup. |
## Walkthrough
Copilot groups the Zabbix triggers by root cause — 41 of 43 are downstream symptoms of the two core BGP neighbor drops. The two that aren't are unrelated customer-side issues.
Copilot runs the SSH procedure: `show bgp summary` on both core routers, `show log | include bgp` on each. Both show the neighbor reset reason as received-from-neighbor, matching a carrier-side event. The looking glass connector confirms the carrier's own prefix advertisements are withdrawn.
Through the carrier's trouble-ticket connector (or email if there's no API), Copilot drafts a ticket with: peer IPs, your ASN, the carrier ASN, timestamps in UTC, the two local log snippets, and a callback phone. Opened and ticket number captured.
Query Splynx for subscribers whose last-mile depends on the affected upstream paths. 4,812 subscribers across three regions. Copilot groups them by region and prepares the outbound SMS list.
Twilio connector sends a terse SMS: cause (upstream carrier), scope (region), ETA (updating), status page URL. Approval prompt shows the SMS count and approximate cost before send.
SSH into the Asterisk dialplan. Swap the on-hold message to the outage notice. Calls landing in the support queue now hear the same message the SMS says.
Push an Identified incident to the Atlassian Statuspage with the affected components, the upstream cause, and the carrier ticket reference (not the ticket number — for security).
Copilot opens a Slack thread in `#noc-war-room` with the timeline, the carrier ticket, the affected subscriber count, the last update time. Updates to the thread auto-propagate to Statuspage and the on-hold message.
Copilot polls the BGP sessions every 60 seconds. When both peers come back up and prefixes re-populate, the all-clear fires — SMS goes out, IVR reverts, Statuspage closes, Slack thread gets the resolution summary and a commitment for the post-mortem.
## Where Studio earns its keep
* The 43-alarm flood becomes one root cause in two minutes, not thirty minutes of triage.
* Subscriber SMS, IVR, and status page update in parallel instead of waiting for whoever remembers each one.
* The carrier ticket references the same timestamps the local logs have, which speeds the carrier's side of the investigation.
* The all-clear closes every external comms channel the same way it opened them — no stale status page messages at 04:00.
## Related
Planning mode for the bulk SMS approval — the cost and scope need to be visible.
`Upstream outage response` with region as an argument.
# Cisco IOS-XE firmware upgrade across 12 sites with change approval
Source: https://altostrat.io/docs/studio/en/use-cases/msp/cisco-firmware-multisite
Plan, approve, schedule, and execute a fleet firmware upgrade — Jira change request, Freshservice approval, Slack war room, staged maintenance windows, post-upgrade verification, CMDB sync.
Cisco PSIRT publishes an advisory affecting the IOS-XE 17.x train running on twelve customer-edge ISR routers. The MSP needs the upgrade staged, approved, executed across twelve maintenance windows, validated, and documented — with the customer informed before, during, and after each window.
## Systems involved
| System | Role |
| ------------------------- | -------------------------------------------------------- |
| Jira | Source change request from the security team. |
| Freshservice | Customer-facing CR with approvals and CAB sign-off. |
| Studio inventory | The twelve target hosts, organized by customer and site. |
| Cisco IOS-XE | The actual upgrade target. |
| TFTP / SCP | Image staging path. |
| Slack `#fleet-upgrade-q2` | Operational channel during each window. |
| ConnectWise PSA / NetBox | CMDB updated with new firmware version per device. |
| Gmail | Pre- and post-window customer comms. |
## Walkthrough
Copilot reads the Jira CR, lists every host tagged `cisco-edge` in inventory matching the affected version, and drafts a per-customer table with current version, target version, and the right maintenance window.
The Freshservice connector creates one CR per customer. Each contains the affected device, the maintenance window, the rollback path, the contact tree, and the Jira advisory link. CAB approves five at a time.
Copilot drafts a per-customer email through Gmail 24 hours before each window: scope, expected outage, contact phone, post-window verification commitment. You review and queue.
Copilot pushes the IOS-XE image to the local SCP server and verifies the MD5 against Cisco's published hash. If a customer's edge can't reach the central SCP, it picks the local jump host instead.
At T-15 minutes for each window, Copilot opens a Slack thread in `#fleet-upgrade-q2`, posts the device, the customer, the rollback command set, and the on-call name. Anyone joining sees the same context.
The `Cisco IOS-XE upgrade` procedure runs against the host. Pre-checks: reachability, free flash, backup config to TFTP, save running-config. Stage commands appear in the staging panel for approval. After approval the upgrade runs, the device reloads, and the procedure waits for the OOB SSH path to come back.
Procedure runs `show version`, `show ip interface brief`, `show bgp summary`, and the customer-specific functional check. A diff of pre and post output is attached to the run.
Copilot updates the ConnectWise/NetBox entry with the new firmware version and the upgrade timestamp. The Freshservice CR is closed with the diff artifact attached, and a closing email goes to the customer with the validation snippets.
## Where Studio earns its keep
* One procedure runs against twelve hosts the same way every time, so the worst window is the same as the best.
* The pre-checks are non-negotiable — Studio refuses to push the image if free flash is short or the backup didn't complete.
* The war room thread captures the exact commands, decisions, and outputs without anyone copying terminal scrollback.
* The CMDB and the customer email both update from the same source of truth, so no one is asking which version is now running.
## Related
Build the IOS-XE upgrade procedure once and run it per host.
Bring a peer into the upgrade window for two-person verification on the highest-risk devices.
# Compromised account: alert to containment to incident report
Source: https://altostrat.io/docs/studio/en/use-cases/msp/compromised-account
A Microsoft Defender alert flags impossible-travel sign-ins for a customer admin account. Verify, contain across cloud and network, capture forensics, file the IR ticket, and brief the customer.
Microsoft Defender for Identity raises a high-severity alert on a customer's domain admin account: sign-ins from two countries within an hour. The on-call MSP engineer needs to confirm scope, kill the active session everywhere it lives, capture evidence, file the incident report, and have the customer's CISO informed before they read about it on the internet.
## Systems involved
| System | Role |
| ----------------------------- | --------------------------------------------------------- |
| Microsoft Defender / Sentinel | Source alert with signals and timeline. |
| Microsoft Entra ID (Azure AD) | Disable account, revoke sessions and tokens. |
| Studio terminal | Pull RADIUS accounting, switch port logs, firewall rules. |
| RADIUS server | Identify NAS and active sessions, send CoA disconnects. |
| FortiGate / Palo Alto | Block source IPs and revoke VPN tokens. |
| Microsoft Teams `#sec-ir` | Internal IR channel. |
| ServiceNow IRM | Customer-facing incident record. |
| Gmail / Outlook | Customer CISO and on-call notification. |
| Studio Procedures | `Account compromise containment` runbook. |
## Walkthrough
Copilot fetches the alert via the Microsoft Graph connector, pulls the username, signed-in IPs, devices, and the recent token activity, and times the events on a single timeline.
In parallel, Copilot queries the RADIUS accounting log for the same username, the VPN appliance for active tunnels, and the customer's M365 audit log for sensitive operations in the last six hours. The footprint becomes obvious in one view.
Through the Graph connector, disable the account, revoke all sessions, and reset the credential. Approval prompt appears once with the exact account name, customer tenant, and revocation count. You approve.
SSH into the RADIUS server. Send a CoA disconnect for the active sessions. The procedure captures the disconnect ACKs from each NAS for evidence.
Push a deny rule for the suspicious source IPs at the customer's FortiGate via SSH. Revoke any VPN tokens for the user. The same IPs get flagged in the firewall's threat feed for one week.
Copilot pulls 24 hours of Entra sign-in logs, M365 audit log entries, RADIUS accounting, and firewall session history into a single Markdown report artifact, with hashes and source timestamps preserved.
Through the ServiceNow IRM connector, open an incident with severity High, attach the report artifact, set the customer contact, and link the original Defender alert.
Copilot drafts a one-screen email to the customer CISO and on-call: what happened, what we did, what's left to do, expected next update time. Reviewed and sent.
Post the timeline in `#sec-ir` Teams. The next-shift IR analyst inherits the incident with full context — alert, containment, evidence, customer status — without you walking them through it.
## Where Studio earns its keep
* The Defender alert, RADIUS log, M365 audit, and firewall view sit on one timeline instead of in five tabs.
* Containment in Entra and on the network happens from the same workspace, with one approval per destructive action and one record of what changed.
* The forensic report writes itself from sources Copilot already pulled — you don't reconstruct the timeline by hand.
* The customer CISO email goes out before the customer's monitoring tools page their on-call.
## Related
Where credentials and approvals sit during destructive actions.
Save this as `Account compromise containment` for the next time.
# Onboard a new MSP customer fleet
Source: https://altostrat.io/docs/studio/en/use-cases/msp/customer-onboarding
Take a customer's CSV inventory and a contract handoff, and turn it into a discovered, monitored, backed-up, documented, and team-briefed managed environment within the day.
A new MSP customer signs. Sales hands over a CSV with 84 devices, vague vendor info, a couple of admin credentials, and a contract start date in seven days. The goal is to land Monday with inventory imported, devices discovered and fingerprinted, configs backed up, monitoring up, the customer's runbook drafted, and the on-call team briefed.
## Systems involved
| System | Role |
| ------------------------- | ------------------------------------------------ |
| Studio inventory | Bulk host import and folder structure. |
| SNMP, LLDP, CDP | Auto-discovery of vendor, model, OS, neighbors. |
| Studio diagrams | Topology drawn from inventory + neighbor data. |
| Configuration backup repo | Pull initial configs to S3-backed storage. |
| Zabbix or LibreNMS | Apply monitoring templates to each device class. |
| ConnectWise PSA | Customer record, contract, and contact tree. |
| NetBox or Device42 | Source of truth for circuits, IPs, and racks. |
| Slack `#cust-acme-corp` | Team briefing channel. |
| Loom-style shared session | Walk the team through the new environment. |
## Walkthrough
Create a `Customers / ACME Corp` folder. Paste or import the CSV. Studio creates one host per row, attaches placeholder protocols, and flags rows missing required fields.
Create one Key Chain entry per credential the customer provided. Set the entry on the folder so every host inherits it. Per-host overrides are added later for the few exceptions.
From the folder context menu, run `Detect device` on every host. Studio reads SSH banners, runs vendor-safe probes, and fills vendor, OS, and version into the inventory. The handful that fail get reviewed by hand.
Copilot runs LLDP and CDP discovery from each switch. The neighbor table feeds an autogenerated network diagram with sites, edges, distribution, and access tiers.
A `Initial config backup` procedure runs against each network device, captures the running and startup config, and stores it in the customer's S3 backup bucket with a timestamped filename and a SHA hash.
Through the Zabbix (or LibreNMS) connector, Copilot applies the right template per detected vendor and class — Cisco edge, MikroTik access, Linux server, ESXi host, MikroTik AP. Triggers and thresholds are reviewed for the customer's tolerance.
Promote the discovery + backup work into a `Customer health check` procedure for ACME, parameterized with site code. Save memories: Internet provider, business hours, after-hours contacts, change windows, customer-specific quirks.
Sync devices and contacts into ConnectWise PSA. Push the topology and IP plan into NetBox so circuit IDs, racks, and prefixes are documented from day one.
Open a shared session, screen-share the inventory, the topology diagram, and the customer runbook. Record it. Drop the recording into the customer folder for anyone who joins later.
## Where Studio earns its keep
* 84 devices go from a CSV to fingerprinted, monitored, backed up, and documented in hours, not days.
* The diagram, the monitoring config, the backup repository, and the PSA all reference the same inventory, so there is one source of truth from the first day.
* The recorded shared-session briefing is the on-boarding artifact every future on-call engineer can play back.
* The customer runbook procedure is reusable across customers — change the site code and the structure stays the same.
## Related
Folder structure, bulk import, and Key Chain inheritance.
Generate the topology from inventory and discovery output.
# End-of-life hardware refresh: vuln scan to install date
Source: https://altostrat.io/docs/studio/en/use-cases/msp/eol-hardware-refresh
A vulnerability scan flags an EOL Catalyst 2960. Build the replacement BOM, request quotes from three vendors, win customer approval, schedule the install, and dispatch a field tech with the right gear.
A monthly vulnerability scan flags six Catalyst 2960-X switches at a customer's two branches as past Cisco's last day of support. The MSP needs a replacement plan that the customer will fund, sourced gear that's actually in stock, an install scheduled for an after-hours window, and a field tech booked with the new switches in their van.
## Systems involved
| System | Role |
| ------------------------------------------ | -------------------------------------------------------------- |
| Tenable / Qualys / Wazuh | Source vulnerability scan with the EOL findings. |
| Studio inventory | The six target devices with site, port count, current uplinks. |
| Cisco EOL data | Confirm the model's EOL/EOS dates and recommended replacement. |
| Distributor APIs (Synnex, Ingram, Westcon) | Quote and stock check across three distributors. |
| ConnectWise PSA | Customer record, opportunity, project, and dispatch. |
| Gmail | Customer-facing quote, approval, and confirmation email. |
| Google Calendar | Maintenance window and field tech schedule. |
| FedEx / DHL | Shipment tracking attached to the ticket. |
## Walkthrough
Copilot fetches the scan result via the connector. Six devices, two sites, current model, last day of support already past, recommended successor `C9200L-24P-4G-E`.
For each target device, Copilot SSHes in and captures `show inventory`, `show interface status`, current PoE budget, uplink configuration, VLAN list, and the AAA configuration. The replacement BOM has to match what's actually installed, not what was ordered three years ago.
Copilot drafts the BOM as a Markdown table: model, accessories, transceivers (matched to the existing fiber types), power cords, rack ears, smartnet term, and a per-site quantity. Reviewed and approved by the account engineer.
Through the distributor connectors, request stock and price for the BOM. Two come back same-day. The third needs a manual follow-up email — Copilot drafts it through Gmail.
The proposal artifact bundles the EOL evidence, the BOM, the three quotes, recommended distributor, lead time, install labor, and the proposed maintenance window. Sent through Gmail with a one-page Markdown summary at the top.
Customer replies with approval and a PO. Copilot files the PO into the PSA opportunity, marks it Won, and creates the project with the install tasks pre-populated.
The distributor connector places the order. The shipment tracking number lands in the PSA project. Copilot watches the FedEx connector and posts updates to the project as the gear moves.
Once delivery is confirmed, Copilot opens a Google Calendar event for the maintenance window, books the field tech, attaches the install runbook, and sends the customer the maintenance notice email through Gmail with the contact tree.
Before the window, Copilot generates each new switch's config from the captured old-switch state, validates it against the customer's standards, and stores it in the project for the field tech to push from the console port.
## Where Studio earns its keep
* The replacement BOM is built from the actual current state of each device, not a guess from a procurement spreadsheet.
* Three distributors are quoted in parallel and the results land beside each other for a clean side-by-side decision.
* The customer proposal, the PO, the shipment, the install schedule, and the pre-staged configs all carry the same project ID end to end.
* Field-tech day one is opening the new switch with a known-good config sitting in the project, not improvising at 2 a.m.
## Related
Distributor APIs, FedEx tracking, and Gmail are all connector calls.
Save the install runbook so the next refresh project drops in cleanly.
# Weekly executive report for managed customers
Source: https://altostrat.io/docs/studio/en/use-cases/msp/executive-weekly-report
Pull the week's uptime, ticket backlog, change activity, backup health, and security posture from the systems they live in, then deliver a customer-ready PDF and a Teams summary every Monday at 09:00.
Every customer with a managed services contract gets a Monday report covering the prior week. The MSP needs to produce twelve customer reports — uptime, ticket throughput, changes executed, backup posture, security incidents — without an analyst spending their morning copying numbers into PowerPoint.
## Systems involved
| System | Role |
| ----------------------------- | ------------------------------------------------------- |
| Zabbix / LibreNMS | Uptime and SLA percentages per site and device class. |
| ConnectWise PSA / Halo | Ticket open, close, and SLA breach counts. |
| Datto / Veeam | Backup job status, RPO and RTO posture. |
| Microsoft Defender / Sentinel | Security incidents and posture changes. |
| Cloudflare / status checks | Customer public site availability. |
| Studio Procedures | The `Customer weekly report` runbook. |
| Gmail / Outlook | Delivery to the customer's CTO and account owner. |
| Microsoft Teams | Customer-shared channel and internal `#weekly-reports`. |
| Google Drive / SharePoint | Archive of every report sent. |
## Walkthrough
The `Customer weekly report` procedure takes a customer code as the only argument. It runs in parallel for the twelve customers on Monday at 06:00.
For each customer, Copilot calls Zabbix for uptime, the PSA for ticket counts and SLA, Datto for backup health, Defender for security signals, and the public-site checker for customer-facing availability.
The procedure compares against the prior week and flags meaningful deltas — a 3 percent SLA drop, a backup that hasn't run in 48 hours, an open incident, a ticket trend going the wrong way.
Copilot writes a Markdown report with the uptime table, ticket breakdown, change list, backup matrix, security summary, recommendations, and an executive summary at the top. The report renders as a clean PDF.
The procedure pauses for a human review before delivery. The account engineer scans the twelve reports, edits commentary where the data needs context, and approves.
Each PDF goes through Gmail to the customer CTO and account owner with a short cover note. The same report is posted in the customer-shared Teams channel as a pinned message for the week.
A condensed roll-up — twelve customers, key risks, actions required this week — is posted in the internal `#weekly-reports` channel so the team starts the week with the same picture.
Each report is filed in the customer's SharePoint folder with a date-stamped filename for the next QBR pack.
## Where Studio earns its keep
* One procedure produces twelve consistent customer reports without an analyst opening five dashboards twelve times.
* The numbers come from the source systems, not a stale CRM field someone forgot to update.
* The deltas surface what's worth talking about — the report leads with the things the customer should care about.
* The same artifact reaches the customer email, the shared Teams channel, and the QBR archive in one delivery.
## Related
Author `Customer weekly report` once and run it per customer code.
How generated reports flow back into the workspace and out to customers.
# MFA enforcement rollout to a 200-user customer
Source: https://altostrat.io/docs/studio/en/use-cases/msp/mfa-enforcement
Move a customer's 200 users from optional to enforced MFA — pull the user list, stage the conditional access policy, communicate by phase, watch enrolment rate, and close the compliance loop.
A customer's cyber insurance now requires enforced MFA on every account by month-end. The MSP runs the rollout: pull the live user list, classify by department and exception, stage the Conditional Access policy, communicate before each phase, watch enrolment progress, and produce the compliance report the insurer wants.
## Systems involved
| System | Role |
| ----------------------------- | ----------------------------------------------------------- |
| BambooHR / Workday | Authoritative employee list, department, manager. |
| Microsoft Entra ID | Where MFA is enforced. |
| Conditional Access | The policy controlling which accounts and apps require MFA. |
| Gmail / Outlook | Pre-rollout, mid-rollout, and reminder emails to users. |
| Microsoft Teams `#it-support` | Helpdesk channel for the rollout week. |
| ConnectWise PSA | Project tracking for the rollout phases. |
| Power BI / Looker | Compliance dashboard for the customer CIO. |
## Walkthrough
Copilot reads BambooHR for active employees, reads Entra ID for active accounts, and reconciles the two into one master list with department, manager, account status, and current MFA enrolment state.
Service accounts, shared mailboxes, on-leave users, and break-glass accounts get tagged. Copilot flags 14 exceptions that need explicit policy carve-outs and writes them into a Markdown table for the customer to sign off.
Through the Graph connector, draft the policy: scope by group, require MFA for all cloud apps, exclude break-glass group, exclude service principals. Copilot shows the draft policy as a JSON artifact for review before push.
Pull the IT department first. Copilot sends a personalized email through Gmail: why, when, what to do, link to the enrolment guide, escalation contact. Each user gets the right manager copied.
The CA policy goes live in report-only mode for the IT phase. Copilot pulls the sign-in logs after 24 hours, finds the legacy OAuth client one user is on, and flags it for remediation before enforcement.
Copilot opens a `#it-support` Teams channel for the rollout week, posts the FAQ and the enrolment guide, and pins them. Helpdesk tickets that mention MFA get a canned first response with the guide link.
Phase by phase — Sales, Engineering, Operations, Finance — Copilot repeats the email, the report-only window, the legacy-app fix, and the enforcement flip. After each phase the enrolment dashboard updates.
Three days before the deadline, Copilot finds every account not enrolled, drafts a personalized reminder through their manager, and updates the PSA with each holdout's status.
Generate the compliance report: total users, enforced, exceptions, evidence of enrolment, evidence of policy state. PDF goes to the customer CIO and into the cyber-insurance evidence pack.
## Where Studio earns its keep
* The user list is reconciled across BambooHR and Entra in one query, not exported and joined in Excel.
* The phased communication uses the same source of truth all the way through, so no one gets emailed twice or skipped.
* Report-only mode catches legacy OAuth issues before users start calling the helpdesk angry.
* The compliance report writes itself from the policy state, the enrolment data, and the exception sign-off — not pulled together at midnight before the audit.
## Related
Microsoft Graph, BambooHR, Gmail, and Teams as Copilot tools.
Promote this rollout into a procedure for the next customer.
# Office 365 outage triage and bulk customer comms
Source: https://altostrat.io/docs/studio/en/use-cases/msp/office365-outage-triage
A PRTG sensor flips red across multiple managed customers. Confirm the upstream nature of the outage, broadcast it once, and update every affected ticket without typing the same sentence forty times.
PRTG sends a red sensor for "M365 Auth Latency" against three different customer probes within five minutes. The on-call MSP engineer needs to know if it's the customers' networks or Microsoft — and if it's Microsoft, get one consistent message in front of every customer before the phones start ringing.
## Systems involved
| System | Role |
| ---------------------------- | ----------------------------------------------------------------------------- |
| PRTG | Source alarm and sensor history. |
| Studio diagnostics | Ping, traceroute, DNS, and HTTPS path checks against `outlook.office365.com`. |
| Microsoft 365 Service Health | Confirm whether Microsoft has acknowledged an incident. |
| Halo PSA / ConnectWise | Bulk-update affected customer tickets. |
| Microsoft Teams | Internal `#noc` channel and customer-shared channels. |
| StatusPage.io | Public status page update. |
| Gmail / Outlook | Customer comms with technical contacts. |
## Walkthrough
Copilot pulls the three sensors and their history. They started failing within 90 seconds of each other across three different customer probes — not a customer-side coincidence.
Copilot runs a parallel diagnostic sweep: ping and HTTPS probe against `outlook.office365.com`, `login.microsoftonline.com`, and `graph.microsoft.com` from each customer probe via SSH. All three customers have a clean Internet path; Microsoft endpoints respond slowly or 5xx.
Copilot calls the Microsoft 365 Service Health connector. There is an acknowledged incident `EX{number}` for Exchange Online authentication, scope global. That settles the diagnosis.
Copilot drafts a short customer-facing message: cause (Microsoft incident), scope (Exchange auth), what's affected (Outlook, OWA), what isn't (Teams chat, SharePoint), workaround (existing sessions still work), the Microsoft incident ID, and the next update time.
The PSA connector lists every open ticket in the last 60 minutes that mentions Outlook, M365, or "email is slow." Copilot stages a bulk update with the message, links the Microsoft incident, and pauses for approval. You scan the list, untick two unrelated tickets, approve.
For customers with a shared Teams channel, Copilot posts the same message tagged to the right contacts. The message sticks at the top of each channel for visibility.
The StatusPage.io connector publishes a Monitoring incident pointing at the Microsoft outage and links the upstream Microsoft advisory.
Copilot adds a 30-minute follow-up reminder. When the timer fires, it re-checks Service Health, the PRTG sensors, and updates the same channels with progress or an all-clear.
## Where Studio earns its keep
* One diagnostic run touches every customer probe at once — no SSH-jumping between consoles to confirm a global pattern.
* The same message reaches the PSA, Teams, and the status page with one approval, instead of forty manual posts.
* The follow-up loop is automatic: the 30-minute check happens whether you remember it or not.
* The all-clear closes every ticket and posts a final status without you composing it three times.
## Related
Use Planning when the bulk update needs a careful review before it goes out.
How PRTG, the PSA, Microsoft Service Health, Teams, and StatusPage.io are reachable.
# Dell R720 disk failure: Kayako to RMA in one workspace
Source: https://altostrat.io/docs/studio/en/use-cases/msp/r720-disk-failure
Triage a Kayako ticket, confirm a failed disk on a Dell PowerEdge R720 over iDRAC, file the warranty RMA with Dell ProSupport, and book datacenter access — without leaving Studio.
A Kayako ticket lands at 02:14 from a customer at the colo: their file server feels slow and a red LED is flashing on the chassis. The on-call MSP engineer triages from one Studio window: the ticket, Zabbix history, iDRAC, the vendor RMA email, the calendar entry for the datacenter walk, and the customer reply.
## Systems involved
| System | Role |
| ----------------------- | ----------------------------------------------------------------------- |
| Kayako | Source ticket and final customer reply. |
| Zabbix | Confirm the alert history and rule out a transient blip. |
| Dell iDRAC9 | Look at storage controller, identify the failed physical disk. |
| Dell ProSupport (Gmail) | File the RMA email with serial, service tag, slot, and error log. |
| Google Calendar | Book the datacenter access window with the colo's reception. |
| Slack `#noc` | Internal chatter and handoff to the morning shift. |
| Studio Memories | Save the colo access procedure and Dell warranty pattern for next time. |
## Walkthrough
Copilot pulls the Kayako thread via the connector. The customer message names the host (`fs-acme-01`), notes the chassis LED, and attaches a phone photo of the front panel.
Copilot queries Zabbix for the same host. The disk-health trigger fired three hours ago, predicate flapped twice in the last week, and IOPS dropped 40 percent at the same time. Not a one-off.
The Studio host entry for `fs-acme-01` already has an HTTPS protocol pointing at `idrac-fs-acme-01.colo.local` with the Key Chain credential attached. One click opens it in a tab. Storage → Physical Disks shows PD 0:1:3 in Failed state, predictive failure log present.
Right-click the iDRAC tab and ask Copilot to summarize. It pulls service tag, model (R720), iDRAC version, slot number, and the SMART error block into a Markdown report artifact stamped with the ticket ID.
Copilot drafts the RMA email through the Gmail connector — service tag, failed slot, error log, dispatch address, on-site contact name. You review the draft, fix the contact phone, and send.
Copilot creates a Google Calendar event for the swap window, invites the colo reception desk, and adds the asset list and access PIN to the description. The event is also posted in `#noc` for visibility.
Copilot drafts a status reply: failed disk confirmed, warranty RMA filed, replacement ETA from Dell, swap booked for the next window, no data loss expected (RAID6 still in degraded state). You review and send.
Promote the iDRAC capture path to a procedure called `Dell PowerEdge disk failure triage` with arguments for hostname, ticket ID, and slot. Save a memory: "Dell ProSupport RMA emails for ACME go to `dispatch-aps@dell.example` and require the colo PO number in the subject."
## Where Studio earns its keep
* The Kayako ticket, Zabbix history, and iDRAC view sit beside each other in the same workspace — not three browser tabs and a password manager.
* Copilot reads the iDRAC storage page and writes the structured RMA email instead of you copy-pasting service tags into Gmail.
* The procedure you save means the next R720 disk failure is a one-prompt run, not an hour of triage.
* The customer reply, vendor RMA, and calendar entry all reference the same ticket ID without you typing it more than once.
## Related
How Kayako, Zabbix, Gmail, and Calendar appear as Copilot tools.
Promote this workflow into a runbook the next on-call engineer just runs.
# Ransomware containment: alert to clean restore
Source: https://altostrat.io/docs/studio/en/use-cases/msp/ransomware-containment
A SIEM detection fires on lateral movement and SMB encryption activity. Contain the blast radius across cloud and network in minutes, snapshot evidence, restore from clean backups, and run the customer through a calm executive briefing.
Wazuh detects encryption-pattern file writes on three Windows file servers at a customer site, and Defender flags lateral SMB to two more. The MSP needs to contain the spread within minutes — at the switch, the firewall, and Entra ID — preserve evidence for the cyber-insurance investigation, restore the affected shares from clean backups, and have the customer's executive team in a structured call within the hour.
## Systems involved
| System | Role |
| ------------------------------------- | ------------------------------------------------------------- |
| Wazuh / Microsoft Defender / Sentinel | Source detections and timeline. |
| Studio terminal | SSH to access switches for port shutdown and VLAN quarantine. |
| FortiGate / Palo Alto | East-west and north-south containment rules. |
| Microsoft Entra ID | Disable suspect accounts, revoke sessions. |
| Veeam / Datto | Snapshot inventory, identify clean restore points. |
| VMware vCenter / Hyper-V | VM snapshot capture for forensics. |
| Microsoft Teams `#sec-ir` | Internal IR channel. |
| ServiceNow IRM | Customer incident record and case file. |
| Gmail | Customer executive comms and law-enforcement liaison. |
| Studio Procedures | `Ransomware containment` runbook. |
## Walkthrough
Copilot pulls the Wazuh and Defender alerts onto one timeline. The encryption pattern matches a known family, the source IP traces to a single contractor laptop on the guest VLAN, and SMB traffic to three file servers is active right now.
SSH to the access switch the contractor laptop is on. Copilot identifies the port from the MAC table and stages a `shutdown` and a VLAN move into the quarantine VLAN. Approval prompt; you approve and execute.
Push deny rules at the FortiGate between the guest VLAN and the file server VLAN. Block SMB to all of `10.10.20.0/24` from anything outside the file server segment for the duration of the incident.
Through the Graph connector, disable the contractor's account and the two service accounts seen in the lateral movement. Revoke all sessions and tokens. The action is logged with timestamps for the case file.
Through the vCenter connector, take a snapshot of each of the five affected VMs without rebooting them. The snapshots become the forensic image set for the investigators.
Through the Datto connector, list backups for the five servers. Copilot highlights the last verified-good restore points before the encryption pattern began and proposes the restore order: domain controllers and DNS first, then file servers, then dependent services.
Copilot opens the ServiceNow IRM record, attaches the alert evidence, the snapshot list, and the restore plan. Drafts a one-page executive briefing for the customer CEO and CIO: scope, containment status, restore plan, ETA, and the next update time.
Open a shared Studio session with the customer's executive team. Screen the timeline diagram, the containment status, and the restore plan. Recording on. The call ends with assigned actions and a 30-minute next-update commitment.
Trigger the Datto restore in the agreed order. After each restore, run the validation procedure: services back, AD healthy, file shares mounting, no encrypted-pattern writes recurring.
Hand the case file and the snapshot images to the appointed DFIR firm through the ServiceNow record. Internal `#sec-ir` channel keeps a running log for the rest of the incident lifecycle.
## Where Studio earns its keep
* Containment fires at the switch, the firewall, and Entra ID from one workspace in minutes — not from three engineers logging into three consoles.
* The restore order is a clean dependency plan, not a guess from a backup admin under pressure.
* The customer executive call has a screen they can read — timeline, status, plan, ETA — instead of a phone call about feelings.
* Every action is timestamped in the case file from the moment it ran. The cyber-insurance investigation has a proper paper trail without anyone reconstructing it.
## Related
Author `Ransomware containment` so the steps are pre-staged for the next time.
Bring the customer's exec team into a recorded session for the structured update.
# WiFi deployment from survey to customer report
Source: https://altostrat.io/docs/studio/en/use-cases/msp/wifi-deployment
Take an Ekahau predictive survey, provision the access points, validate coverage and throughput in the office, and deliver a before-and-after report the customer's office manager actually understands.
A new customer office moves into a 1,800 m² floor and needs WiFi 6E across the open plan, the meeting rooms, and the warehouse pick area. The MSP runs the Ekahau survey, configures the access points, validates the deployment with iperf and a walk test, and hands over a report the customer signs off on.
## Systems involved
| System | Role |
| ----------------------------------------------- | ------------------------------------------------------ |
| Ekahau / Hamina | Predictive and validation survey data. |
| Aruba Central / Cisco Meraki / UniFi Controller | AP provisioning and live state. |
| Studio terminal | SSH to the wireless controller for radio-level config. |
| iperf3 servers | Throughput test from the floor. |
| Studio diagrams | Floor plan with AP placement and coverage overlay. |
| ConnectWise PSA | Project tasks and field tech dispatch. |
| Gmail | Customer scoping and sign-off comms. |
| Microsoft Teams `#proj-acme-wifi` | Internal project channel. |
## Walkthrough
Copilot ingests the Ekahau plan: AP positions, signal targets, channel plan, transmit power, expected throughput per zone. The plan is converted into a Studio diagram with the floor plan as the background.
Generate the SSID config, the radio profile, the WPA3 RADIUS settings, and the per-AP overrides through the Aruba Central connector. Push the staging config to a test group first.
The tech mounts the APs at the planned coordinates. Each AP comes online and registers with the controller. Copilot watches the controller and posts in `#proj-acme-wifi` as each AP joins, with serial number and MAC.
The tech walks the floor with the validation survey app. Heatmap data uploads. Copilot compares against the predictive plan and flags any zone where measured signal is more than 6 dB below predicted.
From the warehouse pick stations, run iperf3 against the on-floor server. Copilot captures the per-station results, charts them against the SLA target, and flags the two stations with marginal performance.
SSH into the controller. Copilot suggests transmit power and channel adjustments for the two underperforming APs. Stage the changes, push, re-test.
Generate a Markdown artifact: floor plan with measured coverage overlay, per-zone signal table, throughput results, two before-and-after images, recommendations for any future expansion. Renders to PDF.
Email the report through Gmail to the customer's office manager and IT contact. Post the PDF in the project channel. Mark the PSA project complete with the artifact attached.
## Where Studio earns its keep
* The predictive plan, the validation data, and the controller config sit in one workspace, not three different vendor portals.
* The radio tuning happens against the same diagram the field tech is reading, so the changes are obvious and reversible.
* The customer report shows measured-against-promised, which is the only chart that matters at sign-off.
* The project channel captures the deployment as it happens — the next office for the same customer is a copy-and-tweak of this run.
## Related
Bring the floor plan in as a diagram background and overlay the AP placements.
Generate the customer-ready PDF inside the workspace.
# Use cases
Source: https://altostrat.io/docs/studio/en/use-cases/overview
Real workflows MSPs, ISPs, WISPs, and VoIP carriers run inside Studio — from a Kayako ticket to a closed customer comms loop, across terminal, ticketing, monitoring, server hardware, vendor RMA, and field dispatch.
These scenarios show Studio in real operating conditions. Each one starts where work actually starts — a ticket, an alarm, a customer call, a sales handoff — and walks the full path through diagnosis, action, vendor coordination, and customer communication until the loop is closed.
Studio is not the only system in any of these flows. Tickets still live in Kayako, ConnectWise, or Freshservice. Alarms still come from Zabbix, PRTG, or LibreNMS. Hardware still talks IPMI, iDRAC, and iLO. The point is that Studio sits in the middle of the working day and stitches those systems together with the terminal, the diagram, the runbook, and the AI that has the context.
## What these scenarios cover
Customer-facing helpdesk and field work — ticket triage, server hardware faults, security incidents, fleet upgrades, customer onboarding, executive reporting.
Subscriber networks at scale — upstream outages, DDoS, PON and fiber deployment, CGNAT, capacity planning, RADIUS disputes, CPE firmware.
Voice carriers and PBX operators — SIP and RTP issues, PSTN provisioning, E911 validation, STIR/SHAKEN, Teams Direct Routing, DR drills.
## How each scenario is structured
Every scenario uses the same shape so you can scan and compare:
| Section | What it covers |
| --------------------------- | ----------------------------------------------------------------------------------------- |
| Opener | The trigger and who's running it. |
| Systems involved | Every external platform, vendor system, or comms channel touched. |
| Walkthrough | Step-by-step from trigger to closed loop. |
| Where Studio earns its keep | The handful of moments Studio collapses what would otherwise be five tabs and three apps. |
## How Studio shows up across these flows
The same Studio surfaces appear across most scenarios:
* **Hosts and protocols** — SSH, Telnet, HTTPS, RDP, VNC, video stream, serial. One inventory, many ways in.
* **Copilot with connectors and MCP** — pull a Kayako ticket, query Zabbix, post in Slack, draft a Gmail reply, file a vendor RMA, book a Google Calendar slot.
* **Procedures** — promote a successful path into a parameterized runbook so the next person doesn't have to rediscover it.
* **Memories** — durable facts about a customer, site, or device so the next conversation starts informed.
* **Shared sessions and calls** — bring a teammate, a vendor, or a field tech into the same terminal and escalate to voice or video without leaving Studio.
* **Diagrams** — autogenerate site or topology diagrams from inventory and discovery so customer reports look professional with no extra effort.
* **Files and artifacts** — drop the post-mortem, the report, the config diff, the recording, the customer email back into the workspace where the work happened.
## A note on connectors
Most of the third-party systems referenced — Kayako, Zabbix, PRTG, LibreNMS, Freshservice, ConnectWise, ServiceNow, Slack, Microsoft Teams, Gmail, Outlook, Google Calendar, Twilio, Stripe, Splynx, Sonar, NetBox, FreePBX, 3CX, Bandwidth, Telnyx, iDRAC, iLO, Cloudflare, Datto, and so on — are reachable from Studio via [connectors or MCP servers](../connectors-and-mcp). You configure the integration once with your own credentials and Copilot calls it with approval. None of these are bundled vendor relationships; they are how Studio fits into the toolchain you already have.
## Where to start
If you only read three, read these:
1. [Dell R720 disk failure](./msp/r720-disk-failure) — the canonical MSP loop: ticket → monitoring → iDRAC → vendor RMA → datacenter access → customer.
2. [Upstream provider outage](./isp/upstream-outage) — the canonical ISP loop: many alarms → looking glass → carrier ticket → bulk customer comms → status page.
3. [One-way audio complaint](./voip/one-way-audio) — the canonical VoIP loop: ticket → call recording → SIP trace → SBC → firewall → validation → customer reply.
# E911 address validation campaign across the customer base
Source: https://altostrat.io/docs/studio/en/use-cases/voip/e911-validation
Pull every active DID, cross-reference E911 registered addresses with the address validation database, identify mismatches, ask subscribers to re-attest, and produce the regulator-ready compliance report.
The state PUC requires the carrier to demonstrate that every DID has a current, validated E911 dispatchable address on file. The carrier owns 84,000 DIDs across 11,000 subscribers. The campaign has to find the gaps, get subscribers to fix them, and produce the evidence — quietly, without breaking emergency service for anyone.
## Systems involved
| System | Role |
| --------------------------------- | -------------------------------------------------------------- |
| Carrier billing / OSS | Source list of active DIDs and the registered address per DID. |
| Intrado / Bandwidth E911 / RedSky | E911 registration system and address validation API. |
| USPS / address validation API | Authoritative address normalization. |
| Splynx / Sonar / homegrown CRM | Subscriber contact lookup. |
| Gmail / Outlook | Subscriber re-attestation request. |
| Twilio SMS | Reminder for non-responding subscribers. |
| Studio Procedures | `E911 validation campaign` runbook. |
| Files / SharePoint | Compliance evidence pack. |
## Walkthrough
Copilot pulls every active DID and joins to the registered E911 address from Intrado. The result is a row per DID with subscriber, location identifier, address-on-file, and last attestation date.
Each address is sent through the USPS validation API in batches. Three classes come back: validated, validated-with-corrections, and unable-to-validate. Counts: 78,300 / 4,200 / 1,500.
The 4,200 validated-with-corrections rows get a Markdown report listing the change. Routine corrections (zip-code +4, abbreviation expansion, casing) are auto-applied through Intrado after a sample review. Material changes go to subscriber re-attestation.
For the 1,500 unable-to-validate and the material-change subset, Copilot drafts personalised emails through Gmail with the address on file, the proposed correction, and a one-click portal link to confirm. Sent in batches of 200 to avoid overwhelming support.
After 7 days, Copilot finds subscribers who haven't responded and sends a Twilio SMS reminder. After 14 days, support follows up by phone.
Each response updates the master campaign table. Copilot maintains a live dashboard with response rate by region, by tier, by DID type.
For subscribers who have not responded by the deadline, the carrier must not break their 911 — the procedure flags them for a phone call from compliance, not a service suspension.
Generate the compliance artifact: total DIDs, validation breakdown, attestations received, evidence per subscriber, exceptions and remediation plan. PDF to the regulator and to the carrier's CCO.
## Where Studio earns its keep
* The DID list, the E911 registrations, and the validation API live in one workspace — no sequential exports across three systems.
* Subscriber re-attestation goes out personalised, with the actual data on the line, instead of as a generic "please verify your address" email.
* The non-responder workflow respects emergency service — the system does not casually disable 911 for someone who didn't open an email.
* The evidence pack is generated from the campaign state at any point in time, so the regulator's question is answered with a current PDF.
## Related
`E911 validation campaign` runs every quarter against the current DID list.
Intrado, USPS validation, Twilio, and Gmail as Copilot tools.
# Voice DR failover drill: scheduled, executed, validated, reverted
Source: https://altostrat.io/docs/studio/en/use-cases/voip/failover-drill
Run the quarterly disaster-recovery drill — fail the SBC and RADIUS to the secondary site, validate inbound and outbound voice, check 911 routing, fail back, and produce the compliance report.
The quarterly DR drill arrives. The voice carrier has to prove it can fail SBCs, RADIUS, and routing to the secondary site without dropping carrier-grade SLAs. The drill needs to be announced, executed, validated, reverted, and signed off — with the regulator's evidence pack assembled the same day.
## Systems involved
| System | Role |
| ------------------------------ | ----------------------------------------------------- |
| Studio Procedures | `Voice DR drill` runbook. |
| Primary SBC + Secondary SBC | Active and standby. |
| FreeRADIUS primary + secondary | Active and standby. |
| Anycast / DNS routing | Where carrier-side traffic is steered. |
| TestCallin / SIPp | Synthetic call generation for validation. |
| Bandwidth / Telnyx | Verify carrier sees the new SBC IP and accepts. |
| Microsoft Teams `#voice-ops` | Drill war room. |
| Gmail / Outlook | Pre-drill customer notice (large enterprise tenants). |
| Studio Files | Compliance evidence pack. |
## Walkthrough
72 hours before, Copilot drafts the customer notice through Gmail: drill window, expected impact (none), what to do if real symptoms appear, a single point of contact for the window. Sent to the enterprise tenant contacts.
At T-15 minutes, open the `#voice-ops` Teams thread with the drill checklist, the rollback path, the on-call names, and the validation criteria. The drill procedure starts.
Copilot snapshots: active calls per SBC, RADIUS auth rate, carrier-side reachability checks, the current Anycast announcement state. The snapshot is the baseline for validation.
Through SSH and the routing connector, withdraw the primary SBC's Anycast announcement. The secondary becomes preferred. Existing calls on the primary continue; new calls land on the secondary within 30 seconds.
Stop the primary RADIUS. The secondary takes over. Auth rate stays inside SLA. The procedure captures the failover transition time.
Run a TestCallin sweep: inbound on five test DIDs, outbound to five test endpoints, both with and without media. Bidirectional audio confirmed in all cases.
The single most important test. Place a 911 test call from a test endpoint with a known address. Confirm it routes to the test PSAP for the address, not to a stale primary-site path.
Stay on the secondary for the contracted soak window (often 2 hours). Watch every metric. Anything outside SLA terminates the drill into rollback and is documented.
Reverse the procedure: re-announce the primary, restart RADIUS primary, validate. Capture the restoration time and the call-continuity status.
Generate the drill evidence: timeline, snapshots, validation results, soak-window metrics, 911 evidence, sign-offs. PDF goes into the compliance file and is emailed to the regulator's contact and the customer's compliance officer for any tenant who requested evidence.
## Where Studio earns its keep
* The drill runs as a procedure, so the next quarter's drill is the same drill — not a rewrite from memory.
* 911 validation is a hard step, not an afterthought — the procedure does not pass without it.
* The evidence pack is the procedure's output, not a separate document someone has to write the next week.
* The customer notice and the regulator evidence reference the same drill ID, so there's a clean audit trail without manual cross-referencing.
## Related
Build the `Voice DR drill` once and run it every quarter.
The compliance evidence pack lives in the workspace.
# One-way audio complaint: ticket to fix in one session
Source: https://altostrat.io/docs/studio/en/use-cases/voip/one-way-audio
A customer reports they can hear callers but callers can't hear them. Pull the call recording, run the SIP trace, identify RTP NAT asymmetry on the SBC, fix the firewall pinhole, validate with a test call, and update the customer.
A small-business customer files a Kayako ticket: outbound calls connect, but the far side can't hear them. The VoIP provider needs the SIP and RTP evidence in front of an engineer in two minutes, the fix on the SBC and the firewall in five, a validated test call, and a customer reply that doesn't sound like a runaround.
## Systems involved
| System | Role |
| --------------------------------- | ------------------------------------------------ |
| Kayako | Source ticket and final reply. |
| Asterisk / FreePBX call recording | The actual call recording for the disputed call. |
| Homer / SIPCapture | SIP message trace for the call. |
| sngrep / pcap on SBC | Live SIP and RTP capture. |
| Studio terminal (SBC SSH) | Inspect SBC config, NAT settings, RTP pinholes. |
| FortiGate / Palo Alto | Firewall RTP rule check and adjustment. |
| TestCallin / SIPp | Synthetic test call to validate the fix. |
| Studio Memories | Customer-specific RTP / NAT notes. |
## Walkthrough
Copilot reads the Kayako ticket, identifies the disputed Call-ID range from the customer's description, and fetches the matching call recording and SIP trace from Homer for one example call. Both are attached to the workspace as artifacts.
Copilot annotates the trace: INVITE, 100 Trying, 180 Ringing, 200 OK, ACK — all clean. The SDP shows the customer's SBC offering an RTP address in the customer's private range, no `c=` line rewrite. RTP from the customer reaches the carrier; carrier RTP heading back never arrives.
SSH to the SBC. Run sngrep filtered on the customer's IP. Place a fresh test call from a softphone. The capture confirms the same one-way RTP pattern.
Copilot correlates the SBC's NAT-traversal config with the customer's firewall behaviour. The customer's FortiGate is dropping inbound RTP because the pinhole was created against the wrong helper. The NAT type on the SBC also needs `nat=force_rport,comedia` for this customer's subnet.
Two changes: SBC `nat` setting and a FortiGate policy adjustment. Both stage in the staging panel with rollback commands. Approval prompt shows both changes side by side.
Push the SBC change. Push the FortiGate change through SSH. Run a synthetic test call through TestCallin that auto-evaluates audio in both directions. Audio is bidirectional.
Copilot drafts a Kayako reply: brief explanation, fix applied, validation result, no further action required from the customer's side. Reviewed and sent.
Save a memory tagged with the customer code: "FortiGate behind SIP-ALG; force RTP pinhole through policy 23, disable SIP-ALG on inbound rule." Promote the diagnosis path into a procedure called `One-way audio triage`.
## Where Studio earns its keep
* The recording, the SIP trace, and the live capture are all on one screen — the engineer can correlate INVITE, 200 OK, and the RTP gap without opening Wireshark.
* The fix is two changes on two systems, staged and approved together, instead of two SSH sessions and two browser tabs.
* The test call validates the fix in the same window the engineer just made the change in — no waiting for the customer to call back.
* The memory means the next ticket from this customer with similar symptoms is solved in 10 minutes, not 50.
## Related
Use the terminal for live sngrep and tcpdump on the SBC.
`One-way audio triage` runbook with customer code as argument.
# PSTN trunk provisioning for a new tenant
Source: https://altostrat.io/docs/studio/en/use-cases/voip/pstn-trunk-provisioning
Sales hands over a new business customer. Reserve a DID block, configure the SBC trunk, provision in 3CX, validate inbound and outbound, and email the tenant their go-live details — all in one session.
Sales hands over a new tenant: 25-user PBX, four DIDs, mainline number on a port-in from the previous carrier scheduled in two weeks. Until the port completes, the tenant gets temporary DIDs from the carrier so they can start using the system today. The provisioning team executes the full setup inside Studio.
## Systems involved
| System | Role |
| -------------------------------- | ---------------------------------------------- |
| HubSpot / Salesforce | Sales handoff record with tenant details. |
| Bandwidth / Telnyx / Inteliquent | Carrier API for DID reservation and SIP trunk. |
| Studio terminal | SSH to the SBC for trunk configuration. |
| 3CX / FreePBX / Cisco CUCM | PBX where extensions and call routing live. |
| Stripe | Billing setup for the tenant. |
| Gmail | Welcome email with credentials and dial plan. |
| Studio Procedures | `Tenant onboarding` runbook. |
## Walkthrough
Copilot reads the HubSpot record: tenant name, billing contact, technical contact, requested number count, location, port-in details, target go-live date.
Through the Bandwidth connector, search and reserve four DIDs in the tenant's local rate centre, plus one toll-free for the mainline. The reservation IDs come back and get stored on the tenant record.
SSH to the SBC. Copilot drafts a tenant trunk: registration credentials, codec list, DTMF mode, allowed source IPs (the tenant's PBX), call-admission control limits matching the contracted concurrent calls. Stages, you review, push.
Through the 3CX connector, create the tenant, add the four DIDs and the toll-free, configure inbound call routing to a placeholder receptionist extension, configure outbound rules through the new trunk.
From a Studio softphone (or via TestCallin), dial each DID. Copilot watches the SBC and the PBX logs to confirm the call routes correctly, audio is bidirectional, and the CDR captures clean.
Place a test outbound call to a verified test number. Confirm the carrier accepts, the caller ID presents correctly, and the call connects.
Through the Stripe connector, create the tenant subscription with the agreed tier, attach the billing contact, and set the first invoice date.
File the port-in request through the carrier connector for the mainline number, with the LOA the customer signed. The port FOC date lands in the tenant record.
Copilot drafts a Gmail welcome: temporary DIDs, port-in expected date, PBX admin URL and credentials, dial plan, support contact, escalation path. Reviewed and sent.
## Where Studio earns its keep
* The carrier API, the SBC, the PBX, and the billing system are touched from the same workspace — there is no spreadsheet of "did we remember to do this step yet."
* The test calls happen against the live trunk before anyone tells the customer it's ready.
* The port-in date is captured on the tenant record where the welcome email pulls from, so the customer email and the operations record never disagree.
* The procedure takes the next tenant from sales-handoff to go-live in about 30 minutes instead of half a day.
## Related
Bandwidth, Telnyx, 3CX, Stripe, and Gmail as Copilot tools.
`Tenant onboarding` runbook with the tenant ID as the argument.
# SIP trunk exhaustion: alarm to expanded capacity in one shift
Source: https://altostrat.io/docs/studio/en/use-cases/voip/sip-trunk-exhaustion
Concurrent-call counters peak above the contracted limit. Confirm legitimate traffic, expand the trunk capacity with the carrier, push the SBC change, validate, and update billing — without dropping calls.
Mid-morning, a healthcare customer's call-centre starts seeing 503 Service Unavailable on outbound dials. The carrier's SBC concurrent-call counter for that customer is sitting on the contracted ceiling. The carrier needs to confirm the traffic is legitimate, expand the trunk, push the change without disrupting active calls, and update the billing.
## Systems involved
| System | Role |
| ----------------------------------- | ----------------------------------------------- |
| Studio terminal | SSH to SBC for live concurrent-call counts. |
| Voipmonitor / Homer | Call quality and pattern history. |
| Carrier portal (Bandwidth / Telnyx) | Contracted CIC count, change request. |
| Splynx / homegrown billing | Customer record, contract terms, billing rules. |
| Microsoft Teams `#voice-ops` | Internal channel. |
| Gmail | Customer-facing notice and confirmation. |
| Studio Procedures | `Trunk capacity expansion` runbook. |
## Walkthrough
Copilot pulls the SBC's concurrent-call counter for the customer and the rejected-call log. Pattern is unambiguous: rejections fired the moment the counter touched the ceiling, repeatedly, across the morning.
Pull the call pattern from Voipmonitor for the morning. Outbound calls to a normal distribution of customer-service destinations, ASR (Answer Seizure Ratio) is normal, no pumping pattern. The customer is just busier than their contract allows.
Through Gmail, send the customer a short note: we're seeing capacity exhaustion, your calls are being briefly rejected, here's what we recommend (uplift your CIC), if you approve we can do it within the hour. Phone call also placed to the customer's IT contact.
Customer agrees to a 25 percent uplift. The PSA opportunity is created and won; billing rules will reflect the new ceiling from the change date.
Through the Bandwidth connector, request the trunk uplift. The carrier confirms within 15 minutes. New CIC ceiling: 250.
SSH to the SBC. Stage the customer's trunk's new call-admission control limit. Approval prompt shows the diff. Push. Active calls are unaffected; new calls now succeed up to 250 concurrent.
Copilot watches the rejected-call counter for 30 minutes. Rejections drop to zero. Concurrent-call counter peaks at 217 during the lunch rush — comfortably inside the new ceiling.
Update the customer's billing record with the new CIC count and the effective date. The next invoice picks up the prorated change automatically.
Gmail confirmation to the customer: change applied, validated, here's the new ceiling, here's the new monthly. Saved memory: "Customer ACME healthcare runs 23 percent above their contracted CIC during open-enrollment season — review every September."
## Where Studio earns its keep
* The exhaustion and the legitimacy check happen in one workspace — the engineer is not guessing whether to expand or to investigate fraud.
* The customer hears about the issue from the carrier before it shows up in their own dashboards, which is the conversation a healthcare call-centre manager wants.
* The carrier change, the SBC change, and the billing update reference the same ticket and the same effective date.
* The seasonal memory means the next September has a proactive uplift conversation in August, not a 503 on day one.
## Related
`Trunk capacity expansion` runbook with tenant code as the argument.
Save seasonal patterns so the next year is proactive.
# STIR/SHAKEN spoofing complaint: trace, mitigate, escalate
Source: https://altostrat.io/docs/studio/en/use-cases/voip/stir-shaken-spoofing
A subscriber complains they're being called by their own number. Pull the SIP trace, check SHAKEN attestation, identify the originating carrier, mitigate at the SBC, and file the formal complaint upstream.
A subscriber files a complaint: they're getting harassment calls displaying their own number as the caller ID. The carrier has to trace the call origin, verify the SHAKEN attestation, mitigate at the SBC for the subscriber's number, and file the formal complaint with the originating carrier and the FCC's Robocall Mitigation Database.
## Systems involved
| System | Role |
| -------------------------------- | ----------------------------------------------------- |
| Kayako / Zendesk | Subscriber complaint ticket. |
| Homer / SIPCapture | SIP trace storage. |
| SBC SSH | Trace the call's origination, verify Identity header. |
| STIR/SHAKEN verification service | Validate the certificate chain. |
| FCC Robocall Mitigation Database | Lookup the upstream carrier's RMD entry. |
| Originating carrier contact | Formal complaint email or portal. |
| FCC consumer complaint portal | Optional escalation. |
| Gmail | Subscriber and inter-carrier comms. |
| Studio Memories | Pattern notes on repeat-offender carriers. |
## Walkthrough
Copilot reads the subscriber complaint, identifies the affected DID, and pulls the last 48 hours of inbound calls to that DID from Homer. Three calls match the spoofing pattern.
For each call, Copilot extracts the Identity header from the INVITE, decodes the JWT, and checks the attestation level. Two are A-attested by a known transit carrier; one is C-attested with no traceback information.
Through the verification service, validate that the signing certificate chains to a Certified STI-PA root and that the cert is not revoked. The A-attested calls validate; the C-attested call has a valid cert but minimal accountability.
Look up the OCN in the FCC Robocall Mitigation Database. The transit carrier is reputable; the originating party shows as a discount international gateway with a thin RMD filing.
SSH to the SBC. Add a temporary rule for the subscriber's DID: block inbound calls where the calling number matches the called number. The rule is narrow — it does not affect any other subscriber.
Copilot drafts a Kayako reply: we traced the calls, applied a block, here's what STIR/SHAKEN told us, here's what we can and can't do about the upstream source. Reviewed and sent.
Through Gmail, draft a formal complaint to the transit carrier's robocall mitigation contact: example call IDs, Identity header contents, attestation level, evidence of harassment pattern. The transit carrier's response time SLA is logged.
For repeat-offender originating parties (saved as memories from prior incidents), file the FCC consumer complaint as a courtesy escalation with the same evidence pack.
Copilot sets a 7-day watch on the subscriber's DID for the same pattern. If it recurs, the ticket reopens automatically with the running history attached.
## Where Studio earns its keep
* The Identity header decoding, the cert chain check, and the RMD lookup happen automatically — the engineer doesn't switch between three browser tabs and a JWT decoder.
* The mitigation is narrow and surgical at the SBC, not a policy change that hurts other subscribers.
* The inter-carrier complaint references actual evidence — the cert serial, the OCN, the call IDs — so it gets taken seriously upstream.
* The repeat-offender memory builds over time, so the next call from the same source produces a stronger escalation immediately.
## Related
Save repeat-offender OCNs and patterns for next-time correlation.
`Spoofing complaint triage` with DID as the argument.
# Microsoft Teams Direct Routing migration for an enterprise tenant
Source: https://altostrat.io/docs/studio/en/use-cases/voip/teams-direct-routing
Migrate a 1,200-seat enterprise from a legacy PBX to Microsoft Teams Direct Routing — SBC provisioning, dial plan, DID porting, phased user migration, training, and legacy decom.
A 1,200-seat enterprise customer is consolidating onto Microsoft 365 and wants their voice on Teams Direct Routing. The carrier owns the SBC side and the carrier-grade SIP trunks. The migration covers the discovery, the SBC and dial plan, the DID port from the legacy carrier, phased user cutover, training, and the decom of the legacy PBX.
## Systems involved
| System | Role |
| -------------------------------- | ------------------------------------------------ |
| HubSpot / SFDC | Customer record and project plan. |
| Microsoft Graph / Teams Admin | Direct Routing configuration on the M365 tenant. |
| AudioCodes / Ribbon SBC | Carrier-side SBC for Teams. |
| Legacy carrier | DID port-out coordination. |
| Bandwidth / Telnyx | New carrier hosting the SIP trunk to the SBC. |
| Studio terminal | SSH to SBC for trunk and translation rules. |
| ConnectWise PSA | Project tasks, hours, and customer touchpoints. |
| Microsoft Teams `#proj-acme-tdr` | Project channel with the customer's IT team. |
| Gmail / Outlook | Customer comms and porting LOAs. |
| Studio Procedures | `Teams Direct Routing migration` runbook. |
## Walkthrough
Open a shared Studio session with the customer's IT team. Walk through current PBX, dial plan, call queues, IVRs, recording requirements, e911 posture. Recorded for the project archive.
SSH to the AudioCodes SBC. Stage the trunk to the carrier, the trunk to the customer's M365 tenant (with the right Teams certificate trust), the translation rules for E.164 and the customer's internal extension format, and the SBA failover for the customer's branches.
Through the Microsoft Graph connector, configure the M365 tenant: PSTN gateway, voice routes, voice-routing policies, dial plans. Apply the trial policy to a pilot group of five users.
Pilot users place test calls inbound and outbound. Copilot watches the SBC and Teams CDR, confirms audio bidirectional, ringing presents correctly, voicemail routes to the right place. Pilot signs off.
File port-in LOAs through the carrier API for the customer's DIDs in three batches by department. Each batch has a confirmed FOC date.
On each FOC date, run the cutover procedure for the affected users: enable Teams Calling, assign DID, post the welcome message in their Teams chat, deactivate the legacy PBX extension. The procedure pauses for 30 minutes between batches to catch any patterns.
For each phase, deliver a 15-minute training video (recorded shared session) attached to the user's welcome message. Office hours posted in the project channel for the cutover week.
Two weeks after the final cutover, with no PSAP fallback dependencies left, schedule the legacy PBX decom. Final config backups taken, hardware powered down, contracts terminated.
Generate the project closure report: scope completed, hours used, issues encountered, user feedback summary, post-cutover SLA performance. Sent to the customer sponsor through Gmail.
## Where Studio earns its keep
* The SBC, the M365 tenant, and the carrier port-in coordinate from one workspace, with the customer's project channel in the same view.
* The pilot validation is done with real calls and real CDRs, not a hopeful sign-off on a config screenshot.
* Phased cutovers gate on the previous batch's quiet — a problem at batch one stops batch two before it starts.
* Decommission only happens when the procedure confirms no inbound paths still depend on the legacy PBX, which is the kind of mistake that creates a 3 a.m. incident in week three otherwise.
## Related
`Teams Direct Routing migration` with tenant ID as the argument.
Use shared sessions for the discovery call and the recorded training.
# Welcome to Studio
Source: https://altostrat.io/docs/studio/en/welcome
Altostrat Studio brings live network access, AI-assisted operations, reusable procedures, team coordination, and production controls into one desktop workspace.
Altostrat Studio is a desktop workspace for operating networks. It keeps device access, conversations, generated work, procedures, team context, and administrative controls connected instead of spreading an investigation across unrelated tools.
Use Studio to connect to devices, investigate live state, ask AI to work from the context you choose, turn successful work into reusable procedures, and preserve the result for the next operator. Studio runs on macOS and Windows and connects from your workstation to the networks you can reach.
## What you can do
Organize hosts, attach multiple protocols, and authenticate through personal or organization-managed Key Chain entries.
Keep terminals, remote desktops, browser sessions, files, diagrams, dashboards, and conversations in the same workbench.
Choose a response mode, attach exact context, review tool activity, and use approvals or Autopilot according to the task's risk.
Separate operational context by team and channel, then organize conversations on a searchable chat board.
Turn connector data and operational results into live dashboards or capability-gated generated apps.
Capture a repeatable workflow with arguments, tool access, schedules, triggers, and an execution history.
Pair an iPhone with the desktop app to continue chats, review activity, and answer approvals while Studio remains the execution bridge.
Manage members, integration readiness, tool policy, credential mode, usage, billing, and feature access.
## How an investigation flows
Add a host or select an existing host, channel, conversation, file, connector, or other Studio object.
Open the appropriate terminal, remote desktop, browser session, diagnostic tool, connector, file, or dashboard.
Use **Ask** for read-only help, **Planning** to research before execution, **Default** for normal tool use, or **Autopilot** only for a deliberately bounded task.
Follow tool activity, inspect proposed external effects, and approve or reject calls according to your trust posture and organization policy.
Save durable facts as memory, keep generated files and apps as artifacts, or promote a repeatable path into a procedure.
Keep work private or place it in the appropriate organization, team, or channel context. Never paste a secret when a Key Chain reference can be used.
## Understand the trust boundaries
Studio can reach production systems, external integrations, a local browser, and—with permission—the desktop interface. Different surfaces have different approval and credential boundaries. Before granting broad access, review:
* [Security and privacy](./security-and-privacy) for operator guidance.
* [Human in the loop](./ai-safety/human-in-the-loop) for tool approvals and Autopilot.
* [AI provider and data flow](./ai-safety/ai-provider-and-data-flow) for model regions and what enters model context.
* [Known limits and roadmap](./ai-safety/known-limits-and-roadmap) for boundaries that still require operational controls.
## Get started
Install the correct desktop build and prepare network and OS access.
Learn the sidebar, conversation surface, artifact area, activity stack, and shortcuts.
Build inventory, attach a protocol, and choose a credential reference.
Set the model, context window, mode, approvals, and follow-up behavior.
# Why Studio
Source: https://altostrat.io/docs/studio/en/why-studio
Studio reduces operational context switching by keeping device access, AI work, team context, reusable procedures, and saved outcomes in one governed workspace.
Network operations often span a terminal client, browser, credential manager, ticketing system, documentation store, chat tool, and automation platform. Each handoff drops context: which device was examined, what evidence supported the conclusion, which command changed state, and where the useful result was saved.
Studio is designed around the unit of operational work rather than one protocol or content type. A conversation can reference a host, use a connector, open a terminal or browser, produce a file or dashboard, become a procedure, and remain available to the appropriate channel without rebuilding the context at every step.
## One workspace, several execution surfaces
| Need | Studio surface |
| --------------- | ------------------------------------------------------------------------------------------------------------- |
| Reach a device | SSH, Telnet, serial, HTTP/HTTPS, RDP, VNC, video, and custom host protocols. |
| Investigate | Terminal output, browser sessions, remote desktops, diagnostics, files, connectors, diagrams, and dashboards. |
| Reason with AI | Model and context selection, response modes, object mentions, memories, slash commands, and sub-agents. |
| Repeat the work | Procedures with parameters, tool controls, schedules, triggers, and run history. |
| Coordinate | Organizations, teams, channels, chat board, sharing, presence, calls, and Studio Remote. |
| Govern | Roles, integration policy, personal or shared credentials, tool availability, approvals, usage, and billing. |
The point is continuity. An operator should be able to move from observation to decision to execution to evidence without losing the target or copying secrets and state between tools.
## Context that becomes reusable
Studio distinguishes between information that is useful only now and information worth preserving:
* Live terminal, browser, connector, and device state should be refreshed at the time of action.
* Generated files, replays, diagrams, dashboards, and apps preserve a dated result.
* Memories preserve compact, durable facts with enough scope to be useful later.
* Procedures preserve a repeatable method, including allowed tools and success criteria.
* Channel context preserves the team setting in which a conversation or artifact belongs.
This separation matters. It prevents a transient observation from silently becoming permanent truth while still letting proven operating knowledge accumulate.
## Control follows capability
Studio can read and change real systems, so broader capability comes with broader controls:
* AI response modes separate read-only inquiry, planning, normal execution, and high-trust Autopilot.
* Organization, channel, and runtime tool policies determine which tools are available.
* Personal and managed shared credential modes support different ownership and audit needs.
* Browser takeover, Computer Use, generated apps, paired phones, and digital workers each have their own trust boundary.
* Usage views and audit history make activity visible after the fact.
Read [Security and privacy](./security-and-privacy) and the [AI safety overview](./ai-safety/overview) before using high-trust features against production systems.
## Start with a narrow workflow
The fastest way to evaluate Studio is to choose one real but low-risk task:
1. Add a test host and attach a Key Chain reference.
2. Open a terminal or browser session and gather read-only evidence.
3. Ask Studio to explain the evidence in **Ask** mode.
4. Repeat in **Planning** or **Default** mode and inspect each proposed tool call.
5. Save the result as a file or memory.
6. If the path is repeatable, promote it into a procedure with a narrow tool set.
From there, add the team, connector, dashboard, remote, or worker surface that solves a demonstrated operational need.
## What to read next
See how channels, conversations, artifacts, tabs, and background activity fit together.
Choose modes, models, context, slash commands, and approval posture.
Turn a successful investigation into a controlled, repeatable workflow.
Configure members, integrations, credentials, and tool policy.
# Workspace Billing Modes: Single vs Assigned vs Pooled Resource Allocation
Source: https://altostrat.io/docs/workspaces/billing-modes
Complete guide to workspace billing modes including Single mode for unified billing, Assigned mode for isolated accounts, and Pooled mode for shared resources. Choose the right billing strategy for your business structure.
## What are Workspace Billing Modes?
Workspace billing modes define how subscriptions and resources are allocated across organizations within your workspace. This permanent configuration choice, made during workspace creation, determines your financial architecture and resource sharing capabilities.
**Why billing modes matter:**
* Control resource sharing and isolation
* Define financial accountability structures
* Enable different business models (enterprise, MSP, franchise)
* Optimize for compliance and operational requirements
## Complete Billing Modes Reference
Choose from three distinct billing architectures designed for different organizational and financial requirements:
## Single Billing Mode: Unified Resource Pool
Single mode creates a unified billing architecture where one billing account provides all resources for the entire workspace. All organizations share a common resource pool funded by a single subscription source.
**Single mode architecture:**
* One billing account per workspace
* Shared resource pool across all organizations
* Centralized financial management
* Simplified administration and invoicing
```mermaid theme={null}
graph LR
subgraph "Workspace (Single Mode)"
BA[Billing Account
100 Users, 50 Locations]
O1[Org A
Using: 45 Users, 20 Locations]
O2[Org B
Using: 30 Users, 15 Locations]
O3[Org C
Using: 25 Users, 15 Locations]
BA --> O1 & O2 & O3
end
```
### When to Use Single Mode
Single mode works best for organizations with centralized financial management and unified operations:
**Ideal use cases:**
* **Traditional corporations**: Departments sharing centralized budget and resources
* **Small to medium enterprises**: Single entity with unified financial management
* **Startups**: Simple structure for rapid growth and scaling
* **Single-brand organizations**: Unified operations under one business entity
### Single Mode Characteristics
* **Resource sharing**: Complete resource pool sharing across organizations
* **Financial structure**: Single point of billing and payment management
* **Limit enforcement**: Shared limits apply to entire workspace
* **Administration**: Simplest mode for management and monitoring
**Example**: A software company with 100 employees across Sales, Engineering, and Marketing. All teams draw from the same pool of user licenses and product features, with all charges consolidated under one corporate billing account.
## Assigned Billing Mode: Isolated Billing Accounts
Assigned mode creates complete financial and resource isolation by linking each top-level organization to a specific billing account. This architecture ensures strict separation between business units, customers, or geographic regions.
**Assigned mode architecture:**
* Each top-level organization requires dedicated billing account
* Complete resource isolation between organizational silos
* Child organizations inherit parent billing assignments
* Multi-currency and multi-entity support
```mermaid theme={null}
graph TD
subgraph "Workspace (Assigned Mode)"
BA1["Billing Account: USA (USD)"]
BA2["Billing Account: Germany (EUR)"]
BA3["Billing Account: Japan (JPY)"]
O1[Org: USA Operations]
O2[Org: Germany Operations]
O3[Org: Japan Operations]
O1S[USA > Sales Team]
O1E[USA > Engineering Team]
O2S[Germany > Vertriebsteam]
O3P[Japan > 製品部]
BA1 -- Assigned to --> O1
BA2 -- Assigned to --> O2
BA3 -- Assigned to --> O3
O1 --> O1S & O1E
O2 --> O2S
O3 --> O3P
end
```
### When to Use Assigned Mode
Assigned mode provides the highest level of financial and operational separation for complex organizational structures:
**Ideal use cases:**
* **Multinational corporations**: Country-based operations with separate budgets and currencies
* **Multi-tenant SaaS**: Complete customer isolation with dedicated billing
* **Managed service providers**: Client-specific billing and resource allocation
* **Enterprise divisions**: Separate P\&L accountability for business units
* **Compliance requirements**: Strict data and financial separation mandates
### Assigned Mode Characteristics
* **Complete isolation**: No resource sharing between organizational silos
* **Billing inheritance**: Child organizations automatically inherit parent billing accounts
* **Financial accountability**: Clear cost center and budget management
* **Multi-currency support**: Different currencies for global operations
* **Compliance ready**: Meets strict separation and audit requirements
**Example**: A global corporation with operations in the USA, Germany, and Japan. Each country is billed in its local currency and manages its resources independently. The US branch cannot use software licenses allocated to the German branch.
## Pooled Billing Mode: Collaborative Resource Sharing
Pooled mode enables multiple billing accounts to contribute resources to a shared workspace pool while maintaining independent billing relationships. This collaborative architecture supports franchise models, partnerships, and consortiums.
**Pooled mode architecture:**
* Multiple billing accounts contribute to shared resource pool
* Independent billing and payment management per account
* Flexible resource allocation across all organizations
* Collaborative resource sharing with separate financial responsibility
```mermaid theme={null}
graph TD
subgraph "Workspace (Pooled Mode)"
subgraph "Shared Resource Pool"
P[Total: 200 Users, 100 Locations]
BA1[Franchisee A
Contributes: 80 Users, 40 Locations]
BA2[Franchisee B
Contributes: 70 Users, 35 Locations]
BA3[Franchisee C
Contributes: 50 Users, 25 Locations]
BA1 & BA2 & BA3 -- contribute to --> P
end
subgraph "Organizations (Consume from Pool)"
O1[Location 1 - Downtown]
O2[Location 2 - Airport]
O3[Location 3 - Mall]
end
P -.-> O1 & O2 & O3
end
```
### When to Use Pooled Mode
Pooled mode works best for collaborative business models requiring both resource sharing and billing independence:
**Ideal use cases:**
* **Franchise operations**: Independent franchisees sharing brand resources
* **Channel partner networks**: Partners contributing to shared resource pools
* **Joint ventures**: Multiple entities collaborating on shared projects
* **Consortiums**: Industry groups pooling resources for common goals
* **Co-ops and alliances**: Independent members sharing infrastructure costs
### Pooled Mode Characteristics
* **Resource aggregation**: All subscription contributions pool into shared capacity
* **Independent billing**: Separate invoicing and payment processing per contributor
* **Dynamic allocation**: Flexible resource usage across all organizations
* **Scalable collaboration**: Support for multiple independent contributors
* **Shared infrastructure**: Cost-effective resource utilization across partners
**Example**: A franchise with 20 locations. Each franchisee has their own billing account and purchases subscriptions. All of these subscriptions combine into a large pool that any location can use, enabling resource sharing while maintaining the financial independence of each franchisee.
## How to Choose the Right Billing Mode
Select the optimal billing mode based on your organizational structure, financial requirements, and operational model:
### Billing Mode Decision Matrix
| Business Need | Recommended Mode | Key Benefits |
| :---------------------------------------------------------- | :---------------- | :---------------------------------------------------------- |
| **Unified operations and simple billing** | **Single Mode** | Centralized management, shared resources, single invoice |
| **Complete financial and operational separation** | **Assigned Mode** | Isolated billing, compliance-ready, multi-currency support |
| **Collaborative resource sharing with independent billing** | **Pooled Mode** | Shared resource pool, separate billing, flexible allocation |
### Critical Decision: Billing Mode is Permanent
⚠️ **Important**: Billing mode selection is permanent and cannot be changed after workspace creation. Choose carefully based on your long-term business strategy and operational requirements.
## What's Next?
* See [Modeling Your Business](/docs/workspaces/modeling-your-business) for detailed implementation examples of these modes.
* Learn about [Organization Hierarchies](/docs/workspaces/organization-hierarchies) to structure your workspace effectively.
* Understand [Subscriptions and Invoicing](/docs/workspaces/subscriptions-and-invoicing) for details on managing billing.
# Workspace Management: Complete Guide to Billing, Organizations & Multi-Tenant Architecture
Source: https://altostrat.io/docs/workspaces/introduction
Complete guide to workspace architecture including billing accounts, organization hierarchies, member management, and billing modes. Learn how to structure enterprise-grade multi-tenant systems with Auth0 and Stripe integration.
## What is a Workspace?
A workspace provides the foundational architecture for enterprise billing and organizational management. Workspaces act as secure, multi-tenant containers that connect authentication systems (Auth0) with payment processing (Stripe) while providing sophisticated resource allocation and usage tracking capabilities.
**Key workspace capabilities:**
* Multi-tenant billing and organizational isolation
* Hierarchical organization structures with usage aggregation
* Enterprise-grade concurrency and reliability features
* Flexible billing models (Single, Assigned, Pooled)
* Integrated member management with role-based access
## Workspace Architecture: Foundation for Enterprise Billing
Each workspace represents a complete customer account environment containing all resources needed for billing management, organizational structure, and user administration. Workspaces are engineered for enterprise-scale operations with advanced reliability features.
```mermaid theme={null}
graph TD
W[Workspace] --> BA[Billing Accounts]
W --> O[Organizations]
W --> M[Members]
W --> BM[Billing Mode]
BA --> PM[Payment Methods]
BA --> S[Subscriptions]
O --> H[Hierarchy Structure]
O --> U[Usage Tracking]
M --> R[Roles & Permissions]
```
## Core Workspace Components
Workspaces consist of four integrated components that work together to provide comprehensive billing and organizational management:
### Billing Accounts: Financial Management and Payment Processing
Billing accounts manage payment methods, subscriptions, and financial transactions within workspaces. Each billing account connects directly to Stripe for secure payment processing and subscription management.
**Billing account features:**
* Secure payment method storage (up to 5 methods)
* Subscription management and resource pooling
* Automated billing and invoice generation
* Multi-currency support for global operations
### Organizations: Hierarchical Resource Management
Organizations provide flexible hierarchical structures for modeling business relationships and resource allocation. Support up to 10 levels of nesting with automatic usage aggregation and limit inheritance.
**Organization capabilities:**
* Model departments, teams, subsidiaries, or partner networks
* Automatic usage tracking and limit enforcement
* Flexible resource allocation and sharing
* Scalable from simple teams to complex multi-tier structures
### Members: Role-Based Access Control
Workspace members provide secure access control with three distinct permission levels for collaborative management:
* **Owners**: Complete workspace control including billing, member management, and configuration
* **Admins**: Organization management, billing visibility, and member invitation capabilities
* **Viewers**: Read-only access to workspace data and organizational structures
### Billing Modes: Resource Allocation Strategy
Billing modes define how resources and subscriptions are allocated across organizations within your workspace. This permanent configuration choice shapes your workspace's financial and operational structure:
* **Single Mode**: Unified billing with shared resource pool
* **Assigned Mode**: Isolated billing accounts for complete separation
* **Pooled Mode**: Multiple billing accounts contributing to shared resources
## Enterprise-Grade Workspace Features
### Enterprise Reliability and Performance
Workspaces include advanced reliability features designed for mission-critical enterprise operations:
* **Idempotent operations**: Prevent duplicate processing during network issues
* **Distributed locking**: Eliminate race conditions in high-concurrency environments
* **Atomic transactions**: Ensure data consistency across all operations
* **Auto-scaling architecture**: Handle thousands of concurrent requests
### Advanced Resource Management
Sophisticated resource tracking and allocation capabilities for complex organizational needs:
* **Multi-resource tracking**: Users, locations, SSO connections, and custom resources
* **Hierarchical limits**: Set and inherit limits across organizational levels
* **Real-time usage aggregation**: Automatic rollup from leaf to root organizations
* **Dynamic limit enforcement**: Most restrictive limit always applies
### Platform Integration Capabilities
Seamless integration with enterprise authentication and payment systems:
* **Auth0 integration**: Connect existing identity management systems
* **Stripe integration**: Direct payment processing and subscription management
* **API-first design**: Programmatic access to all workspace functionality
* **Dashboard management**: Intuitive web interface for administrative tasks
## How to Set Up Your Workspace
Follow these steps to configure your workspace for optimal billing and organizational management:
1. **Select Billing Mode**: Choose Single, Assigned, or Pooled based on your business requirements (permanent decision)
2. **Configure Billing Accounts**: Connect Stripe customers and add secure payment methods
3. **Design Organization Hierarchy**: Model your business structure using nested organizations
4. **Add Workspace Members**: Invite users with appropriate Owner, Admin, or Viewer roles
5. **Setup Subscriptions**: Configure resource allocations and usage limits for your organizations
## What's Next?
* Learn about [Billing Modes](/docs/workspaces/billing-modes) to choose the right model for your business
* Explore [Modeling Your Business](/docs/workspaces/modeling-your-business) for real-world implementation examples
* Understand [Organization Hierarchies](/docs/workspaces/organization-hierarchies) for complex structures
* Review [System Limitations](/docs/workspaces/limitations) to plan your implementation
# Workspace System Limits: Organization, Billing & Performance Constraints
Source: https://altostrat.io/docs/workspaces/limitations
Complete reference for workspace system limitations including organization hierarchy limits, billing account restrictions, performance considerations, and scaling strategies for enterprise implementations.
## Understanding Workspace System Limitations
Workspace system limitations define operational boundaries designed to ensure optimal performance, reliability, and consistent user experience across all enterprise implementations. Understanding these limits is essential for scalable architecture design and growth planning.
**Why system limits exist:**
* Ensure optimal performance and response times
* Maintain system reliability and stability
* Provide consistent experience across all users
* Prevent resource contention and bottlenecks
* Enable efficient scaling and capacity planning
## Workspace-Level Limits: Enterprise-Scale Boundaries
Workspace-level limits define the maximum capacity for top-level container operations designed for enterprise-scale implementations:
### Workspace Capacity Limits
| Resource | Maximum Limit | Implementation Details |
| :------------------------- | :------------------ | :---------------------------------------------------------------------------- |
| **Total Organizations** | 1,000 per workspace | Total count across all hierarchy levels including root and leaf organizations |
| **Workspace Members** | 100 per workspace | Users with assigned roles (Owner, Admin, Viewer) for workspace management |
| **Billing Mode Selection** | Permanent decision | Single, Assigned, or Pooled mode chosen at creation cannot be modified |
## Organization Hierarchy Limits: Structure and Scalability Constraints
Organization hierarchy limits ensure efficient data traversal, query performance, and management capabilities while supporting complex business structures:
### Hierarchy Structure Limits
| Hierarchy Aspect | Maximum Limit | Technical Details |
| :--------------------------- | :---------------------- | :----------------------------------------------------------------- |
| **Maximum Depth** | 10 levels | Maximum parent-child nesting depth for efficient query performance |
| **Direct Children** | 100 per organization | Maximum immediate children per organization node |
| **Total Descendants** | 1,000 (workspace limit) | Effectively unlimited within workspace organization limit |
| **Organization Name Length** | 50 characters | Display name character limit for UI and API compatibility |
### Visual Hierarchy Limit Examples
These diagrams demonstrate maximum depth and direct children constraints:
```mermaid theme={null}
graph TD
subgraph "Maximum Depth: 10 Levels"
L1[Level 1] --> L2[...]
L2 --> L10[Level 10]
L10 --> X[❌ Level 11 Not Allowed]
end
```
```mermaid theme={null}
graph TD
subgraph "Maximum Direct Children: 100"
P[Parent Organization]
C1[Child 1]
C2[Child 2]
C99["..."]
C100[Child 100]
X[❌ Child 101 Not Allowed]
P --> C1 & C2 & C99 & C100 & X
end
```
## Billing and Subscription Limits: Financial Architecture Constraints
Billing and subscription limits define financial architecture boundaries that vary by workspace billing mode and affect operational structure:
### Billing Architecture Limits
| Financial Resource | Mode-Specific Limit | Implementation Details |
| :------------------------------------- | :-------------------- | :---------------------------------------------------------- |
| **Billing Accounts (Single mode)** | 1 per workspace | Single mode restricts to exactly one billing account |
| **Billing Accounts (Assigned/Pooled)** | 10 per workspace | Assigned and Pooled modes support multiple billing accounts |
| **Active Subscriptions** | 3 per billing account | Maximum concurrent subscriptions for resource pooling |
| **Payment Methods** | 5 per billing account | Secure payment method storage with automated failover |
### Exceeding Subscription Limits: Multi-Billing Account Strategy
When customers require more than 3 separate subscriptions for complex invoicing needs, implement multiple billing accounts within the workspace:
**Example**: MSP client requiring 5 separate departmental invoices
**Implementation Strategy**:
1. **Create multiple billing accounts**: "Client ABC - Billing 1" and "Client ABC - Billing 2"
2. **Distribute subscriptions**: 3 subscriptions on first account, 2 on second account
3. **Assign organizational structure**: Link departments to appropriate billing accounts (requires Assigned mode with departmental top-level organizations)
```mermaid theme={null}
graph TD
subgraph "Workspace for Client ABC (Assigned Mode)"
O1[Org: Marketing Dept] --> BA1[Billing Account 1
1 Subscription]
O2[Org: Sales Dept] --> BA1
O3[Org: IT Dept] --> BA1
O4[Org: Operations Dept] --> BA2[Billing Account 2
1 Subscription]
O5[Org: R&D Dept] --> BA2
end
```
## Performance Characteristics: Operation Complexity and Optimization
Workspace operations are optimized for performance, but complexity varies based on data relationships and scope:
### Operation Performance Characteristics
| Operation Type | Algorithmic Complexity | Performance Details |
| :-------------------------- | :--------------------- | :-------------------------------------------------- |
| **Organization Creation** | O(1) constant time | Single atomic write operation (\< 100ms) |
| **Organization Relocation** | O(n) linear time | Performance scales with descendant count |
| **Usage/Limit Calculation** | O(1) optimized | Batch operations avoid recursive queries (\< 200ms) |
| **Organization Listing** | O(n) paginated | 100-item pages typically load under 500ms |
### Performance Optimization Best Practices
1. **Optimize hierarchy design**: Favor wider, shallower structures over deep nesting for better performance and management
2. **Utilize batch operations**: Use bulk API endpoints for multiple entity operations to improve throughput
3. **Implement pagination**: Always use pagination cursors for large resource lists to ensure responsive performance
4. **Monitor operation patterns**: Track performance metrics to identify optimization opportunities
## Error Handling: Limit Enforcement and Resolution
Comprehensive error handling provides clear guidance when system limits are encountered:
### Common Limit Errors and Solutions
| Error Type | Root Cause | Resolution Strategy |
| :------------------------------ | :-------------------------------------------------- | :------------------------------------------------------------------------- |
| **Hierarchy Depth Exceeded** | Organization nesting beyond 10 levels | Restructure to wider hierarchy; use metadata for additional classification |
| **Maximum Children Exceeded** | More than 100 direct children | Create intermediate organizational layers grouped by function or region |
| **Subscription Limit Exceeded** | More than 3 subscriptions per billing account | Create additional billing accounts for extra subscriptions |
| **Resource Quota Exceeded** | Usage exceeds subscription or organizational limits | Upgrade subscription capacity or optimize resource usage |
## Growth Planning: Proactive Scaling and Monitoring
Proactive monitoring and capacity planning prevent unexpected limit encounters and ensure smooth scaling:
```mermaid theme={null}
graph LR
subgraph "Workspace Monitoring"
M1["Organizations
850 / 1,000
85% ⚠️"]
M2["Hierarchy Depth
Current Max: 7 / 10
70% ✓"]
M3["Billing Accounts
9 / 10
90% ⚠️"]
M4["Subscriptions on BA #1
3 / 3
100% ❌"]
end
```
### Enterprise Scaling Strategies
* **Workspace segmentation**: Split large enterprises across multiple workspaces by geography or business unit
* **Hierarchy optimization**: Regular review and flattening of organizational structures for improved management
* **Enterprise consultation**: Contact support for businesses projecting limit exceedance; enterprise plans offer customizable limits
* **Capacity planning**: Implement monitoring and alerting for proactive limit management
# Business Structure Modeling: Franchise, Enterprise, MSP & Partner Network Examples
Source: https://altostrat.io/docs/workspaces/modeling-your-business
Complete guide to modeling business structures with workspace billing modes and organization hierarchies. Real-world examples for franchises, multinational corporations, MSPs, channel partners, and traditional businesses with implementation steps.
## How to Model Your Business Structure
This comprehensive guide demonstrates how to model complex business structures using workspace billing modes and organization hierarchies. Each real-world scenario provides complete implementation guidance including billing mode selection, hierarchy design, and resource management configuration.
**What you'll learn:**
* Choose optimal billing modes for different business models
* Design organization hierarchies for complex structures
* Configure resource management and usage tracking
* Implement best practices for scalability and management
## Franchise Business Model: Multi-Location Brand Management
### Franchise Business Scenario
A restaurant franchise with 50 locations across multiple regions. Each location is independently owned and requires separate billing, while maintaining brand consistency and enabling resource sharing across the franchise network.
**Business requirements:**
* Independent billing for each franchisee
* Shared resource pool for brand consistency
* Regional management and reporting
* Flexible resource allocation across locations
### Recommended Configuration: Pooled Billing Mode
**Why Pooled Mode?** Enables independent franchisee billing while creating a shared resource pool for brand-wide consistency and resource flexibility.
### Implementation
```mermaid theme={null}
graph TD
subgraph "Franchise Workspace"
subgraph "Resource Pool"
BA1[Franchisee Smith
3 Locations]
BA2[Franchisee Jones
2 Locations]
BA3[Franchisee Chen
5 Locations]
end
subgraph "Organization Structure"
F[Franchise HQ]
R1[Region: Northeast]
R2[Region: Southwest]
L1[Location: Boston]
L2[Location: New York]
L3[Location: Phoenix]
L4[Location: Las Vegas]
F --> R1
F --> R2
R1 --> L1
R1 --> L2
R2 --> L3
R2 --> L4
end
end
```
### Franchise Implementation Steps
1. **Initialize Workspace**: Create workspace with Pooled billing mode for resource sharing
2. **Configure Franchisee Billing**:
* Create individual billing accounts for each franchisee
* Add secure payment methods for each account
* Purchase subscriptions based on franchisee location count and needs
3. **Design Organization Structure**:
* Create regional organizations for geographic management
* Add franchise locations under appropriate regional organizations
* Set location-specific resource limits as needed
4. **Setup Resource Management**:
* Configure subscription pooling across all franchisees
* Enable flexible resource allocation to any location
* Implement usage tracking for franchisee reporting and chargeback
### Franchise Model Benefits
* **Financial independence**: Each franchisee maintains separate billing and payment control
* **Resource flexibility**: Shared pool enables dynamic allocation during peak periods
* **Centralized management**: Brand-wide visibility and control for corporate oversight
* **Scalable growth**: Easy addition of new franchisees and locations to existing structure
## Multinational Corporation: Global Enterprise Structure
### Multinational Corporation Scenario
A global technology company with subsidiaries operating in USA, Germany, and Japan. Each country requires complete operational independence including separate budgets, local currencies, and compliance with regional regulations.
**Business requirements:**
* Complete financial and operational isolation between countries
* Multi-currency billing and reporting
* Regional compliance and audit capabilities
* Independent budget management per subsidiary
### Recommended Configuration: Assigned Billing Mode
**Why Assigned Mode?** Provides complete isolation between subsidiaries for compliance, financial accountability, and independent operations.
### Implementation
```mermaid theme={null}
graph TD
subgraph "Global Corporation Workspace"
BA1[Billing: USA Corp
Currency: USD
Budget: $2M]
BA2[Billing: Germany GmbH
Currency: EUR
Budget: €1.5M]
BA3[Billing: Japan KK
Currency: JPY
Budget: ¥200M]
USA[🇺🇸 USA Operations]
DE[🇩🇪 Germany Operations]
JP[🇯🇵 Japan Operations]
USA_S[Sales Team: 50 users]
USA_E[Engineering: 100 users]
USA_M[Marketing: 30 users]
DE_S[Vertrieb: 40 users]
DE_E[Entwicklung: 80 users]
JP_S[営業部: 30 users]
JP_P[製品部: 50 users]
BA1 --> USA
BA2 --> DE
BA3 --> JP
USA --> USA_S
USA --> USA_E
USA --> USA_M
DE --> DE_S
DE --> DE_E
JP --> JP_S
JP --> JP_P
end
```
### Setup Steps
1. **Create Workspace** with Assigned billing mode
2. **Establish Country Structure**:
* Create top-level organization for each country
* Create billing account for each country entity
* Assign billing account to corresponding organization
3. **Configure Billing Accounts**:
* Set appropriate currency for each account
* Add country-specific payment methods
* Purchase subscriptions based on local needs
4. **Build Department Structure**:
* Create child organizations for departments
* Set resource limits per department
* Configure approval workflows as needed
### Benefits
* Complete financial separation between countries
* Local currency billing and budgeting
* Compliance with regional regulations
* Clear cost center management
## Managed Service Provider (MSP): Multi-Client Service Management
### MSP Business Scenario
A managed service provider delivering IT services to 100+ diverse clients. Each client requires complete billing separation and resource isolation, with enterprise clients needing multiple invoices for different departments.
**Business requirements:**
* Complete client isolation and separate billing
* Scalable client onboarding and management
* Multiple invoice capability for enterprise clients
* Efficient resource allocation and usage tracking
### Recommended Configuration: Assigned Billing Mode
**Why Assigned Mode?** Ensures complete client isolation required for MSP operations while supporting complex enterprise client billing needs.
### Implementation
```mermaid theme={null}
graph TD
subgraph "MSP Workspace"
subgraph "Standard Clients"
BA1[Client A Billing]
O1[Client A Org]
BA1 --> O1
BA2[Client B Billing]
O2[Client B Org]
BA2 --> O2
end
subgraph "Enterprise Client with Multiple Invoices"
BA3["Enterprise Client - Billing Account
Subscription 1: Marketing (20 users)
Subscription 2: Operations (50 users)
Total Pool: 70 users"]
O3[Enterprise Client Org]
O3M[Marketing Dept]
O3O[Operations Dept]
BA3 --> O3
O3 --> O3M
O3 --> O3O
end
end
```
### Setup Steps
1. **Create Workspace** with Assigned billing mode
2. **Onboard Standard Clients**:
* Create organization for each client
* Create corresponding billing account
* Assign billing to organization
3. **Handle Enterprise Clients**:
* Single organization with child departments
* Single billing account with multiple subscriptions
* Each subscription generates separate invoice line
* Resources pool within the billing account
### Advanced Scenarios
#### Multiple Invoice Requirements
When a client needs more than 3 separate invoices (subscription limit):
1. Create additional billing account for same client
2. Use organization hierarchy to maintain unified structure
3. Assign different departments to different billing accounts
### Benefits
* Complete client isolation
* Flexible invoicing options
* Scalable client management
* Clear usage tracking per client
## Channel Partner / Reseller Network
### Scenario
A software vendor selling through a multi-tier partner channel. Need to track usage and manage resources through multiple levels of resellers down to end customers.
### Recommended Configuration
**Organization Hierarchy** (Billing mode depends on commercial model)
### Implementation
```mermaid theme={null}
graph TD
subgraph "Partner Channel Hierarchy"
V[Vendor/Root]
MP1[Master Partner A
Limit: 1000 users]
MP2[Master Partner B
Limit: 500 users]
RP1[Regional Partner 1
Limit: 400 users]
RP2[Regional Partner 2
Limit: 300 users]
RP3[Regional Partner 3
Limit: 200 users]
C1[Customer 1
Usage: 50 users]
C2[Customer 2
Usage: 100 users]
C3[Customer 3
Usage: 75 users]
C4[Customer 4
Usage: 60 users]
V --> MP1
V --> MP2
MP1 --> RP1
MP1 --> RP2
MP2 --> RP3
RP1 --> C1
RP1 --> C2
RP2 --> C3
RP3 --> C4
C1 -.50.-> RP1
C2 -.100.-> RP1
C3 -.75.-> RP2
C4 -.60.-> RP3
RP1 -.150 total.-> MP1
RP2 -.75 total.-> MP1
RP3 -.60 total.-> MP2
end
```
### Setup Steps
1. **Design Channel Structure**:
* Map out partner tiers and relationships
* Determine resource allocation strategy
* Plan for usage reporting needs
2. **Create Organization Hierarchy**:
* Top-level: Master partners
* Mid-level: Regional partners
* Leaf-level: End customers
3. **Configure Resource Limits**:
* Set limits at each partner level
* Limits cascade down the hierarchy
* Most restrictive limit applies
4. **Enable Usage Tracking**:
* Direct usage at customer level
* Automatic aggregation up the tree
* Partner dashboards for visibility
### Benefits
* Complete channel visibility
* Automated usage rollup
* Flexible resource allocation
* Partner-specific limits and controls
## Traditional Business
### Scenario
A mid-size company with 200 employees across Sales, Marketing, Engineering, and Operations. All departments share the same budget and resources.
### Recommended Configuration
**Billing Mode**: Single
### Implementation
```mermaid theme={null}
graph LR
subgraph "Company Workspace"
BA[Company Billing Account
200 User Licenses
Premium Features]
O[Company Root]
S[Sales: 50 users]
M[Marketing: 30 users]
E[Engineering: 80 users]
OP[Operations: 40 users]
BA --> O
O --> S
O --> M
O --> E
O --> OP
end
```
### Setup Steps
1. **Create Workspace** with Single billing mode
2. **Set Up Billing**:
* Create single billing account
* Add payment method
* Purchase subscription for total needs
3. **Create Departments**:
* Create organizations for each department
* Optionally set departmental limits
* All draw from same resource pool
### Benefits
* Simple, unified billing
* Flexible resource sharing
* Easy to manage
* Single invoice for accounting
## Key Considerations
### Choosing the Right Model
1. **Financial Structure**
* Unified budget → Single or Pooled mode
* Separate budgets → Assigned mode
2. **Resource Sharing**
* Full sharing → Single mode
* Controlled sharing → Pooled mode
* No sharing → Assigned mode
3. **Compliance Requirements**
* Strict separation → Assigned mode
* Audit trails → Any mode with proper hierarchy
4. **Scalability**
* Plan for growth in organization structure
* Consider future billing requirements
* Design hierarchy for long-term needs
## What's Next?
* Deep dive into [Organization Hierarchies](/docs/workspaces/organization-hierarchies)
* Learn about [Subscriptions and Invoicing](/docs/workspaces/subscriptions-and-invoicing)
* Review [System Limitations](/docs/workspaces/limitations) for planning
# Organization Hierarchies: Multi-Level Structure Design with Usage Tracking & Limits
Source: https://altostrat.io/docs/workspaces/organization-hierarchies
Complete guide to building organization hierarchies with up to 10 levels of nesting. Learn usage aggregation, limit enforcement, and best practices for modeling complex business structures including enterprises, franchises, and partner networks.
## What are Organization Hierarchies?
Organization hierarchies provide the structural foundation for modeling complex business relationships within workspaces. These flexible tree structures support everything from simple departmental layouts to sophisticated multi-tier partner networks with automatic resource management.
**Organization hierarchy capabilities:**
* Model complex business structures up to 10 levels deep
* Automatic usage aggregation from leaf to root organizations
* Cascading limit enforcement with inheritance
* Scalable from small teams to enterprise partner networks
* Real-time resource tracking and allocation
## How Organization Hierarchies Work
Organization hierarchies create sophisticated tree structures with automatic resource management and limit enforcement:
**Hierarchy structure limits:**
* **Maximum depth**: 10 levels of nesting
* **Maximum children**: 100 direct children per organization
* **Scalable design**: Support for complex enterprise structures
**Automatic resource management:**
* **Usage aggregation**: Resource consumption flows up from children to parents
* **Limit inheritance**: Limits cascade down with most restrictive taking precedence
* **Real-time tracking**: Instant visibility into resource consumption across levels
* **Flexible allocation**: Dynamic resource sharing within hierarchy boundaries
```mermaid theme={null}
graph TD
R[Root Organization]
A[Division A]
B[Division B]
A1[Team A1]
A2[Team A2]
B1[Department B1]
B2[Department B2]
A21[Subteam A21]
A22[Subteam A22]
R --> A
R --> B
A --> A1
A --> A2
B --> B1
B --> B2
A2 --> A21
A2 --> A22
```
## Usage Tracking: Automatic Resource Aggregation
Organization hierarchies provide sophisticated usage tracking with automatic aggregation for complete resource visibility at every level:
### How Usage Tracking Works
Every organization maintains dual usage metrics for comprehensive resource monitoring:
* **Direct Usage**: Resources consumed directly by the organization (excluding children)
* **Subtree Usage**: Combined usage including the organization and all descendants
**Benefits of automatic aggregation:**
* Real-time visibility into resource consumption across all levels
* Accurate cost allocation and chargeback capabilities
* Automatic limit enforcement with hierarchical context
* Simplified reporting and capacity planning
```mermaid theme={null}
graph TD
subgraph "Usage Aggregation Example"
R["Company HQ
Direct: 10
Subtree: 135"]
E["Engineering
Direct: 5
Subtree: 75"]
S["Sales
Direct: 10
Subtree: 50"]
E1["Backend Team
Direct: 30"]
E2["Frontend Team
Direct: 40"]
S1["North Region
Direct: 15"]
S2["South Region
Direct: 25"]
R --> E & S
E --> E1 & E2
S --> S1 & S2
E1 -- "30" --> E
E2 -- "40" --> E
S1 -- "15" --> S
S2 -- "25" --> S
E -- "75" --> R
S -- "50" --> R
end
```
### Usage Aggregation Example
This example demonstrates how resource usage automatically aggregates up the hierarchy:
* **Engineering subtree usage (75)**: Direct usage (5) + children's direct usage (30 + 40)
* **Sales subtree usage (50)**: Direct usage (10) + children's direct usage (15 + 25)
* **Company HQ subtree usage (135)**: Direct usage (10) + children's subtree usage (75 + 50)
## Limit Enforcement: Hierarchical Resource Control
Organization hierarchies provide sophisticated limit enforcement using a "most restrictive wins" approach for precise resource control across complex structures.
### How Hierarchical Limits Work
Effective limits for any organization are determined by the most restrictive value from three sources:
1. **Subscription capacity**: Total resources available from billing account
2. **Organization-specific limits**: Limits set directly on the organization
3. **Parent organization limits**: All limits up the hierarchy chain
### Limit Interpretation Rules
* **No limit set (`null`)**: Inherits from parent or subscription (allows free resource flow)
* **Limit set to `0`**: Explicit resource denial for organization and all descendants
* **Limit set to positive value**: Enforced cap that cannot exceed parent or subscription limits
```mermaid theme={null}
graph TD
subgraph "Limit Inheritance Example"
S["Subscription
Capacity: 100 users"]
R["Root Org
Limit: 80 users"]
D1["Division 1
Limit: 50 users"]
D2["Division 2
Limit: (not set)"]
T1["Team 1
Limit: 30 users
Effective: 30 ✓"]
T2["Team 2
Limit: (not set)
Effective: 50 ✓"]
T3["Team 3
Limit: 60 users
Effective: 50 ⚠️"]
T4["Team 4
Limit: (not set)
Effective: 80 ✓"]
S -.-> R
R --> D1 & D2
D1 --> T1 & T2 & T3
D2 --> T4
end
```
### Limit Inheritance Example
This example shows how limits cascade through the hierarchy:
* **Team 1**: Uses its explicit 30-user limit
* **Team 2**: Inherits 50-user limit from Division 1 parent
* **Team 3**: Requested 60 users but limited to 50 by Division 1 parent
* **Team 4**: Inherits 80-user limit from Root Organization
## Real-World Organization Hierarchy Use Cases
Organization hierarchies support diverse business models and operational structures:
### Multi-Tier Reseller Network: Channel Partner Management
Perfect for software vendors managing complex channel partner relationships with automatic usage aggregation and limit enforcement throughout the partner ecosystem.
**Key benefits:**
* Automatic usage rollup from end customers to vendors
* Cascading limits from master distributors to resellers
* Real-time channel performance visibility
* Flexible resource allocation across partner tiers
```mermaid theme={null}
graph TD
V["Vendor"]
D1["Distributor A
Limit: 1000 licenses"]
D2["Distributor B
Limit: 500 licenses"]
R1["Reseller 1
Limit: 300"]
R2["Reseller 2
Limit: 200"]
R3["Reseller 3
Limit: 400"]
C1["Customer ABC
Using: 50"]
C2["Customer XYZ
Using: 75"]
C3["Customer 123
Using: 100"]
V --> D1 & D2
D1 --> R1 & R2
D2 --> R3
R1 --> C1
R2 --> C2
R3 --> C3
```
### Enterprise Department Structure: Corporate Hierarchy Management
Model sophisticated corporate structures with geographic and functional organization for enterprise resource allocation and compliance management.
**Use cases:**
* Regional resource allocation and budgeting
* Departmental cost center management
* Compliance boundary enforcement
* Global office and subsidiary management
```mermaid theme={null}
graph TD
HQ["Global HQ"]
NA["North America"]
EU["Europe"]
US["United States"]
CA["Canada"]
UK["United Kingdom"]
DE["Germany"]
NYC["New York Office"]
SF["San Francisco Office"]
HQ --> NA & EU
NA --> US & CA
EU --> UK & DE
US --> NYC & SF
```
### Franchise Operations: Multi-Location Brand Management
Organize franchise networks with regional and district structures for comprehensive brand management while maintaining individual franchisee autonomy.
**Capabilities:**
* Regional and district-level organization
* Store-specific resource limits and tracking
* Franchise-wide performance visibility
* Automated usage aggregation for reporting
```mermaid theme={null}
graph TD
F["Franchise Corporate"]
R1["Region: Northeast"]
R2["Region: Southwest"]
D1["District: Boston Metro"]
D2["District: NYC Metro"]
D3["District: Phoenix"]
L1["Store #001"]
L2["Store #002"]
L3["Store #003"]
F --> R1 & R2
R1 --> D1 & D2
R2 --> D3
D1 --> L1 & L2
D3 --> L3
```
## Organization Hierarchy Best Practices
Follow these proven practices for optimal hierarchy design and management:
### Hierarchy Design Principles
1. **Mirror business structure**: Align organization names with actual business units and reporting relationships
2. **Optimize for simplicity**: Use shallow hierarchies when possible for easier management and understanding
3. **Plan for evolution**: Design with future reorganizations in mind as moves affect usage and limits
4. **Consider scale**: Balance hierarchy depth with operational complexity
### Operational Management
1. **Monitor usage patterns**: Regular review of subtree usage for capacity planning and optimization
2. **Implement alerting**: Proactive monitoring for organizations approaching resource limits
3. **Audit hierarchy structure**: Periodic review of organization structure for optimization opportunities
4. **Document relationships**: Maintain clear documentation of business logic behind hierarchy design
## Technical Architecture and Performance
Organization hierarchies are built with enterprise-grade technical capabilities:
### Performance Optimization
* **Atomic operations**: All hierarchy updates use atomic transactions for data consistency
* **Efficient queries**: Path-based queries instead of recursive lookups for better performance
* **Scalable design**: Optimized for deep hierarchies and large organization counts
* **Concurrent support**: High-concurrency operations without performance degradation
### Enterprise Features
* **Complete audit trail**: All modifications logged for compliance and debugging
* **Real-time consistency**: Immediate reflection of changes across all hierarchy levels
* **Distributed locking**: Prevents race conditions in high-traffic environments
# Subscription Management & Invoicing: Resource Pooling, Billing Cycles & Payment Processing
Source: https://altostrat.io/docs/workspaces/subscriptions-and-invoicing
Complete guide to workspace subscription management including resource pooling, trial subscriptions, payment methods, invoicing, and usage metering. Learn billing account limits and subscription lifecycle management.
## What is Subscription Management?
Subscription management defines the resources available to your workspace and how billing is processed. This comprehensive system handles resource allocation, payment processing, usage metering, and invoice generation through integrated Stripe billing.
**Key subscription capabilities:**
* Resource pooling across multiple subscriptions
* Automated billing cycles and invoice generation
* Trial subscription management
* Usage metering and limit enforcement
* Multi-payment method support
## How Subscriptions Work with Billing Accounts
Subscriptions connect billing accounts to resource allocation, providing specific quantities of products (users, locations, SSO connections) that organizations can consume. Each subscription generates automated invoices processed through Stripe integration.
**Subscription architecture:**
* Each subscription belongs to a specific billing account
* Subscriptions provide defined quantities of products/resources
* Multiple subscriptions per billing account enable resource pooling
* Automated invoice generation and payment processing
```mermaid theme={null}
graph LR
BA[Billing Account] --> S1[Subscription 1]
BA --> S2[Subscription 2]
S1 --> P1[Product: Users
Quantity: 50]
S1 --> P2[Product: SSO
Quantity: 1]
S2 --> P3[Product: Users
Quantity: 30]
S2 --> P4[Product: Locations
Quantity: 5]
subgraph "Pooled Resources in Billing Account"
PR[Total Users: 80
Total SSO: 1
Total Locations: 5]
end
P1 & P3 -- contributes to --> PR
P2 -- contributes to --> PR
P4 -- contributes to --> PR
```
## Resource Pooling: Subscription Aggregation in Billing Accounts
Resource pooling automatically combines product quantities from multiple subscriptions within a billing account, creating larger, more flexible resource pools for dynamic allocation.
**How resource pooling works:**
* Multiple subscriptions within a billing account automatically pool resources
* Different product types combine separately (users + users, locations + locations)
* Organizations draw from the combined resource pool
* Enables flexible allocation beyond individual subscription limits
### Resource Pool Access and Allocation
Organizations access pooled resources based on billing account relationships and workspace billing mode configuration:
```mermaid theme={null}
graph TD
subgraph "Billing Account: ACME Corp"
S1["Subscription 1
(Marketing Dept)
20 Users"]
S2["Subscription 2
(Sales Dept)
30 Users"]
S3["Subscription 3
(Engineering Dept)
50 Users"]
subgraph "Available Resource Pool"
Pool["Total Capacity: 100 Users"]
end
S1 --> Pool
S2 --> Pool
S3 --> Pool
end
O1[Marketing Org
Using: 25 users]
O2[Sales Org
Using: 40 users]
O3[Engineering Org
Using: 35 users]
Pool -.-> O1 & O2 & O3
```
### Resource Pooling Benefits
1. **Dynamic allocation**: Organizations can exceed individual subscription limits as long as total usage stays within pooled capacity
2. **Financial flexibility**: Separate invoicing for each subscription enables clear budget tracking and departmental billing
3. **Scalable capacity**: Add temporary subscriptions for seasonal demands without modifying base subscription structure
4. **Cost optimization**: Maximize resource utilization across organizational units
### Subscription Limits and Workarounds
**Important**: Each billing account supports maximum **3 active subscriptions**. For customers requiring additional distinct invoices, create multiple billing accounts to exceed this limit.
## Trial Subscriptions: Free 14-Day Platform Access
New workspaces automatically qualify for comprehensive 14-day trials providing full platform access without upfront payment requirements, enabling complete evaluation of workspace capabilities.
### Trial Eligibility Requirements
Workspace trial eligibility follows strict criteria to ensure fair access:
**Automatic trial qualification requires:**
* ✅ Exactly one billing account in the workspace
* ✅ No prior or existing subscriptions on that billing account
**Trial disqualification occurs when:**
* Multiple billing accounts exist in workspace
* Any subscription has been previously activated
* Trial period has been previously utilized
```mermaid theme={null}
graph LR
NW[New Workspace] --> BA[Create Single Billing Account]
BA -- No subscriptions? --> TRIAL[Activate 14-Day Trial]
TRIAL --> CONVERT{Day 14}
CONVERT -->|Payment Method Added| PAID[Convert to Paid Subscription]
CONVERT -->|No Payment Method| SUSPEND[Access Suspended]
```
### Trial Conversion: Seamless Transition to Paid Service
Ensure uninterrupted service by adding payment methods before trial expiration. The system automatically handles conversion to paid subscriptions with immediate invoice generation.
**Conversion process:**
1. Add default payment method before trial expiration
2. System automatically converts trial to paid subscription
3. First invoice generated immediately upon conversion
4. Uninterrupted access to all workspace features
## Advanced Subscription Management
Comprehensive subscription management capabilities for dynamic resource allocation and billing optimization:
### How to Modify Active Subscriptions
Dynamic subscription modification supports real-time business needs while protecting against service disruption:
**Available modifications:**
* Adjust product quantities (increase or decrease)
* Add or remove products from existing subscriptions
* Change billing cycle frequency (monthly/annual)
* Modify subscription pricing tiers
**Protection mechanisms:**
* Prevent capacity reduction below current usage levels
* Validate changes against organizational limits
* Ensure service continuity during modifications
```mermaid theme={null}
graph TD
CURRENT[Current Subscription
50 Users, Monthly]
MODIFY{Modification Request}
subgraph "Possible Changes"
UP[Upgrade to 100 Users]
DOWN[Downgrade to 25 Users]
ADD[Add 10 Locations]
end
CURRENT --> MODIFY
MODIFY --> UP & DOWN & ADD
UP --> IMMEDIATE[Change takes effect immediately.
Prorated charge on next invoice.]
DOWN --> NEXT_CYCLE[Change takes effect at the start of the next billing cycle.]
ADD --> IMMEDIATE
```
### Subscription Lifecycle
The status of a subscription changes based on user actions and payment events.
```mermaid theme={null}
stateDiagram-v2
[*] --> Trialing: New eligible workspace
[*] --> Active: Direct purchase with payment method
Trialing --> Active: Payment method added
Active --> Canceled: User cancels
Active --> Past_Due: Payment fails
Past_Due --> Active: Payment succeeds
Past_Due --> Unpaid: Grace period ends
Unpaid --> Canceled: Deemed uncollectible
Canceled --> [*]: Subscription terminated
```
## Invoice Management: Automated Billing and Payment Processing
Comprehensive invoice management through Stripe integration provides automated billing cycles, payment processing, and detailed financial reporting.
### Invoice Structure and Components
Detailed invoice breakdowns provide complete transparency for financial tracking and accounting:
**Standard invoice elements:**
* Subscription line items with product quantities and rates
* Tax calculations based on billing address and regulations
* Applied discounts, credits, and promotional adjustments
* Clear subtotals and final amount due
```mermaid theme={null}
graph TD
INV[Invoice #1234]
subgraph "Line Items"
L1[Subscription: User Licenses
50 × $10 = $500]
L2[Subscription: Locations
5 × $50 = $250]
L3[Credit: Promotional
-$50]
end
subgraph "Summary"
SUB[Subtotal: $700]
TAX[Tax: $70]
TOT[Total Due: $770]
end
INV --> L1 & L2 & L3
L1 & L2 & L3 --> SUB
SUB --> TAX
TAX --> TOT
```
### Invoice Preview: Understand Financial Impact Before Changes
Preview upcoming invoices before finalizing subscription modifications to understand complete financial impact including prorated charges and adjustments.
**Preview capabilities:**
* View financial impact of quantity changes
* Calculate prorated charges for mid-cycle modifications
* Understand tax implications of subscription changes
* Preview total cost before confirming modifications
## Payment Method Management: Secure Multi-Method Support
Comprehensive payment method management with secure storage and automated failover capabilities through Stripe integration.
**Payment method capabilities:**
* Store up to 5 payment methods per billing account
* Secure tokenization and PCI compliance through Stripe
* Automated payment method failover and retry logic
* Support for multiple payment types (cards, bank transfers)
```mermaid theme={null}
graph LR
BA[Billing Account]
PM1[💳 Visa ****1234
Default]
PM2[💳 Amex ****5678
Backup]
PM3[🏦 Bank ****9012
For Large Invoices]
BA --> PM1
BA --> PM2
BA --> PM3
```
### Payment Method Hierarchy and Failover
* **Primary payment method**: Default method charged for all invoices and subscriptions
* **Backup payment methods**: Automatic failover when primary method fails
* **Intelligent retry logic**: Systematic retry across available payment methods
* **Proactive notifications**: Automated alerts for payment failures and card expirations
## Usage Metering: Resource Consumption Tracking and Enforcement
Sophisticated usage metering system tracks resource consumption against subscription limits with real-time enforcement and accurate billing protection.
**Usage metering features:**
* Real-time resource consumption tracking
* Automatic limit enforcement across organization hierarchies
* Subscription-based metering (not pay-as-you-go)
* Comprehensive usage reporting and analytics
### Usage Tracking Process and Validation
Usage tracking employs sophisticated validation against organizational limits and subscription pools with real-time enforcement:
**Tracking workflow:**
1. Product services report usage to workspace API
2. System validates against effective organizational limits
3. Subscription pool capacity checked in real-time
4. Usage accepted or rejected based on available capacity
5. Atomic updates ensure data consistency and accuracy
```mermaid theme={null}
sequenceDiagram
participant Product Microservice
participant Workspace API
participant Stripe & DynamoDB
Product Microservice->>+Workspace API: Report Usage (+1 User for Org X)
Workspace API->>+Stripe & DynamoDB: Lock resource pool for Org X
Workspace API->>Workspace API: Check current usage vs. limits
alt Usage is within limits
Workspace API->>+Stripe & DynamoDB: Atomically increment usage counter
Stripe & DynamoDB-->>-Workspace API: Success
Workspace API-->>-Product Microservice: OK (202)
else Usage exceeds limits
Workspace API-->>Product Microservice: Limit Exceeded (422)
end
Stripe & DynamoDB-->>-Workspace API: Release lock
```
### Usage Metering Reliability and Accuracy
Enterprise-grade usage metering with comprehensive protection against billing errors and resource over-consumption:
**Reliability mechanisms:**
* **Race condition prevention**: Distributed locking ensures sequential processing of concurrent usage reports
* **Idempotent operations**: Duplicate usage reports automatically detected and prevented
* **Hierarchical validation**: Most restrictive limits enforced across organization and subscription boundaries
* **Atomic transactions**: Database operations ensure complete consistency and accuracy