Skip to main content
Version: 0.17

Workspaces and sections

Overview​

TokenTimer supports organizations through Workspaces and role-based access control (RBAC). Workspaces isolate tokens, alert preferences, and audit events. RBAC defines who can manage or view them.

Choose a workspace or a section​

Choose the right boundary to keep ownership and notifications clean and predictable.

  • Create a new workspace when you need:
    • Isolated workspaces and notifications (e.g. different default contact points).
    • Separate audit and membership boundaries (e.g. different customers).
  • Create a new section when you need:
    • Separate tokens by teams, products, or environments inside the same workspace.
    • Filter the dashboard by team or environment. Sections do not create a membership boundary or automatically assign recipients; assign contact groups to the assets themselves.

Give teammates access​

Workspace alert preferences​

Default thresholds and channels are configured per workspace. Recipients are managed via contact groups; a token uses its selected groups (one or more when plural writes are enabled), falling back to the workspace's default group when none are assigned. Groups can optionally define their own thresholds policy which overrides workspace defaults for that group; multi-group tokens use the union of effective thresholds.

  • Use sections to organize assets and filter dashboards; assign contact groups to route notifications.
  • Changes to workspace thresholds apply to tokens without a group thresholds override.

Transferring tokens between workspaces​

Move tokens from one workspace to another without re-creating them. This keeps alert settings and history attributed to the correct workspace going forward.

  • Where: open Workspaces, pick a workspace, then click Transfer tokens.
  • Who: you need Admin or Workspace Manager access in both source and destination. A Workspace Manager must belong to at least two workspaces.

Transfer steps​

  • In the Workspace section, click on "Transfer tokens", select the source and destination workspaces.
  • Use the search, category, or section filters to narrow the list.
  • Select individual tokens or select all filtered tokens, then click Transfer selected.
Review alert routing and renewal configuration after transfer

Linked domain monitors and managed certificates move with the token, together with their associated targets, instances, jobs, and evidence. Destination identity or idempotency conflicts can block the transfer. Workspace renewal profiles do not move: certificate and target profile links are cleared. Contact-group assignments keep an ID already present in the destination; otherwise they are matched by case-insensitive group name. Unmatched assignments are removed. Check recipients and configure renewal profiles and an eligible agent in the destination before relying on alerts or automatic renewal. Agent enrollment and private keys are not transferred by this action.

Delete a workspace​

Deleting a workspace removes its tokens, members, sections, invitations, and settings. Audit and delivery logs remain for history, with their workspace unlinked.

  • Consider transferring tokens to another workspace beforehand if you still need alerts.
  • Export data for an offline record.
warning

This action is irreversible. Consider exporting data before deletion.