Reference
Users and API tokens
User roles and what each may do, read-only accounts, sessions, password rules, login throttling, and API tokens for scripts and Prometheus.
Configure → Users (admins) manages who can sign in, and the API tokens for scripts and monitoring.
| Role | Can |
|---|---|
| Viewer | See traffic, attacks, mitigations, System, and the configuration pages that every role can read (Exporters, Interface settings, Networks, Hostgroups, Classification, BGP). Change nothing |
| Operator | Everything a viewer can, plus: mitigate an address by hand, withdraw and extend mitigations, the emergency withdraw-all, the whitelist, and host display names |
| Admin | Everything: all configuration, users and tokens, settings, the audit log, export and import, the license, resuming after a withdraw-all, and the support file |
Every user can change their own password and keep their own saved views.
Read-only accounts
Section titled “Read-only accounts”A user marked Read-only sees what their role sees but can change nothing at all, not even their own password or saved views. From v3.2.0 it also can’t download a support file, even with the admin role. It’s meant for a shared login, such as a demo. Failed logins never lock a read-only account by name, so nobody can lock it for everyone else. Settings → Login page can show a note under the login form, for example the demo credentials.
Passwords and sessions
Section titled “Passwords and sessions”- Passwords need at least 10 characters. Setting a new password for a user ends their sessions.
- A session lasts 12 hours without activity, and 7 days at most.
- Admins can list a user’s signed-in sessions (address, browser, when it started and its last request) and end any of them.
- Login throttling. After 5 failed attempts for a username, or 20 from one address, each further attempt must wait (1 second, then 2, 4… up to 15 minutes); a success clears it. There’s no hard lockout, so an attacker can’t lock the admin out. Every login, failure and logout is in the audit log.
- Lost the last admin password? See Common problems.
API tokens
Section titled “API tokens”API tokens let scripts and Prometheus use the API without a session. Each has a name, a role (viewer, operator or admin, with the same rights as a user) and an expiry (Expires after (days), 0 for never).
The token is shown once, when it’s created: copy it then. Heimnull stores only a hash. Send it as a bearer token:
curl -H "Authorization: Bearer $HN_TOKEN" http://heimnull.example.net/api/healthzGive each script its own token with the lowest role it needs, so you can revoke one without the others. For Prometheus, a viewer token is enough. See API and metrics.