> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rapidcert.co.nz/llms.txt
> Use this file to discover all available pages before exploring further.

# Users & Viewers

> Managing admin users and viewer accounts in RapidCert

# Users & Viewers

This guide covers managing administrator users and viewer accounts.

## Admin Users

### User list

Navigate to **Users** to see all admin users.

Each user shows:

| Column     | Description                                                                       |
| ---------- | --------------------------------------------------------------------------------- |
| Name       | User's full name and email address                                                |
| Role       | Admin or Assessor                                                                 |
| Status     | Active or Inactive                                                                |
| Last Login | When the user last signed in                                                      |
| Actions    | Edit, Impersonate (support use only — see below), and Deactivate/Activate buttons |

### Creating users

<Steps>
  <Step title="Click Add User">
    Go to **Users** and click **Add User**.
  </Step>

  <Step title="Enter details">
    Provide the user's name, email address, and role.
  </Step>

  <Step title="Save">
    The user is created and can sign in using the passwordless one-time code sent to their email.
  </Step>
</Steps>

### User roles

| Role     | Capabilities                                                                                                                                                                                  |
| -------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Admin    | Full access — user management, templates, questions, settings, company billing, and revenue reporting                                                                                         |
| Assessor | Review evaluations, manage companies, verify insurance, manage documents, create evaluations, manage notification settings, templates and questions management, view dashboard health metrics |

### Editing users

1. Click on a user in the list
2. Modify details or role
3. Save changes

<Note>
  A user's email address cannot be changed. To change an email, the account must be deleted and recreated with the new address.
</Note>

### Editing viewers

To edit a viewer's details:

1. Navigate to **Clients** in the sidebar
2. Select the client the viewer is assigned to
3. Go to the **Access** tab
4. Find the viewer in the list and click **Edit**
5. Modify the viewer's full name
6. Save changes

<Info>
  The viewer's full name can be edited. An **Admin Viewer** permission checkbox is also available when editing a viewer. Email cannot be changed — to change a viewer's email, create a new viewer account.
</Info>

<Warning>
  The **Save Changes** button will be disabled if the client context cannot be resolved. If you see an error message stating "Viewer client access could not be resolved for this client", ensure you have selected a valid client before attempting to edit viewer details.
</Warning>

### Deactivating users

To disable a user account:

1. Find the user in the **Users** table and click **Deactivate** in the **Actions** column
2. Confirm

<Note>
  Deactivating a user immediately revokes all of their active sessions. They are signed out within seconds and cannot log in again until the account is re-enabled. Their history is preserved.
</Note>

### Impersonating users

The **Impersonate** button on the Users page allows administrators to log in as another user. This feature is intended **for support purposes only** — for example, to see exactly what a contractor/supplier sees in order to help them troubleshoot an issue.

<Warning>
  All impersonation sessions are logged for auditing purposes. Use impersonation only when you need to assist a user and cannot resolve their issue without seeing their view of the system.
</Warning>

<Note>
  Impersonation is not available for users who belong to a company linked to more than one tenant. If you attempt to impersonate such a user, the action will be blocked with a permission error. Contact your RapidCert administrator if you need to assist a user in this situation.
</Note>

## Viewer Accounts

Viewers have read-only access to companies within their assigned client. They are created and managed from the **Clients** page, not from a separate viewers page.

### Creating viewers

Viewers are added within a specific client's settings:

<Steps>
  <Step title="Open the client">
    Navigate to **Clients** in the sidebar and select the client you want to add a viewer to.
  </Step>

  <Step title="Go to the Access tab">
    Select the **Access** tab on the client page.
  </Step>

  <Step title="Add a viewer">
    Click **Add Viewer** and enter the viewer's name and email address. The **Send welcome email** checkbox is checked by default — uncheck it if you do not want an invitation email sent.
  </Step>

  <Step title="Save">
    The viewer is created and assigned to this client. If the welcome email option was left checked, they receive an invitation email. Their account remains **pending** until their first successful login.
  </Step>
</Steps>

<Info>
  Viewers are scoped to a client — they can see **all companies** within that client. There is no per-company assignment for viewers.
</Info>

<Note>
  Pending viewers can request a login code at the login screen. The code is delivered to their email, and the account is activated on first successful login. A request during the cooldown window does not send another email; after the cooldown, the same unexpired code may be sent again.
</Note>

### Viewer permissions

Viewers can:

* View all company profiles within their assigned client
* View evaluation status and certifications
* View insurance status
* Download certificates

Viewers cannot:

* Edit any data
* Assess evaluations
* Access companies outside their assigned client

### Per-client evaluation access control

By default, viewers can see company profiles but not full evaluation details. You can enable or disable viewer access to evaluations on a per-client basis using the **Allow Viewers to View Evaluations** toggle.

To configure this:

1. Navigate to **Clients** in the sidebar
2. Open the client you want to configure
3. On the **Access** tab, toggle **Allow Viewers to View Evaluations** on or off
4. Save

When enabled, viewers assigned to that client can:

* View full evaluation details (responses, scores, comments)
* Download certificate PDFs and full report PDFs for approved evaluations
* Access evaluation history

When disabled, viewers see company profiles and certification status but cannot open individual evaluations. Attempts to access evaluation details return a not-found response rather than an access-denied error, so no evaluation metadata is leaked.

<Note>
  This setting applies to all viewers under the client. You cannot enable evaluation access for individual viewers — it is controlled at the client level.
</Note>

### Viewing viewer email history

You can view email delivery history for individual viewers to troubleshoot login issues or verify invitation delivery. To access a viewer's email history:

1. Navigate to **Clients** in the sidebar
2. Select the client the viewer is assigned to
3. Go to the **Access** tab
4. Find the viewer in the list and click **View Emails**

The email history shows authentication codes and invitation emails sent to the viewer within the last 12 months, including delivery status and whether login codes were successfully used.

For full details on viewer email history, see the [Email Management guide](/guides/admins/email-management#viewer-email-history).

### Removing viewer access

To remove a viewer, open the client's **Access** tab, find the viewer in the list, and click **Delete**. Viewers are deleted, not deactivated.

## Authentication & Security

### Passwordless login

All users (admins, assessors, and viewers) sign in using a one-time code sent to their email address. There are no passwords to manage.

### Resetting access

If a user needs a new verification code:

1. They request a new code at the login screen
2. The code is sent to their email
3. No admin action is needed

## Best Practices

<Tip>
  Regularly review user accounts and remove access for people who no longer need it.
</Tip>

* Use appropriate role levels
* Review access quarterly
* Deactivate departed staff promptly
* Limit admin accounts

## Troubleshooting

<AccordionGroup>
  <Accordion title="User can't log in">
    * Verify the email address is correct
    * Check the account isn't deactivated
    * Have them request a new verification code at the login screen
    * For a newly created pending viewer, confirm they are using the invitation email address. Pending viewers can request a code normally; a recent request within the cooldown window is suppressed, and the same unexpired code may be sent again after the cooldown.
  </Accordion>

  <Accordion title="User can't see expected data">
    * Check client assignments
    * Verify role permissions
    * For viewers, confirm they are assigned to the correct client
  </Accordion>

  <Accordion title="Can't save changes when editing a viewer">
    * Ensure you have selected a valid client before opening the edit viewer modal
    * If you see "Viewer client access could not be resolved", navigate back to the Clients page and select the correct client
    * The Save Changes button will be disabled until a valid client context is established
  </Accordion>

  <Accordion title="Need to remove a user completely">
    * Deactivate the account
    * Contact support for permanent deletion (if required)
  </Accordion>
</AccordionGroup>

## Next Steps

<Card title="Settings" icon="gear" href="/guides/admins/settings-configuration">
  Configure platform settings
</Card>