Operator Console

The Server Operator Console is the day-to-day control surface for customer IT. It runs on-prem on port 18084 and is authenticated by Keycloak SSO (OIDC/PKCE).

Pages

Eight pages:

Overview · Deployment · Models · Data & Knowledge · Governance · Identity & Access · API Access · Settings

Every procedure below is Bucket A — a working console screen and a working write (or read) endpoint. Safe to treat as customer-performable today.

Before you start

1. Confirm you can reach the console (typically http://<host>:18084 — verify bind address on your appliance).
2. Sign in with a mutating role (it_admin or app_owner) unless you only need to read. The auditor role is read-only; mutations return 403 (RES-ADMIN-403).
3. Read What still needs Residion so you do not spend time looking for connector-credential or SSO-save screens that do not exist.

Guide index

Page	What you can do
Sign in and roles	SSO login, RBAC, auditor 403
Overview	Landing orientation
Deployment	View status + install plan
Models	Activate models; set workload routing
Data & Knowledge	Connector status; trigger ingestion
Governance	Audit export; agent journal; budgets
Identity & Access	Agent channels (not IdP federation)
API Access	Keys, quotas, usage
Settings	View settings

Admin API

Console actions map to /v1/admin/... routes. A compact surface list lives under Admin API surface. Prefer the console unless you have a reason to call the API directly.