Managing Users, Permissions, and API Keys in the Incident IQ Integration

Overview

Access to Senturo actions in Incident IQ is controlled per user. Each person is added to the integration individually, given their own API key, and assigned a specific set of permissions that determines which parts of the Senturo Device Console they can reach.

This article covers the full administrator workflow: adding and removing users, understanding what each permission grants, assigning permissions to one user or to everyone at once, and generating, customising, and rotating API keys.

All of it happens in Senturo. Incident IQ users and Senturo users are managed separately, so someone can hold Senturo permissions in Incident IQ without being a full Senturo user.

Before You Begin

You will need administrator access in Senturo, and the Incident IQ integration must already be connected.

Accessing User Management

1. Enter your credentials in Senturo.
2. Navigate to Integrations.
3. Locate Incident IQ and click on Manage > Manage Users.

The User Management panel lists everyone who currently has access to Senturo features in Incident IQ. Use the search field to find a specific person, and the pagination controls beneath the list to move through longer lists.

Adding Users

1. In the User Management panel, click on the add user icon beside the search field. The Add users to IncidentIQ integration panel opens.
2. Add your users using either method:
   • Existing Senturo users — enable the RESYNC senturo users whitelist toggle.
   • Users who are not in Senturo — click on Download Template, add their email addresses to the CSV, then upload it using Drag and drop a CSV file or Browse files.
3. Click on Generate API Keys.

Note: The CSV method exists so that Incident IQ users can be granted Senturo actions without becoming full Senturo users. A help desk administrator who works entirely inside Incident IQ, for example, needs no Senturo account of their own.

Use the email address that matches the person's Incident IQ user record. Authentication is checked against that address, so a mismatch will prevent them signing in.

Removing Users

1. Locate the user in the User Management list.
2. Click on the menu (⋮) beside their name.
3. Click on Delete.

Removing a user revokes their access immediately. Their API key stops working, and any session they have open in the Senturo Device Console ends.

Understanding the Available Permissions

Permissions are assigned per user and map directly to the sections of the Senturo Device Console that person can reach.

A user sees only the sections they hold permissions for. Anything not granted simply does not appear in their navigation.

Note: Wipe Device is irreversible and Unlock Device releases a security lock. Both warrant tighter control than the read-only permissions.

Assigning Permissions to a Single User

1. Locate the user in the User Management list.
2. Click on the menu (⋮) beside their name and click on Manage User.
3. Under Available Actions, check or uncheck each permission as required. To grant that user everything, check Assign All.
4. Save your changes.

Granting All Permissions to Every User

Add All Permissions, at the top of the User Management panel, is a separate control. It grants the full set of permissions to every user in the list at once.

Because it applies across the board — including any user currently restricted to read-only access — review the list before using it. If your intention is to give one person full access, use Assign All within that user's Manage User panel instead.

Managing a User's API Key

Every user needs an active API key to authenticate to the Senturo Device Console. Keys are issued per user and cannot be shared.

Open a user's Manage User panel to manage their key. You have two options:

• Leave the Custom key field blank and Senturo generates a key automatically.
• Enter a value in the Custom key field to set a specific key for that user.

Then click on Change API Key.

Changing a key takes effect immediately:

• The user's previous key stops working at once.
• Any active session they have in the Senturo Device Console is signed out.
• They will need the new key to sign back in.

Choosing a Secure Custom Key

A custom key is useful when a user needs something memorable, or when your district has its own credential conventions. Treat it with the same care as any other credential granting device control.

For a custom key, we recommend:

• At least 12 characters
• A mix of uppercase and lowercase letters
• At least one number
• At least one special character

Avoid reusing a password from another system, and avoid predictable patterns based on the user's name, the district name, or the current year. If you have no specific reason to set a custom key, leaving the field blank and letting Senturo generate one is the stronger option.

Best Practices for Ongoing Management

• Rotate keys periodically. Regenerate keys on a regular schedule, and immediately when someone changes role or leaves the organization.
• Restrict high-risk permissions. Reserve Wipe Device and Unlock Device for senior staff. Most help desk work needs only View Location, View Users, and Change Status.
• Audit the user list. Review it regularly and remove anyone who no longer needs access. Because integration users are separate from Senturo users, they will not be removed automatically when a Senturo account is deactivated.
• Grant deliberately. Assign the permissions a role actually requires rather than defaulting to full access.

Troubleshooting

A user was signed out unexpectedly. Their key was changed, they were removed from the integration, or their 90-day session expired. Check the user list first, then reissue a key if needed.

A user cannot see a section of the console. They do not hold that permission. Open their Manage User panel and check the relevant box.

A user can see a section but the action will not run. Check the device status rather than the user's permissions. Lock, wipe, and recovery report require the device to be set to Missing.

A user removed from Senturo still has access in Incident IQ. Integration users are managed separately from Senturo users. Remove them from the User Management list to revoke access.

Conclusion

Managing the integration comes down to three decisions per person: whether they should have access at all, which actions they should be able to perform, and who holds their key.

Reviewing the user list regularly and keeping destructive permissions with senior staff keeps device control in the right hands while still giving your help desk what it needs to resolve tickets quickly.

FAQs

Q: What is the difference between Assign All and Add All Permissions? A: Assign All sits inside an individual user's Permissions panel and grants every permission to that one user. Add All Permissions sits at the top of the User Management panel and grants every permission to every user in the list.

Q: What happens to a user's session when I change their API key? A: It ends immediately. Their previous key stops working and any open console session is signed out, so give them the new key at the same time you change it.

Q: Do I need to update anything in Incident IQ after changing a key? A: No. The user signs in again with the new key the next time they open a Senturo action link.