The staff console

The staff console is where your team looks after customers from day to day: their accounts, servers and services, invoices and refunds, and their support conversations. Every member of your organization can sign in to it, and their role decides what they see and change. When Coritan serves your storefront's site, the console is part of it at /staff/ on your storefront domain; if you build your own storefront, the same staff routes of the Organization API are there for your team's tools.

• Sign in to the staff console: passwords, two-factor authentication, the step-up check and sessions.
• Look after customers: find an account, correct it, add credit, end its sessions, keep notes and see the storefront as the customer does.
• Handle billing: invoices, payments, refund requests, disputes, failed charges, coupons, orders and the services customers hold.
• Manage customer servers: find any server, then its power, console, files, backups, databases and installs.
• Answer customer conversations: the support inbox, its queue, escalation between tiers and access to a customer's logs or server.
• Manage the staff team and console settings: members and roles, the brand's settings, email design and the notices customers see.
• Run a community with a server list, forum and guides: moderating what customers post.
• Run Mail Hosting for your customers: the console's mail pages use the same routes.

The console's home page shows the work waiting across all of these, its search box finds any customer, invoice, service, server, ticket or coupon, and its activity page reads the audit log. Owners, admins and billing members also have an insights page with revenue, orders, new customers and support times.

The organization's tabs in the Coritan dashboard are where owners and admins set the organization up: its settings, members, API keys, products and prices, payouts, DNS, mail, integrations and webhooks. Organizations lists them. Both places use the same roles and read the same customers, services and invoices, so a change made in one shows in the other. The support inbox, the tools for customers' servers, refund requests, coupons, notices and community moderation are in the staff console only.

• Each area needs a role. Organization roles and permissions lists the lowest role for each, and a call below it answers 403 with Support access required, Tier 2 support access required, Billing access required or Admin access required.
• Actions that move money, end things or open a customer's account also need a step-up in the last 10 minutes, as Sign in to the staff console explains.
• The console works only while your organization is active. For any other status every staff route answers 404 Organization not found.
• Actions that are easy to repeat by mistake have hourly limits for each member, such as 30 credit changes or 12 exports an hour. Past a limit the route answers 429 with rate_limited, the action it counts and retry_after_seconds, and sends a Retry-After header.

The console's pages call the Organization API under https://api.coritan.com/api/v1/orgs/{org_slug}/staff/, and the support inbox calls /chat/staff/. Your own tools can call the same routes as a member, with either credential in Authorization: Bearer:

• A console session from staff sign-in, which starts with ost_. Only a console session can make a step-up, so use one for the actions that need it.
• The member's Coritan access token, $CORITAN_TOKEN in the examples on other pages. It reaches every staff route except those actions.

A Coritan account that is not a member gets 403 Not a member of this organization. The examples below use $STAFF_TOKEN for either credential.

The API reference lists every staff route with its parameters and answers:

Any member can read the counts behind the console's home page:

curl "https://api.coritan.com/api/v1/orgs/acme/staff/ops-summary?audience=paid" \
  -H "Authorization: Bearer $STAFF_TOKEN"

audience is paid, free or all, the default. A paid customer holds at least one service that is not on your free tier, whose servers sleep when nobody plays; everyone else, including a customer with no services, is free. It narrows open_tickets, sla_breached, the unpaid invoice counts, pending_services, orders_24h and customers, and the other counts cover everyone. The console's lists take the same parameter and put paid customers first.

curl "https://api.coritan.com/api/v1/orgs/acme/staff/search?q=alex%40example.com" \
  -H "Authorization: Bearer $STAFF_TOKEN"

q takes 1–200 characters, and audience works as above. Any member can search, and the answer groups what matched:

Customers, invoices, services and servers carry is_free, and paid customers come first.

The activity routes read the organization's audit log, newest first:

curl "https://api.coritan.com/api/v1/orgs/acme/staff/activity?customer_id=812&since=2026-09-01&limit=50" \
  -H "Authorization: Bearer $STAFF_TOKEN"

Each entry has id, at, action, actor_type, actor_id, actor_name, resource_type, resource_id, details and ip_address. What a role may read:

• Owners and admins read the whole log.
• Tier 3 support and billing must pass customer_id, service_id, server_uuid or their own actor_id, or the route answers 403 Name a customer, order or server; the whole log is for org admins.
• Tiers 1 and 2 must pass their own actor_id, or it answers 403 Your own actions are the part of the log your tier may read.
• Read-only members get 403 Support access required.

GET /staff/activity/actions lists the action names that occur, with a count for each, most frequent first and at most 100. Below Tier 3 it lists only your own.

Owners, admins and billing members can read how the organization is doing over the last days, 7–365 and 30 by default, counted in whole days in UTC up to today:

curl "https://api.coritan.com/api/v1/orgs/acme/staff/insights?days=90" \
  -H "Authorization: Bearer $STAFF_TOKEN"

series lists the days, and each daily list in the answer follows it.

• revenue: payments and refunds per day with their totals and net, mrr (the prices of active services as a monthly figure), active_services, the unpaid and overdue invoices in outstanding_count and outstanding_total, and in by_product the 12 products that brought in the most on paid invoices.
• orders: orders placed, failed and ended per day.
• customers: new customers per day.
• support: conversations opened per day, how many closed, first_response_median_seconds, resolution_median_seconds, sla_compliance_percent and a count by_department.

The money figures add amounts as they are, without converting between currencies. GET /staff/insights/export.csv takes the same days and downloads the daily figures as CSV, one row a day. It counts towards the limit of 12 exports an hour that every staff export shares.