# The staff console

> The console and staff API your team uses to look after customers, servers, billing and support, each member within their role.

Source: https://docs.coritan.com/organizations/staff-console/

The *staff console* is where your team looks after customers from day to day: their accounts, servers and services, invoices and refunds, and their support conversations. Every member of your organization can sign in to it, and their role decides what they see and change. When Coritan serves your storefront's site, the console is part of it at `/staff/` on your storefront domain; if you build your own storefront, the same staff routes of the Organization API are there for your team's tools.

## What your team can do

- [Sign in to the staff console](/organizations/staff-console/sign-in/): passwords, two-factor authentication, the step-up check and sessions.
- [Look after customers](/organizations/staff-console/customers/): find an account, correct it, add credit, end its sessions, keep notes and see the storefront as the customer does.
- [Handle billing](/organizations/staff-console/billing/): invoices, payments, refund requests, disputes, failed charges, coupons, orders and the services customers hold.
- [Manage customer servers](/organizations/staff-console/servers/): find any server, then its power, console, files, backups, databases and installs.
- [Answer customer conversations](/organizations/staff-console/support-inbox/): the support inbox, its queue, escalation between tiers and access to a customer's logs or server.
- [Manage the staff team and console settings](/organizations/staff-console/team-and-settings/): members and roles, the brand's settings, email design and the notices customers see.
- [Run a community with a server list, forum and guides](/organizations/storefront/community/): moderating what customers post.
- [Run Mail Hosting for your customers](/organizations/mail/): the console's mail pages use the same routes.

The console's home page shows the work waiting across all of these, its search box finds any customer, invoice, service, server, ticket or coupon, and its activity page reads the [audit log](/organizations/audit-log/). Owners, admins and billing members also have an insights page with revenue, orders, new customers and support times.

## The console and the dashboard

The organization's tabs in the [Coritan dashboard](https://www.coritan.com/dashboard/organizations) are where owners and admins set the organization up: its settings, members, API keys, products and prices, payouts, DNS, mail, integrations and webhooks. [Organizations](/organizations/) lists them. Both places use the same roles and read the same customers, services and invoices, so a change made in one shows in the other. The support inbox, the tools for customers' servers, refund requests, coupons, notices and community moderation are in the staff console only.

## Limits

- Each area needs a role. [Organization roles and permissions](/organizations/roles-and-permissions/#the-staff-console) lists the lowest role for each, and a call below it answers `403` with `Support access required`, `Tier 2 support access required`, `Billing access required` or `Admin access required`.
- Actions that move money, end things or open a customer's account also need a step-up in the last 10 minutes, as [Sign in to the staff console](/organizations/staff-console/sign-in/#confirm-it-is-you) explains.
- The console works only while your organization is `active`. For any other status every staff route answers `404 Organization not found`.
- Actions that are easy to repeat by mistake have hourly limits for each member, such as 30 credit changes or 12 exports an hour. Past a limit the route answers `429` with `rate_limited`, the `action` it counts and `retry_after_seconds`, and sends a `Retry-After` header.

## With the API

The console's pages call the Organization API under `https://api.coritan.com/api/v1/orgs/{org_slug}/staff/`, and the support inbox calls `/chat/staff/`. Your own tools can call the same routes as a member, with either credential in `Authorization: Bearer`:

- A console session from [staff sign-in](/organizations/staff-console/sign-in/), which starts with `ost_`. Only a console session can make a step-up, so use one for the actions that need it.
- The member's Coritan access token, `$CORITAN_TOKEN` in the examples on other pages. It reaches every staff route except those actions.

A Coritan account that is not a member gets `403 Not a member of this organization`. The examples below use `$STAFF_TOKEN` for either credential.

### Find the reference for each area

The [API reference](/api/reference/organizations/) lists every staff route with its parameters and answers:

| Area | Reference |
| --- | --- |
| Sign-in, two-factor authentication and sessions | [Staff sign-in](/api/reference/organizations/customer-authentication/staff/) |
| The operations summary, search, orders and refund requests | [Staff operations](/api/reference/organizations/org-staff-ops/) |
| Activity and insights | [Staff insight](/api/reference/organizations/org-staff-insight/) |
| Customers | [Customers in the staff console](/api/reference/organizations/customers/staff/) |
| Invoices | [Invoices in the staff console](/api/reference/organizations/billing-payouts/staff/) |
| Transactions, disputes and failed charges | [Staff billing](/api/reference/organizations/org-staff-billing/) |
| Customer services | [Services in the staff console](/api/reference/organizations/catalog-services/staff/) |
| Coupons | [Staff coupons](/api/reference/organizations/org-staff-coupons/) |
| Servers | [Servers in the staff console](/api/reference/organizations/org-staff-containers/staff/) |
| The support inbox | [Staff support](/api/reference/organizations/staff-support/chat/) and [your server access](/api/reference/organizations/org-ticket-requests/) |
| The team | [Staff team](/api/reference/organizations/org-staff-team/) and [the assignee list](/api/reference/organizations/org-staff-auth/) |
| Brand settings | [Settings in the staff console](/api/reference/organizations/organizations-members/staff/) and [console API keys](/api/reference/organizations/api-keys/) |
| Notices | [Staff notices](/api/reference/organizations/org-staff-notices/) |
| Community moderation | [Staff community](/api/reference/organizations/org-staff-community/) |

### Read the operations summary

Any member can read the counts behind the console's home page:

```bash
curl "https://api.coritan.com/api/v1/orgs/acme/staff/ops-summary?audience=paid" \
  -H "Authorization: Bearer $STAFF_TOKEN"
```

| Field | What it counts |
| --- | --- |
| `open_tickets` | Conversations that are open, in progress, or waiting on your team or the customer. |
| `sla_breached` | Of those, the ones past their first-reply target. |
| `assigned_to_me` | Open conversations assigned to you. |
| `pending_refunds` | Refund requests waiting for a decision. |
| `unpaid_invoices` | Invoices with the status `unpaid`, and in `unpaid_invoices_24h` the ones raised in the last 24 hours. |
| `dunning_failing` | Unpaid or overdue invoices whose automatic charge attempts have run out. |
| `pending_services` | Orders that are `pending` or `failed` and are not waiting for their invoice to be paid. |
| `orders_24h` | Orders placed in the last 24 hours. |
| `customers` | Customer accounts, and in `signups_24h` the ones created in the last 24 hours. |
| `servers_attention` | Servers whose install failed, that are being moved, or that have been installing for more than 180 seconds. |
| `community_open` | Forum reports, guide proposals, comments and guide reports waiting for a moderator. |
| `audience_counts` | Paid and free totals of customers, orders, invoices and tickets. |

`audience` is `paid`, `free` or `all`, the default. A *paid* customer holds at least one service that is not on your free tier, whose servers sleep when nobody plays; everyone else, including a customer with no services, is free. It narrows `open_tickets`, `sla_breached`, the unpaid invoice counts, `pending_services`, `orders_24h` and `customers`, and the other counts cover everyone. The console's lists take the same parameter and put paid customers first.

### Search across the console

```bash
curl "https://api.coritan.com/api/v1/orgs/acme/staff/search?q=alex%40example.com" \
  -H "Authorization: Bearer $STAFF_TOKEN"
```

`q` takes 1–200 characters, and `audience` works as above. Any member can search, and the answer groups what matched:

| Group | Matches on | At most |
| --- | --- | --- |
| `customers` | Email, first or last name, username, company, or the customer's ID | 20 |
| `invoices` | Part of the invoice number | 10 |
| `services` | Part of the hostname | 10 |
| `servers` | Part of the server's UUID, when `q` has 8 characters or more | 10 |
| `tickets` | Part of the subject, or the ticket number such as `#1042` | 10 |
| `coupons` | Part of the code, for Tier 3 support and above; empty for other roles | 6 |

Customers, invoices, services and servers carry `is_free`, and paid customers come first.

### Read the activity log

The activity routes read the organization's [audit log](/organizations/audit-log/), newest first:

```bash
curl "https://api.coritan.com/api/v1/orgs/acme/staff/activity?customer_id=812&since=2026-09-01&limit=50" \
  -H "Authorization: Bearer $STAFF_TOKEN"
```

| Parameter | What it keeps |
| --- | --- |
| `customer_id` | Entries about the customer and about any of their services. |
| `service_id` | Entries about one customer service. |
| `server_uuid` | Entries about one server. |
| `actor_id` | Entries made by one person. For a member, it is the `user_id` that `GET /staff/auth/me` answers. |
| `action` | Actions whose name starts with this, such as `customer.` or `invoice.marked_paid`. |
| `resource_type` | Entries about one kind of record, such as `customer`. |
| `since` and `until` | Dates, such as `2026-09-01`. Both days are included. |
| `q` | Part of an action name, or a record's ID. |
| `limit` and `offset` | 1–200 entries a page, 50 by default. |

Each entry has `id`, `at`, `action`, `actor_type`, `actor_id`, `actor_name`, `resource_type`, `resource_id`, `details` and `ip_address`. What a role may read:

- Owners and admins read the whole log.
- Tier 3 support and billing must pass `customer_id`, `service_id`, `server_uuid` or their own `actor_id`, or the route answers `403 Name a customer, order or server; the whole log is for org admins`.
- Tiers 1 and 2 must pass their own `actor_id`, or it answers `403 Your own actions are the part of the log your tier may read`.
- Read-only members get `403 Support access required`.

`GET /staff/activity/actions` lists the action names that occur, with a `count` for each, most frequent first and at most 100. Below Tier 3 it lists only your own.

### Read the insights

Owners, admins and billing members can read how the organization is doing over the last `days`, 7–365 and 30 by default, counted in whole days in UTC up to today:

```bash
curl "https://api.coritan.com/api/v1/orgs/acme/staff/insights?days=90" \
  -H "Authorization: Bearer $STAFF_TOKEN"
```

`series` lists the days, and each daily list in the answer follows it.

- `revenue`: payments and refunds per day with their totals and `net`, `mrr` (the prices of active services as a monthly figure), `active_services`, the unpaid and overdue invoices in `outstanding_count` and `outstanding_total`, and in `by_product` the 12 products that brought in the most on paid invoices.
- `orders`: orders placed, failed and ended per day.
- `customers`: new customers per day.
- `support`: conversations opened per day, how many closed, `first_response_median_seconds`, `resolution_median_seconds`, `sla_compliance_percent` and a count `by_department`.

The money figures add amounts as they are, without converting between currencies. `GET /staff/insights/export.csv` takes the same `days` and downloads the daily figures as CSV, one row a day. It counts towards the limit of 12 exports an hour that every staff export shares.

## API

- `GET /api/v1/orgs/{org_slug}/staff/ops-summary`: Staff ops summary (https://docs.coritan.com/api/reference/organizations/org-staff-ops/#op-get-api-v1-orgs-org-slug-staff-ops-summary)
- `GET /api/v1/orgs/{org_slug}/staff/insights`: Money, orders, customers and support over the window, by day (https://docs.coritan.com/api/reference/organizations/org-staff-insight/#op-get-api-v1-orgs-org-slug-staff-insights)
- `GET /api/v1/orgs/{org_slug}/staff/insights/export.csv`: The daily series as one CSV: a column per measure, a row per day (https://docs.coritan.com/api/reference/organizations/org-staff-insight/#op-get-api-v1-orgs-org-slug-staff-insights-export-csv)
- `GET /api/v1/orgs/{org_slug}/staff/search`: Staff search (https://docs.coritan.com/api/reference/organizations/org-staff-ops/#op-get-api-v1-orgs-org-slug-staff-search)
- `GET /api/v1/orgs/{org_slug}/staff/activity`: The org's audit log (https://docs.coritan.com/api/reference/organizations/org-staff-insight/#op-get-api-v1-orgs-org-slug-staff-activity)
- `GET /api/v1/orgs/{org_slug}/staff/activity/actions`: The action names that have occurred, for the filter (https://docs.coritan.com/api/reference/organizations/org-staff-insight/#op-get-api-v1-orgs-org-slug-staff-activity-actions)