Backoffice guide: navigation, roles and shortcuts
Backoffice is the Noxtica console at backoffice.noxtica.com. Use this page to learn how the sidebar is organised, which role opens which page, and which keyboard shortcuts and chrome controls save time. Operators, analysts and workspace administrators all use the same console; what you see depends on your role and on what is enabled for your organisation.
What it is
Availability: Availability depends on your plan, role and the modules enabled for your organisation.
The left sidebar groups pages into 15 workspace groups. Each group has a heading that you can fold shut; the sidebar remembers folded groups in your browser. The top bar holds the workspace switcher (when your account belongs to more than one workspace), the command palette, notifications, page help and the UI tweaks panel. Most pages end with a Related pages bar, and a Settings menu at the top right of a page lists the settings pages that control it.
Every page is scoped to the active workspace. A role is per workspace: one account can be an Admin in one workspace and a Viewer in another.
Roles and what they reach
| Role | What the sidebar shows |
|---|---|
| Viewer | Home, analytics, fingerprints and their sub-pages, Issues, RUM & APM, Behavior Analytics, Infrastructure, Pulse (when enabled), SEO pages, Usage & Quotas, Settings |
| Analyst | Everything a Viewer sees, plus Session Replay, Live Assist, Spot Captures, Hunter Reports (when enabled), Feature Flags, KYC review pages and the Audit Log |
| Admin | Everything an Analyst sees, plus every configuration page: Detection & Collection, Web Analytics & Privacy, Privacy & Legal, Integrations & API, AI & Agents, Billing & Plan, Domains, Users, Sign-in & Access, Workspace Gates, Exports and Data Operations |
| Billing | Only when enabled for your organisation: a branch role for Billing & Plan pages, not a step above Viewer |
The role you hold in the active workspace is printed in the sidebar footer. For the full capability list per role, see Roles and permissions.
Two rules explain most “why can’t I open it” questions:
- The sidebar hides a page below its minimum role. Most configuration pages are hidden below Admin. A deep link to a hidden page can still open for a lower role, but the server checks every read and every change against your role.
- A page can also be hidden or inert because a module or feature is not enabled for your organisation. Pulse, Hunter Reports and Investigations stay out of the sidebar until they are enabled. Related Devices opens with a “disabled” state when it is not enabled.
Sidebar groups, routes and floors
Routes are paths under backoffice.noxtica.com. “Minimum role” is the sidebar floor.
Overview
| Nav label | Route | Minimum role | What you do there |
|---|---|---|---|
| Home | /home | Any signed-in role | See plan and usage, every product module, platform status and next steps |
Device Intelligence. See Fingerprints, analytics and live monitoring.
| Nav label | Route | Minimum role | What you do there |
|---|---|---|---|
| Risk Analytics | /analytics | Viewer | Trends, distribution, signals and geography per domain |
| Traffic Intelligence | /insights | Admin | Read-only traffic summaries; empty until the underlying rollups are on |
| Dashboards | /dashboards | Viewer to read, Admin to change | Build dashboards, reusable cards and cohorts |
| Fingerprints | /fingerprints | Viewer | Search and open device fingerprints |
| Live Fingerprints | /fingerprints/live-monitoring | Viewer | Watch devices as they arrive |
| Compare Fingerprints | /fingerprints/compare | Viewer | Diff devices side by side |
| Fingerprint Population | /fingerprints/population | Viewer | Fleet-wide hardware and attestation distributions |
| Related Devices | /fingerprints/linkage | Viewer, when enabled | Advisory device-relation candidates |
| Geo-risk | /geo-risk | Admin | Risk bands per country, network and IP block |
| Hardware Attestation | /hardware-attestation | Admin | GPU and CPU attestation views; see Device and app attestation |
Session Insights. See Observability overview.
| Nav label | Route | Minimum role | What you do there |
|---|---|---|---|
| Issues | /issues | Viewer | Triage grouped errors and behavior signals |
| RUM & APM (Client RUM, APM Traces, Profiles, Services, Releases, Metrics, Logs) | /rum-apm and /rum-apm/<page> | Viewer | Real-user monitoring and application performance |
| Session Replay, Live Assist | /replay, /replay/live | Analyst | Play recorded sessions and watch live ones |
| Spot Captures | /spot | Analyst | Review operator-started captures; see Spot captures |
| Hunter Reports | /hunter-reports | Analyst, when enabled | Review page audits; see Hunter reports |
| Behavior Analytics, Heatmaps, Journeys, Funnels | /runtime-tracker and /runtime-tracker/<page> | Viewer | Tracker health and behavior analytics |
Infrastructure and Noxtica Pulse
| Nav label | Route | Minimum role | What you do there |
|---|---|---|---|
| Infrastructure | /infrastructure | Viewer | Enrolled observability hosts |
| Pulse, Applications, Profiles, Bundles, Rollouts, Detections, Response, Devices, Privacy, Usage | /pulse and /pulse/<page> | Viewer to read, when enabled | Endpoint telemetry; see Pulse overview |
Protection & Investigations. See Risk actions, investigations and entity lookup.
| Nav label | Route | Minimum role | What you do there |
|---|---|---|---|
| Risk Actions | /risk-actions | Admin | Check shadow evidence before you enforce |
| Agentic Security | /agentic-security | Admin | Agent verification, attestation chain and MCP usage |
| Bot Intelligence | /bot-intel | Admin | Named-bot catalog and operators that reached you |
| Behavioral Corroboration, Behavioral Subjects | /behavioral, /behavioral/subjects | Admin | Advisory behavioral baselines |
| Investigations | /investigations | Viewer, when enabled | Journey and device-location investigations |
| Entity Lookup | /investigation | Viewer | Look up an IP address, domain or ASN |
| Quality & Calibration | /quality-calibration | Admin | Calibration proposals, disputes, corpus, shadow reports |
Identity Verification. See Identity verification integration and Invitations and hosted verification settings.
| Nav label | Route | Minimum role | What you do there |
|---|---|---|---|
| KYC, KYC Verifications, KYC Invitations, KYC Review Queue, KYC Erasure, KYC Policies, KYC Screening Cases, KYC Rescreening, Passkeys, Step-Up Verification, Device Registry, Device Topology Policy | /kyc and /kyc/<page> | Analyst | Review verification cases and run the review workflow; administrators delete verifications in KYC Verifications and work erasure requests in KYC Erasure |
| Assisted Recovery | /kyc/recovery | Admin | Recovery operations queue |
| Agent Delegations | /kyc/agent-delegations | Analyst | See delegated agent activity |
| Evidence Access | /kyc/evidence | Admin | View sensitive evidence; every view is audited |
| KYB, KYM and their sub-pages | /kyb, /kym | Admin | Business and merchant verification; see Business and merchant verification |
Each KYC page depends on the modules enabled for your organisation; a page whose module is off says so on the page. KYC Processes (/kyc/processes) has no sidebar item: open it from the KYC directory page or from a case. See Identity verification operations for the full page list.
Detection & Collection. See Detection and collection settings. All pages need Admin.
| Nav label | Route | What you do there |
|---|---|---|
| Rules & Risk Scoring | /detection/rules | Rules, simulation, risk scoring, shadow candidates |
| Client Cost Levels | /detection/client-cost-levels | Visitor-browser cost per domain |
| Verdict Bands | /detection/verdict-bands | Stage replay protection; sealed results |
| Honeypots & Shared Intel | /detection/honeypots | Tripwires and shared-intelligence opt-in |
| Collector | /detection/collector | Token refresh interval |
| Probes | /detection/probes | Extra collector probes |
| Behavioral Signals | /detection/behavioral-signals | Behavioral capture options |
Web Analytics & Privacy and Privacy & Legal. All pages need Admin. See Privacy and compliance controls in Backoffice and Real user monitoring and Web Vitals.
| Nav label | Route | What you do there |
|---|---|---|
| Consent & Privacy, RUM Collection, Tracking Allowlists, Capture Policies, RUM Data Lifecycle, Uptime Checks | /web-analytics/<page> | Per-domain RUM consent, sampling, allowlists, capture and uptime checks |
| Data Retention, Data Locations, KYC Training Data, Compliance, Legal Basis Register, Data Subject Scope, Sub-processors, Platform Assurances | /privacy/<page> | Retention, legal basis and assurance pages |
Integrations & API. See Integrations and API pages. All pages need Admin.
| Nav label | Route | What you do there |
|---|---|---|
| Event Sinks | /event-sinks | Push events to a SIEM; see Event sinks |
| API & SDK | /api-config | Server API keys and integration links |
| MCP Tokens, Score API Keys, Ingestion API Keys, Webhooks | /integrations/<page> | Credentials and event delivery |
| Script & Consent | /integrations/script-consent | Collector snippets and consent mode |
| Alerts, Status Reports, Relay Hostnames, Attestation Apps, Connectors | /integrations/<page> | Notifications, reports, first-party hostnames, mobile apps, connections |
SEO & Marketing. Viewer reads; running checks and connecting Search Console need Admin. See SEO tools.
| Nav label | Route | What you do there |
|---|---|---|
| SEO Check, Site Crawls, Search Console, Search Score | /seo/<page> | Technical checks, crawls and search visibility for an owned domain |
AI & Agents. See AI assistant, MCP tokens and coding-agent keys. All pages need Admin.
| Nav label | Route | What you do there |
|---|---|---|
| Agent Registry | /ai/agent-registry | Decide how verified AI crawlers are treated |
| LLM Routing, Speech, LLM Provider Keys | /ai/llm-routing, /ai/speech, /ai/provider-keys | Model routing, voice features, your own provider keys |
| Coding Agent Keys | /integrations/coding-agent-keys | Read-only keys for a coding agent |
| Agent Monitor | /agent/monitor | Watch agent runs; when enabled for your organisation |
Billing & Plan. See Plans, packages and add-ons.
| Nav label | Route | Minimum role | What you do there |
|---|---|---|---|
| Usage & Quotas | /usage | Viewer | Meters, AI usage and spend |
| Plan | /billing/plan | Admin | See limits and request a change |
| Packages & Add-ons, Wallet, Invoices, Monthly Reports | /billing/<page> | Admin (Billing role when enabled) | Subscriptions, balance, statements and reports |
Administration. See Domains, site keys and the install card and Workspace gates, feature flags, data operations and mobile operations.
| Nav label | Route | Minimum role | What you do there |
|---|---|---|---|
| Domains | /domains | Admin | Register origins, site keys, per-domain settings |
| Users | /users | Admin | Invite and manage team members; see Roles and permissions |
| Settings | /settings | Any signed-in role | Your own sign-in security, appearance, notifications |
| Sign-in & Access | /administration/sign-in-access | Admin | SSO, IP allowlist, enforced MFA; see Sign-in, SSO, SCIM, MFA and IP allowlist |
| Workspace Gates | /administration/workspace-gates | Admin | Optional workspace behaviours |
| Feature Flags | /feature-flags | Analyst to read, Admin to change | Visitor experiments |
| Mobile Operations | /mobile-operations | Admin | Mobile posture and the tenant kill-switch key |
| Audit Log | /audit | Analyst | Who changed what; see Audit log and data export |
| Exports | /exports | Admin | Download data exports |
| Data Operations | /data-operations | Admin | Delete end-user browser data, retention runs |
Prerequisites
- A Backoffice account in at least one workspace. Sign-in, SSO and MFA are covered in Sign-in, SSO, SCIM, MFA and IP allowlist.
- An authenticator app, if you will change settings. Sensitive changes ask for a fresh MFA code (see step 5).
- For Pulse, Hunter Reports, Investigations and Related Devices: the feature enabled for your organisation. Ask your account team.
Steps
1. Check your workspace and role
Look at the sidebar footer: it shows your email and role. If your account belongs to more than one workspace, the top bar also shows the workspace switcher with the active workspace name.
2. Switch workspace
- Open the workspace switcher in the top bar: Switch workspace (current: ).
- Pick a workspace. Workspaces marked Suspended or Unavailable cannot be opened.
- Backoffice reloads on Home. Nothing from the previous workspace stays on screen.
If the switch fails, the switcher shows one of three messages: you are no longer an active member, the workspace could not be verified (retry in a moment), or your network is not allowed to reach that workspace (ask its administrator to add your IP address).
3. Jump to a page with the command palette
Press Ctrl+K (⌘K on macOS), or use the search box at the top of the sidebar. Type at least 2 characters.
- Navigation lists pages you can open. Items also match aliases, for example
siemfinds Event Sinks andmfafinds Settings. - Results lists matching entities. Everyone with device access gets device results. Users and domains need Admin. Replay sessions need the replay permission, error groups and funnels need analytics, and KYC verifications need the KYC review permission.
- Recent pages lists the pages you opened last while the search box is empty.
4. Use G shortcuts and the shortcuts list
Press G, then a letter within about a second.
| Keys | Opens |
|---|---|
G D | Home |
G A | Risk Analytics |
G F | Fingerprints |
G L | Live Fingerprints |
G C | Compare Fingerprints |
G I | Issues |
G R | Session Replay |
G H | Heatmaps |
G J | Journeys |
G N | Funnels |
G S | Settings |
Press ? to open the Keyboard shortcuts list. It shows only the chords your role can use. Ctrl+\ (⌘\ on macOS) collapses or expands the sidebar. Esc closes the open dialog or panel. Shortcuts stay quiet while you type in a field, while a modifier key is held and while a dialog is open.
5. Confirm sensitive changes with step-up MFA
Creating or rotating keys, changing domains, minting tokens, changing detection settings and similar actions ask for a code from your authenticator app, even though you are signed in. A successful check stays fresh for 6 hours by default; Backoffice asks again after that. If you cancel, nothing changes.
6. Set your own preferences
Open the tweaks button in the top bar (UI tweaks) for:
- Theme: Dark, Light, High contrast.
- Density: Compact, Comfortable, Spacious.
- Font: Sans, Mono, Humanist, Mixed.
- Language: pick a language from the list.
The same theme, density and font defaults are on Settings → Appearance.
7. Read page help and the in-console legal pages
- The help button in the top bar opens Page help for the page you are on, with a link to the full documentation.
- The bell opens Notifications: recent audit activity and destructive actions.
- The console carries read-only copies of the legal documents under
/legal/: Terms of Service, Privacy Policy, Cookie Policy, Acceptable Use, Legal Notice, Subprocessors, Disclaimer and Data Processing Addendum. The public versions are at Terms, Privacy, Cookies, Acceptable use, Legal notice, Subprocessors, Disclaimer and DPA.
8. Find a page you cannot see
| If the page is missing because | You see | Do this |
|---|---|---|
| Your role is below the floor | No sidebar item; a deep link shows Access denied and names the required role | Ask a workspace admin for the role, or an admin to do the task |
| The module is not in your plan | A strip reading ” is not included in your plan” (KYC, Behavioral Corroboration, Hardware Attestation) | Ask your account team |
| The feature is not enabled for your organisation | No sidebar item (Pulse, Hunter Reports, Investigations), or a “not enabled” state on the page | Ask your account team |
| Billing needs attention | Every page except Billing & Plan and Settings is paused | See Billing status, grace period and reminders |
| Your workspace requires MFA enrolment | Backoffice sends you to /mfa/enroll | Enrol an authenticator app |
| You are in a different workspace | The item exists in another workspace | Switch workspace (step 2) |
Verify it works
- Press
?: the Keyboard shortcuts dialog opens with an Anywhere section and a Go to (press G, then the letter) section. - Press
Ctrl+Kor⌘K, typefing: Fingerprints appears under Navigation. - Press
GthenD: Backoffice opens Home. - Open the workspace switcher (if shown) and pick another workspace: the console reloads on Home under the new workspace name, and the role in the sidebar footer matches that workspace.
Troubleshooting
| Symptom | Cause | Fix |
|---|---|---|
| A page in these docs is not in your sidebar | Your role is below its floor, or the feature is not enabled for your organisation | Check the role in the sidebar footer against the tables above |
| Access denied with “Required role: admin or higher” | The deep link needs a higher role | Ask a workspace admin |
| The palette shows no users or domains | User and domain results need Admin | Ask for the Admin role, or open the page itself |
A G shortcut does nothing | Focus is in a field, a modifier key is held, a dialog is open, or the page is not available to your role | Click outside the field, close the dialog, press G then the letter within about a second |
| No workspace switcher | The account belongs to one workspace | None needed |
| Backoffice keeps asking for an MFA code | The fresh-verification window has passed | Enter the code; the check stays fresh for 6 hours by default |
| Every page except Billing & Plan and Settings is paused | No package is active after the grace period | Choose a package under Billing & Plan |
Related
- Domains, site keys and the install card: register a domain and copy its site key.
- Fingerprints, analytics and live monitoring: the Device Intelligence pages.
- Integrations and API pages: map of every credential and delivery page.
- Roles and permissions: the capability list behind each role.
- Sign-in, SSO, SCIM, MFA and IP allowlist: MFA and SSO setup.
- Customer Capability Reference: what each capability family returns and its limits.
- Getting started: install the collector and verify the evaluation.