Backoffice guide: navigation, roles and shortcuts

On this page

Backoffice is the Noxtica console at backoffice.noxtica.com. Use this page to learn how the sidebar is organised, which role opens which page, and which keyboard shortcuts and chrome controls save time. Operators, analysts and workspace administrators all use the same console; what you see depends on your role and on what is enabled for your organisation.

Key points

Role floors decide the sidebarThe sidebar hides a page below its minimum role; most configuration pages need Admin and the server checks every change.
Ctrl+K finds pages and recordsThe palette needs 2 characters and returns pages plus the entities your role may search.
G then a letter jumpsEleven G chords open Home, Analytics, Fingerprints, Live, Compare, Issues, Replay, Heatmaps, Journeys, Funnels and Settings.
Sensitive changes ask for MFAA fresh authenticator check stays valid for 6 hours by default.

What it is
Prerequisites
Steps
Verify it works
Troubleshooting
Related

How this page is organisedBar length shows each section’s share of the text. Select a section to jump to it.

What it is

Availability: Availability depends on your plan, role and the modules enabled for your organisation.

The left sidebar groups pages into 15 workspace groups. Each group has a heading that you can fold shut; the sidebar remembers folded groups in your browser. The top bar holds the workspace switcher (when your account belongs to more than one workspace), the command palette, notifications, page help and the UI tweaks panel. Most pages end with a Related pages bar, and a Settings menu at the top right of a page lists the settings pages that control it.

Every page is scoped to the active workspace. A role is per workspace: one account can be an Admin in one workspace and a Viewer in another.

Roles and what they reach

Role	What the sidebar shows
Viewer	Home, analytics, fingerprints and their sub-pages, Issues, RUM & APM, Behavior Analytics, Infrastructure, Pulse (when enabled), SEO pages, Usage & Quotas, Settings
Analyst	Everything a Viewer sees, plus Session Replay, Live Assist, Spot Captures, Hunter Reports (when enabled), Feature Flags, KYC review pages and the Audit Log
Admin	Everything an Analyst sees, plus every configuration page: Detection & Collection, Web Analytics & Privacy, Privacy & Legal, Integrations & API, AI & Agents, Billing & Plan, Domains, Users, Sign-in & Access, Workspace Gates, Exports and Data Operations
Billing	Only when enabled for your organisation: a branch role for Billing & Plan pages, not a step above Viewer

The role you hold in the active workspace is printed in the sidebar footer. For the full capability list per role, see Roles and permissions.

Two rules explain most “why can’t I open it” questions:

The sidebar hides a page below its minimum role. Most configuration pages are hidden below Admin. A deep link to a hidden page can still open for a lower role, but the server checks every read and every change against your role.
A page can also be hidden or inert because a module or feature is not enabled for your organisation. Pulse, Hunter Reports and Investigations stay out of the sidebar until they are enabled. Related Devices opens with a “disabled” state when it is not enabled.

Routes are paths under backoffice.noxtica.com. “Minimum role” is the sidebar floor.

Overview

Nav label	Route	Minimum role	What you do there
Home	`/home`	Any signed-in role	See plan and usage, every product module, platform status and next steps

Device Intelligence. See Fingerprints, analytics and live monitoring.

Nav label	Route	Minimum role	What you do there
Risk Analytics	`/analytics`	Viewer	Trends, distribution, signals and geography per domain
Traffic Intelligence	`/insights`	Admin	Read-only traffic summaries; empty until the underlying rollups are on
Dashboards	`/dashboards`	Viewer to read, Admin to change	Build dashboards, reusable cards and cohorts
Fingerprints	`/fingerprints`	Viewer	Search and open device fingerprints
Live Fingerprints	`/fingerprints/live-monitoring`	Viewer	Watch devices as they arrive
Compare Fingerprints	`/fingerprints/compare`	Viewer	Diff devices side by side
Fingerprint Population	`/fingerprints/population`	Viewer	Fleet-wide hardware and attestation distributions
Related Devices	`/fingerprints/linkage`	Viewer, when enabled	Advisory device-relation candidates
Geo-risk	`/geo-risk`	Admin	Risk bands per country, network and IP block
Hardware Attestation	`/hardware-attestation`	Admin	GPU and CPU attestation views; see Device and app attestation

Session Insights. See Observability overview.

Nav label	Route	Minimum role	What you do there
Issues	`/issues`	Viewer	Triage grouped errors and behavior signals
RUM & APM (Client RUM, APM Traces, Profiles, Services, Releases, Metrics, Logs)	`/rum-apm` and `/rum-apm/<page>`	Viewer	Real-user monitoring and application performance
Session Replay, Live Assist	`/replay`, `/replay/live`	Analyst	Play recorded sessions and watch live ones
Spot Captures	`/spot`	Analyst	Review operator-started captures; see Spot captures
Hunter Reports	`/hunter-reports`	Analyst, when enabled	Review page audits; see Hunter reports
Behavior Analytics, Heatmaps, Journeys, Funnels	`/runtime-tracker` and `/runtime-tracker/<page>`	Viewer	Tracker health and behavior analytics

Infrastructure and Noxtica Pulse

Nav label	Route	Minimum role	What you do there
Infrastructure	`/infrastructure`	Viewer	Enrolled observability hosts
Pulse, Applications, Profiles, Bundles, Rollouts, Detections, Response, Devices, Privacy, Usage	`/pulse` and `/pulse/<page>`	Viewer to read, when enabled	Endpoint telemetry; see Pulse overview

Protection & Investigations. See Risk actions, investigations and entity lookup.

Nav label	Route	Minimum role	What you do there
Risk Actions	`/risk-actions`	Admin	Check shadow evidence before you enforce
Agentic Security	`/agentic-security`	Admin	Agent verification, attestation chain and MCP usage
Bot Intelligence	`/bot-intel`	Admin	Named-bot catalog and operators that reached you
Behavioral Corroboration, Behavioral Subjects	`/behavioral`, `/behavioral/subjects`	Admin	Advisory behavioral baselines
Investigations	`/investigations`	Viewer, when enabled	Journey and device-location investigations
Entity Lookup	`/investigation`	Viewer	Look up an IP address, domain or ASN
Quality & Calibration	`/quality-calibration`	Admin	Calibration proposals, disputes, corpus, shadow reports

Identity Verification. See Identity verification integration and Invitations and hosted verification settings.

Nav label	Route	Minimum role	What you do there
KYC, KYC Verifications, KYC Invitations, KYC Review Queue, KYC Erasure, KYC Policies, KYC Screening Cases, KYC Rescreening, Passkeys, Step-Up Verification, Device Registry, Device Topology Policy	`/kyc` and `/kyc/<page>`	Analyst	Review verification cases and run the review workflow; administrators delete verifications in KYC Verifications and work erasure requests in KYC Erasure
Assisted Recovery	`/kyc/recovery`	Admin	Recovery operations queue
Agent Delegations	`/kyc/agent-delegations`	Analyst	See delegated agent activity
Evidence Access	`/kyc/evidence`	Admin	View sensitive evidence; every view is audited
KYB, KYM and their sub-pages	`/kyb`, `/kym`	Admin	Business and merchant verification; see Business and merchant verification

Each KYC page depends on the modules enabled for your organisation; a page whose module is off says so on the page. KYC Processes (/kyc/processes) has no sidebar item: open it from the KYC directory page or from a case. See Identity verification operations for the full page list.

Detection & Collection. See Detection and collection settings. All pages need Admin.

Nav label	Route	What you do there
Rules & Risk Scoring	`/detection/rules`	Rules, simulation, risk scoring, shadow candidates
Client Cost Levels	`/detection/client-cost-levels`	Visitor-browser cost per domain
Verdict Bands	`/detection/verdict-bands`	Stage replay protection; sealed results
Honeypots & Shared Intel	`/detection/honeypots`	Tripwires and shared-intelligence opt-in
Collector	`/detection/collector`	Token refresh interval
Probes	`/detection/probes`	Extra collector probes
Behavioral Signals	`/detection/behavioral-signals`	Behavioral capture options

Web Analytics & Privacy and Privacy & Legal. All pages need Admin. See Privacy and compliance controls in Backoffice and Real user monitoring and Web Vitals.

Nav label	Route	What you do there
Consent & Privacy, RUM Collection, Tracking Allowlists, Capture Policies, RUM Data Lifecycle, Uptime Checks	`/web-analytics/<page>`	Per-domain RUM consent, sampling, allowlists, capture and uptime checks
Data Retention, Data Locations, KYC Training Data, Compliance, Legal Basis Register, Data Subject Scope, Sub-processors, Platform Assurances	`/privacy/<page>`	Retention, legal basis and assurance pages

Integrations & API. See Integrations and API pages. All pages need Admin.

Nav label	Route	What you do there
Event Sinks	`/event-sinks`	Push events to a SIEM; see Event sinks
API & SDK	`/api-config`	Server API keys and integration links
MCP Tokens, Score API Keys, Ingestion API Keys, Webhooks	`/integrations/<page>`	Credentials and event delivery
Script & Consent	`/integrations/script-consent`	Collector snippets and consent mode
Alerts, Status Reports, Relay Hostnames, Attestation Apps, Connectors	`/integrations/<page>`	Notifications, reports, first-party hostnames, mobile apps, connections

SEO & Marketing. Viewer reads; running checks and connecting Search Console need Admin. See SEO tools.

Nav label	Route	What you do there
SEO Check, Site Crawls, Search Console, Search Score	`/seo/<page>`	Technical checks, crawls and search visibility for an owned domain

AI & Agents. See AI assistant, MCP tokens and coding-agent keys. All pages need Admin.

Nav label	Route	What you do there
Agent Registry	`/ai/agent-registry`	Decide how verified AI crawlers are treated
LLM Routing, Speech, LLM Provider Keys	`/ai/llm-routing`, `/ai/speech`, `/ai/provider-keys`	Model routing, voice features, your own provider keys
Coding Agent Keys	`/integrations/coding-agent-keys`	Read-only keys for a coding agent
Agent Monitor	`/agent/monitor`	Watch agent runs; when enabled for your organisation

Billing & Plan. See Plans, packages and add-ons.

Nav label	Route	Minimum role	What you do there
Usage & Quotas	`/usage`	Viewer	Meters, AI usage and spend
Plan	`/billing/plan`	Admin	See limits and request a change
Packages & Add-ons, Wallet, Invoices, Monthly Reports	`/billing/<page>`	Admin (Billing role when enabled)	Subscriptions, balance, statements and reports

Administration. See Domains, site keys and the install card and Workspace gates, feature flags, data operations and mobile operations.

Nav label	Route	Minimum role	What you do there
Domains	`/domains`	Admin	Register origins, site keys, per-domain settings
Users	`/users`	Admin	Invite and manage team members; see Roles and permissions
Settings	`/settings`	Any signed-in role	Your own sign-in security, appearance, notifications
Sign-in & Access	`/administration/sign-in-access`	Admin	SSO, IP allowlist, enforced MFA; see Sign-in, SSO, SCIM, MFA and IP allowlist
Workspace Gates	`/administration/workspace-gates`	Admin	Optional workspace behaviours
Feature Flags	`/feature-flags`	Analyst to read, Admin to change	Visitor experiments
Mobile Operations	`/mobile-operations`	Admin	Mobile posture and the tenant kill-switch key
Audit Log	`/audit`	Analyst	Who changed what; see Audit log and data export
Exports	`/exports`	Admin	Download data exports
Data Operations	`/data-operations`	Admin	Delete end-user browser data, retention runs

Prerequisites

A Backoffice account in at least one workspace. Sign-in, SSO and MFA are covered in Sign-in, SSO, SCIM, MFA and IP allowlist.
An authenticator app, if you will change settings. Sensitive changes ask for a fresh MFA code (see step 5).
For Pulse, Hunter Reports, Investigations and Related Devices: the feature enabled for your organisation. Ask your account team.

Steps

1. Check your workspace and role

Look at the sidebar footer: it shows your email and role. If your account belongs to more than one workspace, the top bar also shows the workspace switcher with the active workspace name.

2. Switch workspace

Open the workspace switcher in the top bar: Switch workspace (current: ).
Pick a workspace. Workspaces marked Suspended or Unavailable cannot be opened.
Backoffice reloads on Home. Nothing from the previous workspace stays on screen.

If the switch fails, the switcher shows one of three messages: you are no longer an active member, the workspace could not be verified (retry in a moment), or your network is not allowed to reach that workspace (ask its administrator to add your IP address).

3. Jump to a page with the command palette

Press Ctrl+K (⌘K on macOS), or use the search box at the top of the sidebar. Type at least 2 characters.

Navigation lists pages you can open. Items also match aliases, for example siem finds Event Sinks and mfa finds Settings.
Results lists matching entities. Everyone with device access gets device results. Users and domains need Admin. Replay sessions need the replay permission, error groups and funnels need analytics, and KYC verifications need the KYC review permission.
Recent pages lists the pages you opened last while the search box is empty.

4. Use G shortcuts and the shortcuts list

Press G, then a letter within about a second.

Keys	Opens
`G` `D`	Home
`G` `A`	Risk Analytics
`G` `F`	Fingerprints
`G` `L`	Live Fingerprints
`G` `C`	Compare Fingerprints
`G` `I`	Issues
`G` `R`	Session Replay
`G` `H`	Heatmaps
`G` `J`	Journeys
`G` `N`	Funnels
`G` `S`	Settings

Press ? to open the Keyboard shortcuts list. It shows only the chords your role can use. Ctrl+\ (⌘\ on macOS) collapses or expands the sidebar. Esc closes the open dialog or panel. Shortcuts stay quiet while you type in a field, while a modifier key is held and while a dialog is open.

5. Confirm sensitive changes with step-up MFA

Creating or rotating keys, changing domains, minting tokens, changing detection settings and similar actions ask for a code from your authenticator app, even though you are signed in. A successful check stays fresh for 6 hours by default; Backoffice asks again after that. If you cancel, nothing changes.

6. Set your own preferences

Open the tweaks button in the top bar (UI tweaks) for:

Theme: Dark, Light, High contrast.
Density: Compact, Comfortable, Spacious.
Font: Sans, Mono, Humanist, Mixed.
Language: pick a language from the list.

The same theme, density and font defaults are on Settings → Appearance.

7. Read page help and the in-console legal pages

The help button in the top bar opens Page help for the page you are on, with a link to the full documentation.
The bell opens Notifications: recent audit activity and destructive actions.
The console carries read-only copies of the legal documents under /legal/: Terms of Service, Privacy Policy, Cookie Policy, Acceptable Use, Legal Notice, Subprocessors, Disclaimer and Data Processing Addendum. The public versions are at Terms, Privacy, Cookies, Acceptable use, Legal notice, Subprocessors, Disclaimer and DPA.

8. Find a page you cannot see

If the page is missing because	You see	Do this
Your role is below the floor	No sidebar item; a deep link shows Access denied and names the required role	Ask a workspace admin for the role, or an admin to do the task
The module is not in your plan	A strip reading ” is not included in your plan” (KYC, Behavioral Corroboration, Hardware Attestation)	Ask your account team
The feature is not enabled for your organisation	No sidebar item (Pulse, Hunter Reports, Investigations), or a “not enabled” state on the page	Ask your account team
Billing needs attention	Every page except Billing & Plan and Settings is paused	See Billing status, grace period and reminders
Your workspace requires MFA enrolment	Backoffice sends you to `/mfa/enroll`	Enrol an authenticator app
You are in a different workspace	The item exists in another workspace	Switch workspace (step 2)

Check your role
The sidebar footer shows the role you hold in the active workspace.
Switch workspace
Use the top-bar switcher if your account has more than one workspace.
Open the palette
Press Ctrl+K or Cmd+K and type at least 2 characters.
Use G shortcuts
Press G then a letter; press ? to list the chords your role can use.
Confirm with MFA
Enter an authenticator code when a sensitive change asks for it.
Find a hidden page
Compare the page floor with your role, then ask about plan or feature enablement.

How to find and open a Backoffice page

Verify it works

Press ?: the Keyboard shortcuts dialog opens with an Anywhere section and a Go to (press G, then the letter) section.
Press Ctrl+K or ⌘K, type fing: Fingerprints appears under Navigation.
Press G then D: Backoffice opens Home.
Open the workspace switcher (if shown) and pick another workspace: the console reloads on Home under the new workspace name, and the role in the sidebar footer matches that workspace.

Troubleshooting

Symptom	Cause	Fix
A page in these docs is not in your sidebar	Your role is below its floor, or the feature is not enabled for your organisation	Check the role in the sidebar footer against the tables above
Access denied with “Required role: admin or higher”	The deep link needs a higher role	Ask a workspace admin
The palette shows no users or domains	User and domain results need Admin	Ask for the Admin role, or open the page itself
A `G` shortcut does nothing	Focus is in a field, a modifier key is held, a dialog is open, or the page is not available to your role	Click outside the field, close the dialog, press `G` then the letter within about a second
No workspace switcher	The account belongs to one workspace	None needed
Backoffice keeps asking for an MFA code	The fresh-verification window has passed	Enter the code; the check stays fresh for 6 hours by default
Every page except Billing & Plan and Settings is paused	No package is active after the grace period	Choose a package under Billing & Plan

Domains, site keys and the install card: register a domain and copy its site key.
Fingerprints, analytics and live monitoring: the Device Intelligence pages.
Integrations and API pages: map of every credential and delivery page.
Roles and permissions: the capability list behind each role.
Sign-in, SSO, SCIM, MFA and IP allowlist: MFA and SSO setup.
Customer Capability Reference: what each capability family returns and its limits.
Getting started: install the collector and verify the evaluation.