6 Users and API access
Sophea Portal owns people, invitations, Teams, and workspace access. Nous receives the resulting workspace membership and role so it can authorize chat and administration. Use this page to verify that Portal access has reached Nous and to manage personal tokens and service-account API keys.
For instructions on inviting people, assigning direct workspace access, or granting access through a Team, see Organizations and workspace access.
6.1 Verify synchronized users
Open Settings and select Users, or navigate to /app/admin/users.
The user table shows the people currently known to this Nous workspace, including their email, synchronized role, and account state. Treat it as a verification surface, not the source of truth for access.
If Portal access changed but Nous still shows the old state:
- Confirm the person still has an active access source in Portal.
- Check direct grants and every Team the person belongs to. Removing one source does not remove access when another source remains.
- Ask the person to reopen the workspace from Portal so the current account mapping is synchronized.
- If the state still differs, report the workspace name, user email, expected role, and the access source shown in Portal to Sophea support.
Do not repeatedly invite the person or create a second account. Invitations are bound to the invited email address, and duplicate identities make access harder to audit.
6.2 Delete a synchronized user
For an inactive account in Users, choose Delete User and review the warning before confirming. Remove workspace access in Portal first; deleting a Nous account is a permanent cleanup action. It removes the account and session history. Uploads only that user can access are deleted. Files shared through a project or agent remain available only to people who still have access. Deletion cannot be undone.
Deleting a person also removes what their own sign-in granted in search:
- Private connections they signed in with are deleted. Nous asks you to try again in a few minutes while search updates; choose Delete User again until it completes.
- A workspace connection that still uses their sign-in blocks the deletion. Delete it, or reconnect it in Portal with another account, then try again.
- Access that the source system itself grants to their email, such as SharePoint or Google Drive permissions a permission-synced connection reads, is not personal and stays.
After the deletion, no Portal connection can sign in with that email’s account again, even for someone who later joins with the same email. That person can still add their own personal connection from Nous.
6.3 Understand Nous roles
Portal resolves the effective workspace role before synchronizing the account into Nous.
| Nous role | Typical workspace meaning | Capabilities |
|---|---|---|
| Admin | Workspace owner or workspace admin | Manage workspace configuration, connectors, document sets, agents, actions, integrations, and synchronized users. |
| Basic | Workspace member | Use chat, projects, available knowledge, and shared agents. Members can also create their own projects and agents where the product is enabled. |
| Limited | Restricted service account | Read supported resources and send chat messages without general administration. |
Organization roles and effective workspace roles are different. An Organization admin receives workspace-admin authority across that Organization’s active workspaces. A direct workspace admin manages only that workspace and does not gain Organization people or Team management.
6.4 Personal API tokens
Any workspace member can create a personal token in Nous. Open the user menu, select User Settings > Accounts & Access, then select Create token. Name the token, choose an expiry, and copy its value when it appears. Nous shows the full value only once. Tokens created here begin nous_pat_.
A personal token acts as its owner in the current Nous workspace. Agent availability, indexed documents, and connected sources follow that person’s access. Store the token in a secret manager, and revoke it from the same screen when it is no longer needed. This token is for the Nous chat API.
For requests, options, and follow-up messages, see Use the Nous Chat API.
6.5 Service accounts
Service accounts represent scripts, scheduled jobs, and integrations that call the Nous API without a browser session. They are workspace-scoped and use bearer tokens.
The Nous Chat API guide also applies to service-account tokens.
Open Settings > Service Accounts, or navigate to /app/admin/service-accounts.
6.5.1 Create a service account
- Click New Service Account.
- Enter a name that identifies the system and purpose, for example
Nightly policy check. - Choose Basic or Limited permissions. Admin service accounts are provisioned through Portal rather than this Nous page.
- Click Create Account.
- Copy or download the token immediately and store it in a secret manager.
Send the token as a bearer credential:
curl -H "Authorization: Bearer $SOPHEA_SERVICE_TOKEN" \
https://nous.example.com/api/me6.5.2 Choose the minimum role
- Admin can call administrative endpoints. Use it only when the integration must change workspace configuration.
- Basic is the default for automation that needs ordinary user-level APIs.
- Limited is appropriate for integrations that only need supported read and chat operations.
Create separate service accounts for separate systems. This gives every integration an independent audit identity and lets you rotate or revoke one token without interrupting others.
6.5.3 Rotate or revoke a token
- Use Regenerate when a token may be exposed or reaches your rotation date. The previous token stops working immediately.
- Use Delete Account when the integration is retired. Existing audit entries remain attributable to that service account. If the service account owns personal connections, Nous removes them first and asks you to try again in a few minutes.
After every rotation, confirm the calling system uses the new token before considering the operation complete.