Tenant administration

Introduction

Your company is a Maptainer “tenant”: a space of its own, with its data, its users and its configuration. The administrator configures it from two places:

What each person sees and can do depends on three things, one after the other. Each one can only take away: a role permission is no use if the module is not subscribed to or if the company does not use that part.

Prerequisites

Almost all of this manual is only for the Administrador (Administrator) role:

The permissions of the other roles are explained in Roles and permissions.

General settings

You open it from the user menu (top right) → Configuración. It is a single page with several sections, one below the other.

The Geovalla de órdenes de trabajo (Work order geofence), SLA and Tipo de Lecturas (Type of meter readings) sections only appear if you have subscribed to their module.

Saving changes

All the sections are saved together with Guardar configuración (Save settings), at the end of the page. “Configuración guardada” (Settings saved) appears.

1. Change whatever you need in any section.
2. Scroll to the end and click Guardar configuración.
3. If you have changed anything in Ajustar en detalle (Fine-tune), the page reloads by itself: “Se han guardado los cambios. Recargamos para aplicar la nueva estructura de la empresa.” (The changes have been saved. Reloading to apply the new company structure.)

To discard what you have not saved, click Cancelar (Cancel), next to Guardar configuración: the page reloads the saved settings.

The ⓘ icons next to many fields explain each setting when you hover over or tap them.

Working day, formats and planning

The first three sections have their own manual:

The company's working day is used for the SLA, the planner, preventive maintenance and staff capacity. With shifts, each worker also uses their own. A branch can have its own hours (see A branch's own hours).

Formato de fecha and Formato de hora decide how dates and times are written throughout the web app and in the customer portal (see Work calendar).

“Cómo trabaja tu empresa” profiles

This section adapts Maptainer to the size and the way of working of your company. Whatever is switched off is only hidden: no data is deleted and it appears again when you switch it back on.

At the top there are three starting profiles. Each one sets in one go the options in Ajustar en detalle and some settings that are not visible.

The settings that the profile sets and that are not visible on the screen:

With Priority only, the dashboard does not show the charts by criticality (Criticidad Incidencias (Incident criticality) and MTTR por Criticidad (SLA, horas de jornada) (MTTR by criticality, SLA, working hours)).

To change profile:

1. Click the profile you want.
2. Read the message: “¿Aplicar el perfil “…”? Se reemplaza tu configuración actual de capacidades…” (Apply the profile “…”? Your current capabilities configuration will be replaced…).
3. Click Aceptar (OK). The profile is saved immediately and the page reloads.

If you then change a single option in Ajustar en detalle, your company no longer has an exact profile. Below the profiles you see: “Tu configuración actual no coincide con ninguno de los perfiles: la has ajustado a medida. Elegir uno reemplazará esos ajustes.” (Your current configuration does not match any of the profiles: you have customised it. Choosing one will replace those settings.). The hidden settings (life cycle, mandatory fields, dashboard and criticality) stay as the last profile left them.

Fine-tuning

Click Ajustar en detalle to see the ten switches. Switch them on or off and click Guardar configuración.

When you switch off Trabajamos con delegaciones a warning appears: the route optimiser needs to know where each technician starts from. Before doing so, give the head office an address with coordinates (see Branches and sectors).

Suggestions

Maptainer looks at how you work and, if your data justifies it, suggests switching something on. Suggestions are shown in two ways:

• Below an option in Ajustar en detalle, with the label Te lo sugerimos: (We suggest:) and the reason. In that case Ajustar en detalle opens by itself.
• Above the profiles, for a module you have not subscribed to, with the text “Habla con tu proveedor para contratarlo” (Speak to your provider to subscribe to it).

They are only suggestions: they do not change anything unless you act.

Work order geofence

This section sets how the system detects that a technician arrives at or leaves the area of a WO. It only appears with the Tracking de personal (Staff tracking) module. What the geofence does with WOs is described in Work orders.

The entry zone is 200 m around the assets, the point or the area of the WO. The geofence never changes the status of a WO.

If a value is out of range, when you save a message appears with the name of the field and what it accepts, for example “Revisa “Precisión GPS mínima (m)”: admite de 5 a 100.” (Check “Precisión GPS mínima (m)”: accepts 5 to 100.), and the cursor goes to that field. Nothing is saved until you correct it.

Dashboard targets

This section only changes the colour of the dashboard indicators: green, amber or red. It does not change any deadline. It is explained in Dashboard.

Subscribed modules

This section shows which modules your company has. It is for information only: modules are enabled by your provider.

If you need a module that is shown as No contratado, speak to your provider. Without the module, its screens do not appear and its permissions have no effect, not even for the administrator.

SLA

The SLA de la organización (Organisation SLA) section brings together the response and resolution deadlines, which deadline each priority uses, the “SLA en riesgo” (SLA at risk) alert and how compliance is assessed. It only appears with the SLA module. It is explained in Customers and SLA.

Type of meter readings

It only appears with the Lecturas de contador module. It switches on the reading modes your company uses:

The two modes are explained in Reading batches.

Roles and permissions

Each user has a role, and the role decides what they can do on the web and in the app. Roles belong to your company: whatever you change here does not affect other companies.

Where it is

1. Click Ir al administrador in the user menu.
2. Open Gestión de Personal.
3. Click Roles y Permisos, at the top right.

Gestión de Roles y Permisos (Roles and permissions management) opens. On the left are the roles; on the right, the permissions of the chosen role. The padlock marks the system roles, which cannot be deleted.

Starting roles

Each company starts with five system roles:

This is how their permissions come when the company is created. Your company may have changed them since.

In Activos GIS, “All” includes Aprobar cambios (Approve changes), and in Reportes, Costes (Costs) and Seguimiento personal (Staff tracking). With these starting permissions:

• Costes, Seguimiento personal and Aprobar cambios are held by Supervisor and Administrador. Técnico, Almacén and Solo Lectura do not have them.
• Control almacén (Warehouse control) is held by Almacén, but not by Supervisor: the supervisor does not adjust the inventory or record valued receipts.
• Configuración Global → Editar, which gives access to the maintenance catalogue, is held only by Administrador.
• Personal → Editar, which shows the rate, the home address and the reason for absences, is held only by Administrador.
• The Técnico completes their WOs from the app, but does not validate or close them. If you want them to, tick Cerrar (Close) under Mantenimiento (see Changing a role's permissions).

What each role sees on screen is summarised in Getting started.

The permissions table

Click a role to see its table. Each row is a module and each checkbox, a permission. The rows are in four groups: Operativa Diaria (Daily operations), Administración y Catálogos (Administration and catalogues), Módulos Contratados (Subscribed modules) and Avisos que recibe (Alerts received).

A grey row with the label inactivo (inactive) belongs to a module that your company has not subscribed to. Its permissions have no effect even if they are ticked.

Each checkbox has its name beside it, and hovering over it shows what it allows. These are the checkboxes in each row:

What each permission allows

The detail for each module is in its manual. This is the summary:

What the technician sends from the app is also checked against their role: Cerrar to validate, close or reopen a finished WO, Eliminar to cancel it; asset Crear, Editar and Eliminar to create, modify or decommission assets; meter reading Crear and Editar; and inventory Movimientos for materials. If something is rejected, the app shows the error for that record and the rest is saved. See Permissions in the app.

Anyone who does not have Configuración Global and is not an administrator does not see Configuración in the menu. If they open the page by typing its address, they only see “No tienes permiso para acceder a Configuración” (You do not have permission to access Configuración).

Changing a role's permissions

1. Click the role on the left.
2. Tick or untick the checkboxes. The ones you have changed are highlighted.
3. Click Guardar cambios (Save changes). “Permisos guardados correctamente” (Permissions saved successfully) appears.

Descartar (Discard) puts the checkboxes back as they were saved. The changes apply to all users with that role. They reach them within a minute at most; menus change when they reload the page.

The Administrador role has no checkboxes: it always has full access to everything subscribed.

Creating a role

Create your own role when none of the starting ones fits, for example an area manager who only views and assigns.

1. Click Nuevo rol (New role), at the top right.
2. Enter the Nombre del rol (Role name) (mandatory).
3. If you want, enter a Descripción (Description).
4. In Copiar permisos base de (Copy base permissions from), choose the role to start from, or leave it as “— Sin permisos base —” (No base permissions).
5. Click Crear rol (Create role). “Rol creado correctamente” (Role created successfully) appears.
6. Click the new role on the left and adjust its permissions.

• You can only copy the permissions of Supervisor, Técnico, Almacén and Solo Lectura. A custom role cannot have the administrator's full access.
• You cannot use a name that already exists (“Ya existe un rol con ese nombre.”, A role with that name already exists.) or the internal names of the system roles: admin, supervisor, technician, warehouse, readonly or superadmin.

The role's tab and the Rol de sistema (System role) drop-down on the staff record show the name. The description appears when you hover over the tab and below the role title.

Deleting a role

You can only delete custom roles that no user has. System roles are never deleted.

1. Click the role on the left.
2. Click Eliminar rol (Delete role) and confirm with Eliminar.

If someone has the role, Eliminar rol does not appear: instead, a notice says how many users have it and who they are. Change their role on their Gestión de Personal record and the button will appear. If someone is given the role just as you delete it, Maptainer rejects the deletion and shows the list of users.

Exceptions for one user

There is no screen for giving or removing a permission for a single person. If someone needs permissions different from those of their role, create a role for them.

Company users

Company users are not created separately: each account is linked to a staff record. Everything is done in Gestión de Personal and is explained in Staff and teams.

• Your plan sets a maximum number of users. All accounts count, including inactive ones and those that have not been activated. When you reach the maximum, “Has alcanzado el límite de … usuarios de tu plan. Amplía tu suscripción para poder añadir más.” (You have reached your plan's limit of … users. Upgrade your subscription to add more.) appears. Only deleting an account frees a place: the deleted person is anonymised and no longer counts.
• Rol de sistema lists Administrador, Supervisor, Técnico, Almacén and Solo Lectura, followed by the custom roles by name. The ⓘ help explains what each system role does.
• Your customers' portal users are managed in Gestión de Clientes (Customer management). See Customer portal.

Remote connections

A remote connection stores the address and access key of another system's API, for example your ERP or an external inventory. Asset layers use it to fetch their data (see Layers and asset types).

It is in the administrator → Conexiones Remotas. Only the administrator sees it.

If you are unsure whether to use this screen or API y copias de datos, open ¿Para qué sirve esta pantalla? (What is this screen for?) below the title, or see Remote connections or API keys.

Each connection has a name and up to three URL base (Base URL) + token pairs, for example for production and pre-production. Each connection is shown as a card with its addresses and whether the token is Configurado (Configured) or Sin token (No token). The token is never shown again.

Creating a connection

1. Click Nueva conexión (New connection) (or Crear primera conexión (Create first connection) if there are none).
2. Enter the Nombre (Name), for example “API ERP de producción”.
3. In URL 0, enter the base address of the API, for example “https://erp.ejemplo.com/api/v1”.
4. Next to it, enter the Token de acceso (Access token) if the API requires one.
5. If necessary, fill in URL 1 and URL 2. Empty rows are ignored.
6. Click Crear conexión (Create connection). “Conexión creada” (Connection created) appears.

Maptainer sends the token to the API as a “Bearer” credential. It only connects to public Internet addresses and does not follow redirects.

Editing or deleting a connection

• Editar conexión (Edit connection) (the pencil on the card): change the name or the addresses. Leave the token empty to keep the saved one, or tick Quitar el token guardado (Remove the saved token). Click Guardar cambios.
• Eliminar conexión (Delete connection) (the bin): confirm with Eliminar. It cannot be undone.

If any layer uses the connection, it is not deleted: a message appears with the names of those layers. Remove the connection from their Origen de datos externo (External data source), or delete those layers, and try again. Nor can you empty an address that a layer uses. If you change the order of the addresses, each layer keeps using its own.

Each layer uses the address you choose in its Base URL (see Layers and asset types).

API and data backups

This screen is used for two things: giving other systems read access to Maptainer data, and downloading a full copy of everything. It is in the administrator → API y copias de datos. Only the administrator sees it.

Remote connections or API keys

Both screens store credentials, but in opposite directions:

Both screens explain it in ¿Para qué sirve esta pantalla?, below the title. Click that strip to open it. From there you can jump to the other screen or to this manual.

Full backup

Backup completo (Full backup) generates a ZIP with everything your company has subscribed to: assets, work orders, incidents, meter readings, inventory, staff and catalogues. It also includes the photographs and attached documents, and whatever has been decommissioned or deleted.

1. Click Backup completo.
2. Confirm with Generar copia (Generate backup).
3. Wait. A bar shows the progress. You can leave the screen: the backup keeps being generated.
4. When it finishes, click Descargar el ZIP (Download the ZIP).

Only one backup is generated at a time: meanwhile, the button is locked. Each backup can be downloaded for 3 days and is then deleted. The history says who requested it, its status (En cola (Queued), Generándose (Generating), Disponible (Available), Fallida (Failed) or Caducada (Expired)) and its size.

When you open the ZIP you will find:

Dates are in the time zone of your main branch and numbers use a decimal comma. Hours are in decimals: 1,50 is one and a half hours.

Creating an API key

Create one key for each tool that connects. That way you can remove access for one without touching the others.

1. Click Nueva clave (New key).
2. Enter the Nombre, for example “Power BI”.
3. If you want, choose when it Caduca (Expires). Without a date, it never expires.
4. Tick the Permisos (Permissions): what the key will be able to read. Modules not subscribed to are shown in grey and cannot be ticked.
5. Click Crear clave (Create key).
6. Click Copiar (Copy) and paste the key into the other tool. Then click Hecho (Done).

Keys are read-only: none can create, change or delete data. Each key allows 120 requests per minute, and the company can have up to 50 keys.

Whoever is going to program the integration will find the technical details in Referencia de la API (API reference) and Guía de la API (API guide), at the top right.

Deactivating, rotating or deleting a key

The keys table shows, for each one, its permissions, its status (Activa (Active), Desactivada (Deactivated) or Caducada), its Último uso (Last used) and when it Caduca.

• Desactivar (Deactivate): the key stops working until you click Activar (Activate). Useful for cutting off access for a while.
• Rotar (Rotate): creates a new key with the same permissions. You choose whether the previous one is deactivated now or keeps working for 1, 7 or 30 more days, to allow time to change it in the other tool.
• Eliminar: the key stops working for good. It cannot be undone.

Audit

The audit log records your company's sign-ins and sensitive changes: who signs in, from which IP and what they change in users, roles and credentials. Nobody can modify or delete the log from Maptainer.

It is in the administrator → Auditoría. Only the administrator sees it.

What is recorded

Searching the log

Each row has Fecha y hora (Date and time), Acción (Action), Quién (Who), Sobre qué (On what), Resultado (Result) (Correcto (Successful) or Fallido (Failed)) and IP.

1. Filter with Tipo (Type), Acción, Quién, Resultado, Desde (From) and Hasta (To). The list updates immediately.
2. Click Detalle (Detail) on a row to see the data: what changed (“antes → después”, before → after), the IP and the browser or the app.
3. Click the name under Quién to see only what that person did.
4. Click historial (history), under Sobre qué, to see everything that affects that user, role or WO. quitar (remove) undoes that filter.
5. Quitar filtros (Clear filters) returns to the full list.

The list shows 50 entries per page; use Anterior (Previous) and Siguiente (Next). For failed attempts, Cuenta (seudónimo) (Account, pseudonym) shows a code instead of the email that was typed.

The audit log cannot be exported from the screen.

Account security and good practice

The access rules are the same for all users and are explained in Getting started:

When your company's subscription is 30 days or less from expiring, a strip appears at the top: “Tu suscripción vence en N días. Ponte en contacto con tu proveedor para renovarla.” (Your subscription expires in N days. Contact your provider to renew it.). Entendido (Understood) hides it for the rest of the browser session.

Good practice for the administrator:

• One account per person. Do not share users: each sign-in throws the other person out and the audit log can no longer say who did what.
• Few administrators, but more than one. The administrator can do everything. Give that role only to whoever configures the company, and have at least two so that you are not left without access.
• The right role. Start from the most similar role and remove what is not needed. For a special case, create a custom role.
• Same-day deactivation. When someone leaves, set their account to Inactivo / Bloqueado and their record to Inactivo (Inactive) (see Deactivating or deleting).
• Lost mobile. Ask that person to close the mobile session from their profile (see Closing the mobile session). If they cannot, set their account to Inactivo / Bloqueado in the meantime.
• Check the audit log from time to time. Filter by Resultado → Fallido to see unusual sign-in attempts.
• Tokens with the minimum permission. In Conexiones Remotas, use read-only keys if the other API allows it. In Claves de API, tick only the permissions each tool needs.
• One API key per tool. That way you can cut one off without affecting the others, and Último uso tells you which one is still in use.
• Profile changes, at the start. Changing profile while operations are running changes the WO life cycle.

Current limitations

• Guardar cambios and Descartar are always visible in the permissions table.

Common problems

Last updated: OCT 2, 2026