User Management

The Users screen (/admin/users) lets lab administrators create staff accounts, assign roles, control access, and deactivate users who leave the organization. Every action is scoped to your tenant — you never see users from other laboratories.

Required permission: users.view (create/edit/delete require the corresponding CRUD permissions or legacy users.manage).

User lifecycle

stateDiagram-v2
    [*] --> Invited: Admin creates user
    Invited --> Active: User sets password / first login
    Active --> Active: Role or profile updated
    Active --> Deactivated: Admin disables account
    Deactivated --> Active: Admin re-enables
    Deactivated --> [*]: Optional archival

Creating a user

1. Open Admin → Users.
2. Click Add User (requires users.create).
3. Fill in the required fields:

Field	Description
Full name	Display name across the portal
Email	Login identifier; must be unique per tenant
Phone	Optional; used for SMS notifications
Role	One or more roles from Roles & Permissions
Collection center	Optional; restricts data visibility to a branch

4. Save. The user receives credentials or a password-setup flow depending on your auth configuration.

First lab user

The account created during lab registration is automatically assigned the Admin role. Use that account to provision additional staff.

Editing users

Users with users.edit can update:

• Display name and contact details
• Assigned roles (permissions recalculate immediately on next request)
• Collection center assignment
• Active / inactive status

Role changes take effect without requiring the user to log out, though some cached UI elements may refresh on navigation.

Deactivating users

Deactivation (users.edit) prevents login while preserving historical records:

• Invoices, results, and audit entries retain the original user attribution
• Active sessions may continue until token expiry; force re-login by rotating passwords if needed

Permanent deletion

EaseLab favors deactivation over hard deletion to protect financial and clinical audit trails. Contact platform support if a GDPR erasure request requires deeper removal.

Permissions and menu visibility

A user's effective permissions are the union of all assigned roles. The Admin menu uses view permissions to show or hide items:

flowchart TD
    U[User] --> R1[Role A]
    U --> R2[Role B]
    R1 --> P1[permissions set A]
    R2 --> P2[permissions set B]
    P1 --> E[Effective permissions]
    P2 --> E
    E --> M[Filtered Admin menu]
    E --> API[API authorization]

See Roles & Permissions for the complete module list.

Collection center scoping

When a user is bound to a collection center:

Behavior	Detail
Patients	May be limited to center-registered patients
Invoices	Filtered to center context where applicable
Reports	Center-scoped variants where supported

Leave collection center empty for headquarters staff who need organization-wide visibility.

Lab staff vs EaseLab support

Type	Access
Lab staff	Your lab portal — patients, invoices, and administration for your lab only
EaseLab support	Platform-level assistance for billing, outages, and account issues

Lab user management is done by your lab owner under Administration → Users. EaseLab operators do not use your day-to-day lab portal unless assisting you through an approved support process.

Security best practices

Practice	Why
One account per person	Audit integrity
Least-privilege roles	Reduces billing and catalog accidents
Remove roles before deactivation	Clean permission reviews
Enable 2FA for admins	Protects high-value accounts

Periodic access review

Quarterly, export your user list and verify each account still needs its assigned roles — especially invoices.delete and quick.cancel_invoice.

API reference

Tenant user endpoints are documented under Admin Endpoints. Typical operations:

Method	Path	Action
GET	/admin/users	List users
POST	/admin/users	Create user
PUT	/admin/users/{id}	Update user
GET	/admin/users/access	Current user's effective permissions

Troubleshooting

Issue	Resolution
User cannot see Admin menu	Grant *.view on needed modules via role
"Forbidden" on save	Check read-only mode; verify edit permission
Duplicate email error	Emails are unique per tenant; reuse requires reactivation
User sees empty reports	Assign report group view permissions

Related documentation

• Roles & Permissions
• Security: Roles & Access Control
• How-To: Manage Staff & Roles
• FAQ: Account & Users