# Managing access in Salto KS
> Manage user access and permissions in your Salto KS site, for site owners and administrators.


## Overview {#overview}

This page covers how to manage user access and permissions in your Salto KS system.
Whether you are a Site Admin, Site Owner, or a user with access-management permissions, this guide walks you through key tasks such as granting access, managing hardware, configuring credentials, and reviewing events.

## Grant access to a user {#grant-access}

### Adding users {#adding-users}

On the **Users** tab, you have an overview of everyone who has access to your site.
From here, you can manage each user's role and permissions and add new people to your site.

There are two ways to create users.
You can manually add each user to the site or upload a CSV file containing a list of users.

To add users to your site, follow these steps:

1. Click on the **Add Users** button in the header.
The system displays options to add users.

2. Choose between the following options:
   - **Manually**: Enter the user's email to add them to this site or check if the user is already part of it.
     Add in their information and define their roles, rights, and access groups.
   - **Upload CSV**: Follow the instructions to ensure your file meets the requirements or download the template.
     Upload the file to add users successfully to your site.

### Create access groups {#create-access-groups}

Access Groups are collections of users for whom you can define specific access rules, namely, who can access which locks and during which timeframes.

To create a new Access Group, follow these steps:

1. Navigate to the **Access** page in your web app.

2. Click on **Add Access Group**.
The Access Group creation screen is displayed.

3. Provide a unique and descriptive name for the group so it is easy to identify later.

4. Select the users, locks, floors, and timeframes that will apply to all users in the group.

{{% info-panel %}}
You can view and manage existing Access Groups on the **Access Groups** page.
By selecting any group, you can update it by adding or removing users, or by adjusting its associated parameters as needed.
{{% /info-panel %}}

### User roles and permissions {#user-roles-and-permissions}

Users in a Salto KS site can be assigned specific roles that define their level of access and the actions they are permitted to perform within the site.
The role assigned to each user depends on the responsibilities and permissions you want them to have.
Roles help ensure that only authorized individuals can manage settings, assign access, or view specific site information.
Understanding these roles is key to managing your site securely and effectively.

Salto KS defines four primary roles, each with distinct capabilities:

- **Site Owner**: There is only one Site Owner for each site.
  The Salto KS account is registered in this person's name.
  The Site Owner can create Site Admins, Super Users, and Site Users.
  The Site Owner can also modify users' information and account settings.
- **Site Admin**: This user has all the same rights as a Site Owner.
  They cannot, however, alter information of or delete the Site Owner.
- **Site Super User**: A Super User can view but not modify the details for the Owner or Site Admins.
  A Super User can, however, create other Site Super Users and new Site Users and grant them basic rights.
- **Site User**: This is the most basic of roles.
  These users only require access to unlock doors.
  They typically only need the mobile app to gain access to a site they are added to.

{{% info-panel %}}
For more information on how to delete, block, or change user permissions, see [Manage users and credentials](#manage-users-and-credentials).
{{% /info-panel %}}

## Manage users and credentials {#manage-users-and-credentials}

As a Site Owner or Admin, you can assign and manage user credentials to control access effectively.
Here is an overview of credential types that may be assigned to users:

- **RFID Credential (Tag/Keycard)**: Contactless key fob with a secure chip.
  Present it to a lock for which the user has permissions to gain entry.
- **Digital Key (Bluetooth LE)**: Mobile credential stored in your smartphone.
  Tap your phone to a BLE-enabled lock using the Salto KS app.
- **PIN Code**: Enter a unique PIN on the lock or wall reader keypad.
- **Custom PIN**: Users can set a 4-6-digit PIN via the mobile app or let the system auto-generate one.
- **Remote Opening**: Unlock doors from anywhere using the Salto KS web or mobile app.

To manage these credentials in your Salto KS web app, follow these steps:

1. Navigate to the **Users** page in the web app.

2. Click on the user whose credentials you want to manage.
The **Manage Keys** page is displayed.

### Select the user's actions menu {#select-user-actions-menu}

At the top header of the user's page, open the **Actions** dropdown menu where you can manage the user and their credentials.

Available options include:

- **Edit User**
- **Reset IQ PIN**
- **Add to Access Group**
- **Block/Unblock** (user)
- **Delete** (user) or **Remove my data** (when managing your own user profile)

### Manage credentials via chips {#manage-credentials-via-chips}

Below the header, you will see four chips: **Keys**, **Entries**, **Lock Options**, and **Access Groups**.

#### Keys {#keys}

Under the **Keys** section, you can:

- Assign a Tag (RFID keycard)
- Assign a PIN
- Block Digital Key
- Delete your own Digital Key
- Assign Offline Access

#### Entries {#entries}

Under the **Entries** section, you can view the user's entry history.

#### Lock options {#lock-options}

In the **Lock Options** section, you can manage the following opening modes:

- **Remote Opening**: Unlock doors remotely via Salto KS web or mobile app.
- **Remote Office Mode**: Set locks to Office Mode remotely for unrestricted access during specific timeframes.
- **Manual Office Mode**: Activate Office Mode manually by presenting a valid Digital Key, tag, or PIN.
- **Easy Office Mode**: Enable Office Mode for scheduled timeframes by activating with a valid credential.
- **Override Privacy Mode**: Allow the user to override Privacy Mode using a tag, Digital Key, or Remote Opening.

#### Access groups {#access-groups-manage}

In the **Access Groups** section, you can assign or manage the user's access groups.

## Offline access {#offline-access}

In the event that wireless locks lose connection to the IQ, Offline Access ensures that authorized users' credentials can still unlock doors.

With Offline Access:

- Site Admins can grant offline permissions for a user per credential.
- Offline access rules are synced from the IQ and stored locally in the lock's memory.
- Users can access doors using Digital Keys or Tags, even when real-time connectivity is interrupted.
- This feature guarantees uninterrupted access for up to 360 credentials for BLUEnet locks and 39 credentials for RFnet locks.

To grant Offline Access to a user, follow these steps:

1. Navigate to the user's **Keys** page.

2. Select the **three‑dot menu** next to the relevant key.

3. Select the option to assign offline access.

{{% info-panel %}}
Offline Access adds a layer of resilience and reliability across all Salto KS hardware components, making it a vital part of your site's access strategy.
{{% /info-panel %}}