Administer a Zentrik workspace safely

Zentrik workspace roles are:

• Owner: workspace ownership and the most sensitive workspace-level controls
• Admin: settings, integrations, API keys, team administration, and product configuration
• Editor: day-to-day creation and editing in product workflows without access to workspace Settings
• Viewer: read-only workspace participation

Keep at least one active Owner. Do not use Owner as the default collaboration role. Review Admin access whenever responsibilities change.

Open Settings → Team.

For new teammates:

1. Enter the intended email and role.
2. Review the batch before sending.
3. Check Invitations for pending, sent, failed, expired, or revoked states.
4. Resend only after confirming the original delivery state.
5. Verify that an accepted invitation appears under Members with the intended role.

Owners and Admins can change roles and remove members. Confirm the target identity before removal, especially when names are similar.

The Settings hub groups product configuration and workspace administration:

• Discovery: evaluation, workflow, and property configuration
• Definition: requirements, documentation templates, and user-story standards
• Delivery: sprints and team capacity
• Integrations: connected evidence and delivery providers
• API Keys: credentials for MCP clients and the external API
• Team: members, roles, and invitations
• Billing: plan, usage, and invoices when the role can manage billing
• Portal: Ideas Portal access and configuration when enabled
• Workspaces: Owner-only workspace organization

The options shown in Settings depend on the workspace plan and enabled capabilities.

Treat provider credentials and Zentrik API keys as secrets:

• create separate credentials for distinct systems or agents when practical
• name keys by purpose and owner
• grant only the scopes the workflow needs
• store secrets in an approved secret manager or environment variable
• never paste a key into documentation, chat, source control, screenshots, or support messages
• revoke credentials that are unused, exposed, or owned by a departing teammate
• confirm the active Zentrik workspace before connecting an MCP client

Use MCP setup or the REST API reference for the relevant authentication flow.

Use Settings → Billing for the workspace plan, current usage, configured limits, and invoices when your role has billing access. Use the pricing page for current published packaging.

Workspace Owners can use Settings → Workspaces to review the workspaces they can organize. Separate workspaces when teams or clients require distinct access and context. Do not move data between workspace boundaries without confirming authorization and downstream integrations.

Before removing a teammate:

1. Transfer ownership of important product decisions, documents, integrations, and operating routines.
2. Identify credentials, connected providers, or external automations they own.
3. Create replacement credentials where needed.
4. Revoke the person’s invitations or remove their membership.
5. Revoke or rotate affected API keys and provider credentials.
6. Verify that required integrations and scheduled imports still run.

Removing a member is not a substitute for rotating a credential they could access.

• at least one current Owner is active
• Admin access matches current responsibilities
• Editors and Viewers have the least access they need
• pending and expired invitations are reconciled
• API keys have a current purpose and owner
• integration credentials still belong to active administrators
• billing contacts and invoice access are current
• workspace boundaries match team or client access requirements
• teammates understand which capabilities are enabled for the workspace

Use Security and trust for current public assurance information. For a workspace-specific access, billing, or configuration issue, use the Still stuck? path below and include the workspace name, the screen, what you expected, and what happened.

Do not include passwords, API keys, access tokens, private customer content, or full diagnostic exports in the initial support message.