> For the complete documentation index, see [llms.txt](https://wiki.crosswatch.app/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://wiki.crosswatch.app/crosswatch/settings/connections/managed-users.md). # Managed users CW supports managed users through a **delegation model**. One CW installation stays centrally managed. A **User Profile** delegates selected resources to a managed user. Managed users do not receive separate CrossWatch installations. {% hint style="info" %} CW is an advanced synchronization tool. It is not a tracker. Managed users need to understand provider connections, synchronization resources, and their delegated scope. For that reason they dont get to create their own sync pairs etc. {% endhint %} ``` Provider instances ↓ Sync Pairs, Watchers, and Webhooks ↓ User Profile ↓ User Account ↓ Read Only or Full Access ``` Remember these three concepts: ``` User Profile = what belongs to the user User Account = who signs in Access Mode = what the user may do ``` {% hint style="info" %} A **provider profile** stores a connection to one provider account or server. A **User Profile** defines a managed user's delegated CrossWatch scope. {% endhint %} {% hint style="warning" %} **When using managed users, create:**\ **Dedicated provider instances, Sync Pairs, Watchers, and Webhooks for each account.** Each provider instance belongs to exactly one managed user. Do not share instances or resources between User Profiles. {% endhint %} {% hint style="info" %} Scheduling cannot be delegated to managed users yet. {% endhint %} ### Set up a managed user An administrator can create a managed user's resources before creating the account. A **Full Access** user can also create and manage supported resources within their delegated scope. {% stepper %} {% step %} ### Create provider instances Create a provider instance for each account CrossWatch should manage. For Alex, you might create `Alex Plex`, `Alex Trakt`, and `Alex SIMKL`. The built-in `default` instances is only for the administrator and cannot be used. Use clear names. These instances appear in sync resources and User Profiles. Never assign them to another user's profile. See [Profiles](/crosswatch/settings/connections/profiles.md) for creating provider connections. {% endstep %} {% step %} ### Create synchronization resources Create the Sync Pairs, Watcher routes, and Webhook routes for that user's instances. For example: ``` Alex Plex → Alex Trakt Alex Plex → Alex SIMKL ``` These are normal CrossWatch resources. Creating a user account does not create them automatically. See [Configure Pairs](/crosswatch/settings/configure-pairs.md) and [Watcher](/crosswatch/settings/scrobbler/watcher.md). {% endstep %} {% step %} ### Create a User Profile Create a User Profile, such as `Alex`, then assign Alex's resources. ``` Alex Provider Instances Alex Plex Alex Trakt Alex SIMKL Sync Pairs Alex Plex → Alex Trakt Watchers Alex Plex → Alex SIMKL ``` The User Profile is the delegation boundary. Assigning a synchronization resource also includes its required provider instances. Add provider instances directly when a user needs them outside a synchronization resource. {% endstep %} {% step %} ### Create the User Account Create the login and assign its User Profile. ``` Username: alex User Profile: Alex Access: Read Only ``` The account provides the identity. The assigned User Profile determines the available resources. {% endstep %} {% endstepper %} ### User Profiles and User Accounts #### User Profile A User Profile defines the delegated resource scope. It answers: **Which CrossWatch resources belong to this user?** It can include: * Provider instances * Sync Pairs * Watcher routes and Webhook routes Every included provider instance must belong only to that user. #### User Account A User Account is the login identity. It defines: * Username and password * Assigned User Profile * Enabled status * Access Mode It answers: **Who signs in, and what may they do?** ### Access Modes Access Mode controls actions within the assigned User Profile. It does not control the resources a user can see. #### Read Only **Read Only** allows users to view their delegated environment. This can include dashboard, watchlist, playback, activity, insights, status, and synchronization information. Read Only users cannot change normal CrossWatch resources. #### Full Access **Full Access** is the default for new managed users. It permits supported write actions within the delegated User Profile. Users can create, edit, and run Sync Pairs using their delegated provider instances. They can also manage supported Watcher routes, Webhook routes, watchlists, playback, and editor functions. A resource always stays within the User Profile boundary. Users cannot use another user's provider instances or resources. {% hint style="warning" %} **Full Access is not administrator access.** Managed users cannot access global configuration or application user management unless delegated functionality supports it. {% endhint %} ``` Administrator = controls CrossWatch User Profile = controls resource scope Access Mode = controls capability within that scope ``` ### Example: Alex and Sam An administrator uses one CrossWatch installation for Alex and Sam. ``` Provider instances Alex Plex → Alex Trakt Sam Plex → Sam Trakt User Profiles Alex Profile: Alex Plex, Alex Trakt, Alex Plex → Alex Trakt Sam Profile: Sam Plex, Sam Trakt, Sam Plex → Sam Trakt User Accounts alex → Alex Profile → Full Access sam → Sam Profile → Read Only ``` Both users share the installation. Each User Profile isolates the resources delegated to that user. ### Provider instance ownership A provider instance must belong to one managed user and one User Profile. Do not share provider instances between users. This is unsupported in the UI. `config.json` can represent a shared provider instance. Do not use this configuration. It creates an unsupported ownership model. Create dedicated instances for each user. Prefer names such as `Alex Plex` and `Sam Plex`. Assign each Sync Pair, Watcher route, and Webhook route to the profile that owns its workflow. Do not cross user boundaries. ### Existing installations You do not need to rebuild an existing CrossWatch installation. Existing provider instances and synchronization resources can remain in use. Assign each provider instance to only one user's scope. Create dedicated provider instances and resources when stronger separation is required. ### Add another managed user 1. Create provider instances for the user. 2. Connect them to the correct external accounts. 3. Create a User Profile and assign the provider instances. 4. Create a User Account and assign the profile. 5. Choose **Read Only** or **Full Access**. 6. Create Sync Pairs, Watchers, and Webhooks as an administrator or Full Access user. 7. Sign in as that user and verify the delegated scope. ### Summary Assign each provider instance to one user only. Delegate resources through a User Profile. Full Access users can create and manage supported synchronization resources within that scope. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://wiki.crosswatch.app/crosswatch/settings/connections/managed-users.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.