EARLY ACCESS Muster is being validated by pilot departments. Schedule a walk-through →
← Documentation

For admins — admin console guide

The admin console at admin.safesignals.io is where department administrators manage personnel, devices, incident archives, licensing, mutual-aid partners, and long-term exposure records. This guide covers the console's day-to-day workflows.

Testing Muster before your department goes live? Start with tester_onboarding.md. The tester department + License Key are pre-provisioned by Safe Signals; this admin guide describes what you'll actually see in the console once you're signed in.

Who's an admin? Anyone with a role that grants console access:

  • Chief — full access to everything.
  • Admin — everything except billing and Chief assignment.
  • Training Officer — training tab, read-only elsewhere.
  • Safety Officer (admin) — safety-relevant data.
  • Health Officer — exposure records, occupational health.
  • Billing Contact — billing only.
  • Read-only — dashboards and reports only.

Tier requirement: Admin console is available for Tier 1 and above. Emergency-tier departments use in-app administration instead.

Table of contents

  1. First-time setup
  2. Personnel management
  3. Device management
  4. Incident archives
  5. Training archives
  6. Mutual-aid partnerships
  7. Safety and exposure records
  8. Reports and compliance exports
  9. Configuration and settings
  10. Billing and licensing
  11. Audit log
  12. User management and 2FA
  13. Integration partners (API access)

First-time setup

Testers see a different first-time flow than self-service customers. If Safe Signals hand-minted your License Key and pre-provisioned your test department (typical if you're in the pre-live cohort), your admin credentials arrive by direct email from Safe Signals, not the Stripe Checkout welcome email. Sign in at admin.safesignals.io with the email + temporary password from that email; the flow below (steps 2 and 3) is otherwise the same. See tester_onboarding.md §1-2 for the broader tester onboarding context.

When your department purchased Muster via muster.safesignals.io, the billing email became your initial Chief. Check that email for your activation link, then:

  1. Follow the link and set a password.
  2. See 2FA below for the current authentication baseline (Firebase Auth email + password; TOTP enforcement is Phase 5d work).
  3. From the dashboard, walk through Settings → Department profile, then Personnel → Admins to invite other admins. There's no dedicated setup wizard today — the initial onboarding is one dashboard visit + a few tab clicks.

Personnel management

Every firefighter or officer who uses Muster is a personnel record in your department. Manage them via the Personnel tab.

Adding personnel — two ways:

  • One at a time — Personnel → + Add member. Fill in personnel id, display name, member number, rank, and a comma-separated list of certifications. Ships end-to-end via POST /v1/admin/personnel and is audit-logged.
  • From a mobile check-in — when a firefighter checks into their first incident, their record is auto-created. Chief edits the details later.

CSV bulk import — the "+ Add member" panel also has a CSV textarea below the single-add form. Paste a CSV with a header row (personnel_id, display_name required; optional member_number, rank, certifications as semicolon- separated inside the cell). Muster imports each valid row via the same POST /v1/admin/personnel/bulk write path; rows that conflict (duplicate id) or fail validation come back in a per-row rejection list so you can fix and resubmit.

Editing personnel:

  • Personnel → member row → Edit member. Update display name, member number, rank, and certifications. PATCH /v1/admin/personnel/{id} is the write path; every field change is audit-logged.

Removing personnel:

  • Personnel → member row → Retire (soft-deactivate). Sets active: false; the record persists indefinitely for OSHA 1910.1020 retention purposes. DELETE /v1/admin/personnel/{id} maps to soft-deactivate on the backend, not hard delete.
  • Never hard-delete — Muster's OSHA 1910.1020 retention rule requires 30+ years post-separation for personnel involved in exposure events. Retiring is the correct action; hard deletion is architecturally refused.

Qualifications:

Personnel → member detail → Qualifications card. Three NFPA-mapped checkboxes plus a free-form certifications section:

  • Incident Safety Officer (ISO) — grants iso_qualified. NFPA 1521 → NFPA 1550 Chapter 5. Surfaces the member on the safety-page ISO-qualified roster (the roster chiefs consult before assigning ISO on a real incident, per NFPA 1550 Chapter 21.13).
  • Incident Commander (IC) — grants ic_qualified. NFPA 1550 Chapter 5 Fire Officer qualification.
  • Training Officer — grants training_officer_qualified. NFPA 1041 / NFPA 1020.

Advisory only in the app, not a hard block. When an operator picks IC or ISO from the mobile role picker on a real-mode incident, Muster surfaces a red compliance-warning subtitle citing the applicable NFPA standard. The picker does NOT hard-block the selection — rules 5 and 22 preserve the operator's unconditional authority to make command and safety decisions. The Qualifications card is the chief's tool for keeping the roster in sync with training records.

Rehab officer, apparatus operator, hazmat tech, and other role qualifications are captured as free-form certifications in the same set alongside the three NFPA-mapped flags.

Behind the scenes: qualifications are stored as well-known wire keys (iso_qualified, ic_qualified, training_officer_qualified) inside the personnel record's certifications: Set<String>. Free-form certifications coexist with the flags. The typed PersonnelQualification enum + Personnel.hasQualification() predicate in core_domain give programmatic consumers a typo-proof API.

Certification expiration reminders — two ways to enter per-cert expiration dates:

  • Per-member editor — Personnel → member row → Edit training & certs → + Add cert expiration. Type cert name + YYYY-MM-DD date; save.
  • In the CSV bulk import — add a cert_expirations column. Values are semicolon-separated name=YYYY-MM-DD pairs (e.g., NFPA 1001=2027-06-01;EMT-B=2026-08-15). One row per firefighter carries all their expirations.

Both write to the same personnel-record cert_expirations map that the Reports tab's Certification expiration PDF reads from — urgency-banded 0-30 / 31-60 / 61-90 / 91-180 day windows + "already expired" rows so chiefs can plan renewals.

Firefighter portal invitations — Tier 2 and above:

  • Personnel → member detail → Send portal invitation.
  • Firefighter receives an email with a magic link.
  • They access their own vitals history, exposure records, and cancer presumption documentation at firefighter.safesignals.io.
  • Can revoke portal access from the same page.

Device management

Every Muster device is registered under your department's license. Manage via the Devices tab.

Device activation:

  • Chief runs Devices → Generate activation code. Emails the code to the firefighter along with install instructions.
  • Firefighter installs Muster, enters the activation code.
  • Device is registered under your department.

Device list shows:

  • Device ID (Ed25519 fingerprint).
  • Associated firefighter (if assigned).
  • Device type (iPhone, iPad, laptop).
  • App version.
  • Last seen (via cloud sync).
  • Current incident status (if in one).

Actions per device:

  • Revoke — device stops working for this department AND the License Key it holds is added to the blocklist so every cloud-write handler (event upload, archive upload, relay engagement, exposure upload, etc.) refuses the key going forward. Revocation takes effect within ~5 minutes on every Cloud Run instance (the per-instance revocation cache refreshes on a 5-minute TTL). Local mesh Mayday, evacuation, and exposure capture continue to work on any session already running on the revoked device — rule 6 is unconditional. Use when a device is lost, stolen, or a firefighter leaves the department.
  • Reassign — transfer to a different firefighter.
  • Force logout — end the current session, requiring re-activation.
  • View activity log — every action this device has taken.

Revoked devices are marked but retained in the audit log; not deleted. The revoke action's response includes license_jti_blocklisted: true|false so you can confirm the JTI write landed. If it returns false, the device record pre-dates the Stage 2 license_jti schema — re-registering from the device (or using the standalone POST /v1/admin/licenses/<jti>/revoke endpoint) populates the field.

Seat management:

  • Tier 1: hard cap of 25 active members enforced in the License Key.
  • Tier 2 and above: per-member scaling, no hard cap. See Billing and licensing for seat-count changes.

Incident archives

Every finalized incident produces a signed .muster archive. Access via the Incidents tab.

Browsing:

  • Filter by date range, incident type, outcome, host department (for mutual aid).
  • Search by incident number.
  • Sort by date, duration, or outcome.

Per-incident detail:

  • Full metadata (times, address, personnel involved, host department).
  • Timeline view.
  • Safety events (hazards, evacuations, emergency traffic).
  • Exposures captured.
  • PDF snapshot of the after-action report.
  • Rehab cycles.
  • Whiteboard snapshot.
  • Mayday events (subject to visibility settings — see Configuration and settings).

Archive actions:

  • Regenerate PDF — useful after adding corrections or changing PDF style settings.
  • Export archive — download the raw .muster file for offline retention.
  • Request correction — post-finalization corrections require admin authorization; adds a CorrectionNoted event to the archive, original preserved (rule 21).
  • Investigation mode — audit-logged access to full Mayday detail regardless of the department's default visibility setting. Used for internal investigations, insurance claims, workers' comp.

Mutual aid archives:

  • Host department archives contain the full authoritative incident record.
  • Guest department archives are scoped — events involving your personnel + incident-level context. Non-personnel- attributed events from other departments are redacted per privacy rules.
  • If the host issues corrections post-finalization, guest archives show a banner "Host issued N correction(s) since this scoped copy was generated" — click Re-pull scoped copy to refresh.

Training archives

Separate tab from real incidents. Same filtering and search. Training archives retain indefinitely by default — they're a teaching library over time, not disposable data.

  • Tag archives (structure-fire, mayday-drill, mci, rescue, etc.) for cross-drill analysis.
  • "Learning value" flag — instructors set on notable drills; surfaces them in a "recommended for review" list.
  • Publish within department — notify members a specific drill is worth reviewing.
  • Cross-reference with related real incidents or other drills.

Training archives cannot be submitted to NERIS and are watermarked "TRAINING — NOT A REAL INCIDENT" on every PDF page.

Mutual-aid partnerships

Tier 2 and above. Mutual aid tab manages partner departments.

Registering a partner:

  • Mutual Aid → Register partner.
  • Enter the other department's ID (they share it with you) and their Ed25519 public key fingerprint.
  • Configure terms: reciprocal or one-way, scope limitations, expiration.
  • Partner department's admin gets notified to confirm.

Partner-registered vs. spontaneous mutual aid:

  • Partner-registered — auto-trust at incident time. No QR ceremony needed. Two clicks to activate mutual aid on a running incident.
  • Spontaneous — QR token bootstrap. One device shows a QR; the other scans. Slower but works without pre-registration.

Revoking a partner:

  • Mutual Aid → partner card → Revoke.
  • Takes effect immediately. Future incidents no longer auto-trust.
  • Past incident archives are unaffected.

Safety and exposure records

Safety and Exposures tabs surface longitudinal data across incidents.

Safety tab:

  • Recent safety events across all incidents (hazards raised, emergency traffic, evacuations, safety concerns).
  • ISO qualification roster.
  • Trend analysis (repeat hazard types, evacuation frequency).
  • Near-miss log.

Exposures tab:

  • Aggregate department statistics (non-identifying by default).
  • Per-firefighter exposure history (restricted to Chief / Admin / Health Officer, audit-logged).
  • Trend analysis by contaminant type.
  • PPE failure patterns.
  • Cancer presumption documentation generation for California, Florida, New York, New Jersey, Massachusetts, Pennsylvania, Texas, and Illinois. State-specific requirements are documented in the reports themselves and in the Reports tab of the admin console.

30-year retention is enforced architecturally. Admin cannot configure exposure retention shorter than OSHA 1910.1020 requires.

Reports and compliance exports

Reports tab generates compliance documentation:

Live today:

  • NFPA 1550 compliance report — auditor-visible signals (ISO designation rate, PAR completion, exposure capture, Mayday tracking, correction rate). Per-chapter feature coverage.
  • NFPA 1580 compliance report — tiered claim (full Chapters 20-22, supports Chapters 4-13, informational Chapters 14-19).
  • OSHA 1910.1020 exposure summary — retention compliance badge, aggregate stats, top-25 firefighter exposure history, audit-trail counts proving employee-access logging.
  • Audit log CSV — RFC 4180 full-detail export for legal discovery.
  • Incident statistics CSV — windowed type/outcome/hour-bin distribution.
  • Personnel roster CSV — current roster with rank, certifications, status.
  • Device inventory CSV — every activated device.
  • Certification expiration PDF — urgency-banded renewal reminders.
  • Training cadence CSV — training hours by member for NFPA 1550 Chapter 11-15 personnel-training documentation.

Deferred (visible on the Reports page as Phase 8+):

  • State-specific cancer presumption packages for California, Florida, New York, New Jersey, Massachusetts, Pennsylvania, Texas, and Illinois. Each state's format is generated by a dedicated renderer inside Muster's cloud services; the download button in the admin console will appear once your Tier 2 or higher subscription's long-term exposure surface is fully activated.

All live reports are download-only. Nothing is emailed automatically — the chief chooses when to generate and where to send.

Configuration and settings

Settings tab. Chief and Admin roles only.

Department profile:

  • Department name, address, contact info.
  • Logo (appears on PDFs).
  • Timezone.

Incident-time defaults:

  • Rehab thresholds (default per NFPA 1580 Chapter 22.7.1.1; department-customizable).
  • Span-of-control warning threshold (default 5 per NFPA 1550 Chapter 21.2).
  • PAR interval (default 20 minutes).
  • Fatigue-monitor thresholds.
  • Auto-finalize window (default 72 hours).

Visibility and privacy:

  • pdfSignatureStyle — prominent (default) / none.
  • archiveStorage — local_only / cloud_only / cloud_and_local.
  • maydayVisibility — full_disclosure / admin_privileged (default) / restricted / redacted.
  • vitalsRetention — incident_only (default, strictest) / department_aggregate / personal_history (requires firefighter opt-in).
  • exposureInReport — summary_only (default) / named_by_admin / named_in_all.
  • safetyEventsInReport — full_detail (default) / summary_only / admin_only.

Notification settings — per-admin, not per-department. Which events trigger notifications, on which channels (email, SMS, in-app, push), quiet hours, escalation rules.

Integrations (Tier 2 and above):

  • Issue per-dept API keys — the legacy model. Mints a License Key scoped to your department that an integrator bakes into their SDK. Revoke individual keys via the "API keys" list.
  • Authorize a registered integration — the newer two-step onboarding model. Vendors self-register their capability declarations globally on api.safesignals.io; you click Authorize on the Integrations page's "Authorized integrations" panel to grant that vendor consumer access to your department's data. Revoke at any time; re-authorizing a revoked integration is one click.
  • See the API authentication guide for the integrator side and the two auth models' differences.

Billing and licensing

Billing tab. Chief and Billing Contact roles only.

Available:

  • Current tier and seat count.
  • Payment method management.
  • Billing history and invoice downloads.
  • Upgrade or downgrade tier.
  • Add or remove seats.
  • Cancel subscription.

Tier changes:

  • Downgrading disables (but does not delete) tier-gated data. Cloud archives remain; access is disabled until you re-upgrade.
  • Upgrades take effect immediately.
  • License Key is issued per department, not per device. All devices under the department activate against the same key.

Renewal:

  • Auto-renewal by default.
  • Renewal reminders at 30 days, 7 days, and 1 day before expiration.
  • Grace period: 30 days past expiration before Phase 5 cloud features degrade. Safety features continue to work at full authority regardless of license state (rule 6).

Audit log

Every admin console action is logged with:

  • Actor (user ID, role at time of action).
  • Action (specific operation).
  • Target (affected entity).
  • Before/after state for edits.
  • Timestamp, IP address, user agent.
  • Success/failure.

Retention: indefinite. Audit log is not subject to tier downgrade or license expiration deletion.

Access:

  • Chief and Admin can view the department's full audit log.
  • Lower-privilege admins see only their own actions.
  • Safe Signals support staff can access audit logs for support and investigation — these accesses are themselves logged (meta-audit).

Export:

  • CSV format (RFC 4180) for compliance audits, legal discovery, or import into external SIEM.

User management and 2FA

Personnel tab → Admins sub-tab.

Adding an admin:

  • Admins → Invite admin. Enter email and pick a role.
  • Invitation email includes a magic link and 2FA setup instructions.
  • Once accepted, the admin appears in the admin list with role and last-login timestamp.

Changing an admin's role:

  • Admins → admin detail → Change role. Chief can assign any role; Admin can assign roles below Admin.

Removing an admin:

  • Admins → admin detail → Revoke access.
  • Audit log records the action.
  • The admin's past actions remain in the audit log.

Chief succession:

  • Only Chief can promote another admin to Chief.
  • At least one Chief must always exist.
  • If the sole Chief loses account access, contact support@safesignals.io for the recovery ceremony (requires identity verification + payment-method confirmation).

2FA:

Firebase Auth email + password with optional TOTP is the Phase 5 baseline. Mandatory 2FA enforcement + backup-code generation + a chief-facing 2FA reset flow are Phase 5d follow-ups. In the meantime:

  • Sign in with the email + password Firebase Auth invitation from your welcome email.
  • Enable 2FA on your Google / Apple / Firebase account itself if your Firebase Auth provider supports it.
  • Lost account access: contact support@safesignals.io.

For SSO/SAML enterprise integration, Tier 3 customers can contact sales@safesignals.io — Phase 8+ feature landing per the ROADMAP.

Integration partners (API access)

Third-party systems — RMS vendors, dispatch platforms, LOSAP reporters, downstream cancer registries — read from + write to Muster via the public REST API at api.safesignals.io. Current schema: 1.3 (July 2026).

Access model — two-step onboarding:

  1. Safe Signals mints the integrator's License Key. The integrator (e.g., ESO Records Integration v1.2) gets one integration-scoped credential tied to their organization, not your department. Contact integrations@safesignals.io if you're an RMS vendor asking to be added; contact support@safesignals.io if you're a chief wondering whether your existing vendor is already registered.
  2. You authorize the integration for your department. Admin console → Integrations tab → Marketplace → find the integrator → Authorize. Grants read access to your department's incident data at the capabilities declared at registration time. Revoke at any time. Rule 25 preserved — each department decides which integrator sees their data.

What integrators can read:

  • Layer 1 reads via 8 endpoints — list incidents, project a single incident's state, download the signed archive or after-action PDF, get NERIS Core Schema projection, get LOSAP attribution, get per-unit GPS movement summary, list trust keys. Full reference: docs/api/reference.md.
  • Layer 2 writes (ingest external CAD/dispatch events) — by registered producer capability declaration.
  • Layer 3 subscription (WebSocket live event tail).

Dart SDK: muster_api_client on pub.dev (currently 0.2.0). Covers every Layer 1 endpoint plus Layer 2 ingest. Python + TypeScript + Go + Java clients generated from the same .proto files on customer demand. See docs/api/PUBLIC_API_CLIENT_SDKS.md.

On-demand after-action PDF. Integrators pulling /archive.pdf before the mobile side has finalized + uploaded the authoritative PDF get an on-demand rendering that includes the Section 9b unit-movement table (matches the mobile-authoritative PDF's layout so integrators see the same shape regardless of which path served the request). The on-demand PDF is honestly labeled as such in a footer; integrators can distinguish it from the authoritative mobile-signed PDF at the storage-path key.

Movement summary. Layer 1 GetIncident responses since schema 1.3 carry an optional movement_summary field — same row shape as GetIncidentUnitMovement — so integrators polling incident state don't need to chain a second call.

Rate limits + rejection handling: Documented per method in docs/api/reference.md. 429 responses carry Retry-After headers.

API changelog: docs/api/changelog.md. Every schema-version bump is documented; wire-format breaks require a v2 proto package + 12-month deprecation window per rule 19.