Admin overview

The admin UI is a Blazor Server app mounted on the same process as the API, gated by the AdminPolicy authorization policy. It runs at /admin on the server origin and is intended for operators of a Pia Server instance — not end users.

The first user to sign in on a fresh install is bootstrapped as an administrator via the Setup flow; subsequent admins are promoted from the Accounts page.

Pages

Route	Purpose
/admin	Accounts — search users, change roles, deactivate/reactivate
/admin/devices	Registered E2EE devices and their status
/admin/groups	Groups and group-scoped policy / AI provider overrides
/admin/limits	Runtime policies — rate limits, quotas, identity policy, AI payload limits
/admin/audit	Filterable audit log of admin and security-relevant events
/admin/anomalies	Login anomalies (impossible-travel, brute-force patterns) needing review
/admin/license	Edition, expiry, seat counts, feature flags from the active license
/admin/license-events	Recent licence history (issue, refresh, expiry)
/admin/settings	AI provider catalog, encryption status, database provider
/admin/token-usage	Per-user AI token usage over the last 7 days
/admin/synced-items	Sync inventory across users (templates, providers, sessions, memory, todos)
/admin/plugins	Installed and available plugins
/admin/trusted-certificates	Custom CA certificates trusted for upstream calls

Where to start

Users Manage accounts, roles, and recovery.

Groups Group membership and per-group AI provider overrides.

Policies Rate limits, quotas, and identity policy — editable at runtime.

Audit log What's logged, how to filter, and how to read it.

Licensing Edition, seats, features, and the licence-issuing workflow.