SmartWaves Admin

Overview

Manage branches, plans, vouchers, payments, PPPoE & routers

DEMO TENANT: default

🔎

Network Snapshot

Live backend metrics, refreshed every 30 seconds

Router observations: awaiting live check

Authenticated Hotspot Sessions

—

Router-by-router session counts not checked yet.

PPPoE Online

—

Stable

MPESA Payments (Today)

—

3 pending

Branches / Routers

—

Grouped by site

Network Observability

Bounded SNMP metric and NetFlow/IPFIX summary ingestion. Topology is shown only from observed links.

Collectors

Enabled tenant collectors

Reporting

Seen in the last 15 minutes

Metrics

Recent bounded samples

Flow Summaries

Recent aggregated windows

Collector name

Collector type

Collector tokens are returned once and stored only as keyed digests.

Collectors

Inactive credentials are rejected.

Name	Type	Token prefix	Last seen	Status
No collectors loaded.

Observed Topology

Configured nodes are distinct from collector-observed links.

No topology loaded.

Source	Target	Type / Interface	Status	Latency / Loss	Observed
No observed links.

Latest Metrics

Interface and device measurements, not inferred health.

Sampled	Node	Interface	Metric	Value
No metric samples.

Latest Flow Summaries

Aggregated prefixes only; raw unbounded flows are not stored.

Window	Router / Interface	Source	Destination	Protocol	Traffic
No flow summaries.

Verified Session Usage

Verified RADIUS session-lifetime counters grouped by session start date; not precise daily traffic.

0 B

Payment Trend

Successful collections grouped by selected period

Live Subscriber Mix

Waiting for the first sample

Live Operations Trend

Rolling samples from live overview polling, not simulated values in API mode

0 samples

Recent Payments

Recent tenant payment activity

Pending: 3

Time	Phone	Plan	Amount	Status

Quick Tools

Common actions

In API mode, branches/routers/plans are stored in DB. Vouchers/payments wiring comes next.

Voucher Devices

—

Search MAC / IP

Status

Online

Voucher FUP

Use plan default unless overridden

Override

Threshold MB

Action

Status

Throttle Down Kbps

Throttle Up Kbps

MAC	IP	First Seen	Last Seen	Status

Block prevents future redeems for this MAC on this voucher. Delete removes the device and frees a slot.

—

Branches / Sites

Status

Branch	Code	Location	Branch	Support	Routers	Status

Best practice: Create all branches first, then register routers under each branch.

Plans

Manage hotspot + PPPoE packages (API-wired)

Type

Status

Name	Type	Portal Scope	Price	Validity	Speed	Status	Actions

Hotspot portals fetch active plans dynamically and apply their configured branch scope.

Vouchers

Generate, export, and track voucher usage

Generated inventory

—

All retained voucher records

Available

—

Not yet activated

Used

—

Access activations retained

Needs accounting

—

Used without sale classification

Recorded sales

—

Sold vouchers only

Recorded revenue

—

Linked or manually recorded sales

Voucher use proves that network access started; it does not prove that money was received. Revenue below includes only linked payments or sales explicitly recorded by an operator. Complimentary access remains visible with zero revenue.

Search voucher history

History branch

A branch view also includes tenant-global vouchers valid there.

Generate voucher inventory

Generation scope

Global vouchers show in every branch. Pick a branch to generate branch-only vouchers.

Batch Name

Optional label for this bulk generation.

Quantity

Plan

Only Hotspot plans should be used for vouchers.

Creates the selected plan and quantity.

Code	Scope	Plan / Batch	Access	Accounting	Value	Created	Activated	Expires	Payment / Reference	Actions

TV / Decoder Access

Paid, exact-MAC entitlements for browserless devices — separate from phone vouchers and PPPoE.

Prepaid TV vouchers — generate, record sale, track redemption

TV codes are separate from normal guest vouchers. Collect payment before recording a sale. Generated codes are shown only once; save or print them securely.

TV router *

Time package *

Quantity (max 50)

Batch name (optional)

Open this section to load TV voucher inventory.

Inventory status

Search TV voucher history

ID	Branch / router	Plan	Status	Payment ID	Redeemed TV	Action

Load the inventory to see TV and decoder entitlements.

TV connection: not checked. Detected means RouterOS has seen a MAC, not proof of a live Wi-Fi association. A HotSpot active session is not an Internet speed test.

Network origin: select a registered TV and press Network origin. Router evidence does not prove device ownership or authorize sales.

Branch

TV Router

Status

TV / Decoder	MAC identity	Branch / Router	Package	Buyer	Access until	Package status	TV connection	Actions
No TV/decoder entitlement inventory loaded.

A TV entitlement is never a phone voucher. Its MAC is a single-device RADIUS identity; replacement is handled by revoking the old device, then creating a new paid entitlement.

Router readiness & guarded publishing

The customer-facing “Buy for a TV” button can use either an isolated TV network or a guarded shared-SSID fallback for simple transparent access points.

Prefer the isolated TV SSID/VLAN. Where a transparent TP-Link/Tenda access point cannot tag VLANs, the separately gated one-SSID fallback keeps phone captive login and paid-TV MAC access on the normal HotSpot. Use it only after testing original client-MAC visibility, AP client isolation, unknown-device denial, phone portal fallback, expiry and revocation. Publish portal flag separately pushes the accepted mode to that exact router.

Branch / Router	TV access network	RADIUS / profile	NAS scope	Eligible plans	Portal offer	Guidance	Actions
No router readiness data loaded.

Payments

Tenant M-Pesa transactions

Status

From

MPESA Receipt / Ref

Time	Type	Phone	MPESA Receipt	Access / Voucher	Checkout ID	Plan	Amount	Status

Subscriber Services

One lifecycle and billing view for PPPoE, DHCP/IPoE, and Static IP

Access Type

Branch

Service	Customer	Access Identity	Plan / Site	Billing	Authorization	Connection	Provisioning	Actions

Access Networks

Tenant-scoped CIDR, gateway, DHCP server, and Router/NAS context

Name	Branch / Router	Network	Purpose	DHCP Server / Pool	Mode	Status

Register only networks actually present or intentionally managed on the selected router. Public networks must represent address space routed to that tenant.

PPPoE Subscribers

Existing accounts, expiry, and renewals. New subscribers use Subscriber Services.

Status

Account	Plan	Phone	Router MAC	Expiry	Online	Status

Corporate Accounts

Company billing groups, linked PPPoE users, shared renewal

Company Name

Contact Person

Billing Phone

Corporate Plan

Company	Plan	Accounts	Usage	Expiry	Status	Actions

Usage Analytics

Tenant-wide usage by default; filter an individual voucher, MAC, or PPPoE user when needed

Service

Range

User / Voucher / MAC

Alert Threshold (MB)

Verified Session Usage

—

Selected range

Hotspot Session Usage

—

Identified Hotspot RADIUS records

PPPoE Session Usage

—

Registered PPPoE accounts only

Loading accounting evidence...

Service	User	Download	Upload	Total	Sessions	Last Seen

PPPoE Requests

New connection requests from the portal

Status

Name	Phone	Location	Plan	Status	Requested	Expires

Usage Analytics

Network-wide usage, heavy-user alerts, CSV export, and FUP checks

Loading usage analytics...

Reports

Payments plus truthful client, service, and Hotspot-session activity

From date

To date (inclusive)

Choose From date and To date, then Apply dates to both recorded payments and historical Client Activity. Both dates are inclusive in the Nairobi calendar (maximum 366 days). Select a preset period to clear the custom range. Current registered customer/branch counts remain a present-time snapshot, not historical customer totals.

Open this page or click Refresh to load live report data. Zero is shown only after a successful query.

Recorded Successful Payments

Today

Summary

Successful and pending records; not all payments are necessarily M-Pesa

Total Success

Pending Count

Registered Customer Breakdown

Current customer records, independently counted by service and branch. Not online users.

Total Customers

—

Current registered records

HotSpot Customers

—

Customer type: hotspot

PPPoE Customers

—

Customer type: pppoe

Active Customer Records

—

Database status, not connected devices

Inactive Customers

—

Customer record is inactive

Registered PPPoE Accounts

—

Distinct from customer records

Registered TV Devices

—

Entitlements, including revoked

Active TV Entitlements

—

Unexpired grants, not proof of Internet

Loading selected branch and service counts...

Branch	Total	HotSpot	PPPoE	Other	Active	Inactive
No customer breakdown loaded.

Client Activity

Period events are historical. Enabled/active flags reflect stored records, not real-time router connectivity.

Group by

Branch

Load a period to see acquisition and session activity.

New Customers

—

Records created in period

New PPPoE

—

Accounts created in period

Hotspot Starts

—

Trusted session starts

Hotspot Devices

—

Distinct devices in period

Enabled customer records

—

Enabled PPPoE account records

—

HotSpot session records marked active

—

Period	New customers	New PPPoE	Hotspot starts	Unique devices
No client activity report loaded.

Date	Total	Count

Infrastructure Registry

Tenant-scoped asset custody, stock movements, and dual-stack address allocation with durable history.

Future equipment is supported in the inventory catalog: OLTs, ONUs/ONTs, distribution switches, fiber infrastructure, APs, PPPoE customer routers/CPEs, UPS and power equipment can be registered as categories, assigned an asset tag and tracked by location. Registering inventory does not enable OLT/ONU provisioning or confirm device health. Vendor-specific management (SNMP, OMCI/OLT adapter, TR-069/GenieACS) requires separate tested integration.

Serialized Assets

Tracked by tag, serial, or MAC

Low Stock

At or below reorder level

IP Prefixes

IPv4 and IPv6 authority

Active Allocations

Reserved or assigned addresses

Locations

Warehouses, offices, vehicles, sites, and technician custody.

Code

Name

Type

Branch ID (optional)

Code	Location	Type	Branch	Status
No locations loaded.

Item Catalog

Serialized equipment and count-based consumables use separate ledgers.

SKU

Name

SKU	Name	Category	Tracking	Reorder
No items loaded.

Tag	Item	Serial / MAC	Status	Location	Assignment
No assets loaded.

SKU	Item	Location	On hand	Reorder	State
No stock balances loaded.

Name	CIDR / VRF	Gateway	Family	Utilization	Status
No prefixes loaded.

Address	Prefix	Owner	Hostname / MAC	Status
No allocations loaded.

Time	Kind	Description	Debit	Credit	Status
No statement loaded.

Received	Phone	Amount	Receipt	Match charge ID
No unmatched payments loaded.

Key	Name	Status
No templates loaded.

Router	Observed status	Latency	Sampled
No routers loaded.

Router	WAN ping	RADIUS ping	HotSpot sessions	PPPoE sessions	Recovery observation	Sampled
No recovery observations loaded.

Ticket	Customer	Issue	Status / SLA	Due	Assign admin ID	Internal note
No tickets loaded.

Category

Vendor / payee

Amount

Currency

Occurred on

Branch ID (optional)

Notes / receipt reference

No expenses loaded.

Date	Category	Vendor	Amount	Branch	Reference
No expenses loaded.

Leads / Prospects

Track prospects separately; conversion is explicit and creates a normal tenant customer only after confirmation.

Name

Phone

Location

Desired service

Plan ID (optional)

Source

Follow-up

Assigned admin ID

Status

Notes

No leads loaded.

Lead	Service	Status	Follow-up	Action
No leads loaded.

Invoice Aging / Receivables

Derived from billing_charges, the authoritative ledger. “Not observed” network state is never treated as paid or online.

Status

Branch ID (optional)

No receivables loaded.

Account	Customer	Due	Outstanding	Aging	Status
No receivables loaded.

Credit Notes, Refunds & Accounting

Approval-controlled ledger adjustments and an immutable accounting synchronization outbox.

Type

Charge ID

Payment ID (refund)

Amount

Reason

Number	Type	Account	Amount	Status	Actions

Accounting outbox not loaded.

Created	Event	Status	Attempts	Provider reference	Action
No accounting events loaded.

Routers / Sites

Routers are registered under branches for monitoring and sync

Branch

Branch	Router	Host	Status	Hotspot

AP capabilities are entered per installation; they are not auto-detected by MikroTik. An inventory profile never enables TV payments or changes RouterOS.

Access points

Basic shared Wi-Fi or tagged Guest/TV VLANs. Configuration is staged only.

Choose a router to manage AP profiles.

Station APs & PPPoE Customer Routers

Read-only monitoring for the selected MikroTik; uplink status is not proof of AP Wi-Fi health.

Choose a router and click Check devices. No RouterOS configuration will change.

Station access points (registered inventory)

Station / AP	Router connection	SSID	Observation
Not checked.

PPPoE customer routers (subscriber sessions)

Customer / Username	Account	Session observation	Last recorded connection
Not checked.

A PPPoE session confirms authentication, not customer Wi-Fi quality. A basic AP without its own management telemetry can only have its router-facing uplink checked.

Registration: manually save each AP's verified station name, MikroTik port, SSID and optional management IP below. Discover MikroTik ports to get candidates, then confirm the correct AP; port discovery does not auto-register a physical AP. Existing PPPoE customers appear after their subscriber service/account is assigned to this router. Session checks update on Check devices; they do not register unknown CPEs automatically.

Discover & Review Unregistered Devices

Router-observed endpoints and PPPoE logins. Device type is unknown until checked physically.

Not scanned. Scans are manual and read-only; no hardware or customer is automatically registered.

LAN / Ethernet observations — unclassified endpoints

Observed MAC / IP	MikroTik port	Evidence	Review
Scan not run.

An observed MAC can belong to a phone, TV, AP, ONU, switch or CPE. Several MACs on one uplink do not identify which device is the AP. Confirm the AP label, physical uplink and SSID before approving the existing registration form.

Observed PPPoE usernames

PPPoE username	Assigned session IP	Registration match	Action
Scan not run.

A matching PPPoE subscriber already assigned to this router appears automatically in the monitoring panel. Unknown logins must be reviewed in Subscriber Services; discovery never creates subscriptions, RADIUS credentials or payments. For OLTs/ONUs and switches, use Infrastructure Registry until vendor telemetry is integrated.

MikroTik physical port inventory (read-only)

Discovery reads MikroTik only. It cannot prove a connected AP supports VLANs.

Global isolation not checked. An AP's brand or saved inventory does not prove isolation.

MikroTik Ethernet Port Roles — Planning Only

Choose what each Ethernet port should serve. Saving creates an Admin inventory plan, NOT a live RouterOS change. Free Internet is modeled on ether2: its own DHCP and gateway, without HotSpot, with firewall and paid-network isolation checks. An unmanaged plug-and-play switch can fan out to several basic APs, but it cannot enforce switch-port isolation.

MikroTik Ethernet interface

Planned service

Connected equipment

Tagged VLAN IDs (VLAN trunk / Free LAN + VLAN)

Notes / switch name

No port role has been applied to a live device.

Ethernet	Service	Downstream	VLANs	Status	Actions
Select a router to load plans.

Select a planned port and click Preview configuration. No RouterOS changes will be made.

AP name

AP network capability

MikroTik uplink interface

AP management IPv4 (unique)

Physical AP attachment

Guest SSID

Inventory active Save = staged inventory only. Review rollout before touching RouterOS.

AP	Router uplink	Mode	SSID mapping	Status	Actions
Select a router.

A saved profile is not physical acceptance. TV access remains off until the exact AP, tagged/untagged mapping, client isolation, unpaid-MAC denial, and payment expiry have been tested. Routers with multiple AP modes require separate trusted portal contexts and per-network authorization before activation.

Customers

Customer profiles, reporting categories, and plan defaults

Name	Phone	Category	Default plan	Status

Settings

Branding, MPESA, Router API, roles

Not connected

Branding

Portal name, support contacts

ISP Name

Support Phone

Support Email

Website

Currency

Used for tenant billing display, plans, reports, invoices and SMS variables.

Currency Symbol

Timezone

Country Code

Business Address

Demo Password

Leave blank to keep current password. Demo mode will reject other passwords.

Admin Idle Timeout (minutes)

Automatic inactivity logout. Allowed range: 5–120 minutes. Default: 15.

Admin Absolute Session Lifetime (hours)

Maximum lifetime even while active. Allowed range: 8–12 hours. Default: 12.

Free PPPoE Child Accounts

Global default. 0 means every child account requires an add-on or separate billing unless package/account overrides it.

Welcome SMS

Welcome SMS Trigger

Welcome SMS Template

Variables: {{full_name}}, {{first_name}}, {{account_username}}, {{package_name}}, {{package_price}}, {{installation_fee}}, {{initial_total}}, {{expiry_date}}, {{support_phone}}, {{support_email}}, {{website}}, {{currency}}

Saved to backend in API mode.

Hotspot Portal Defaults

Set branch defaults, then push `hotspot/config.js` to a branch router

Default Branch Lock

Plan Scope

Only one mode is active at a time, based on Default Branch Lock.

Branch only (hide global plans) Global mode: include branch plans

Portal API Base (for router file)

Target Router

Hotspot Branch Debug Toggle Allow hidden branch picker (Ctrl + Alt + B)

Save updates backend defaults for this tenant. Push writes `hotspot/config.js` to the selected router (branch-safe check enforced).

Portal Announcements

Show promos or notices on the hotspot page only when active.

Type

Branch Scope

Priority

Title

Message

Photo URL (optional)

You can paste an image URL or upload a photo from this device.

Upload Photo (optional)

Photo Preview

Button Text (optional)

Button URL (optional)

Start Time (optional)

End Time (optional)

Status Active

Once the hotspot page has this new code, announcements are pulled from backend automatically. You do not need to push text edits to the router each time.

Status Filter

Image Filter

Sort

Title	Scope	Type	Window	Status	Priority	Action

Account 2FA

TOTP protection for the current owner/admin account

Not loaded

This is available only to owner/admin accounts.

Current Password

Authenticator Code

Start setup to generate a TOTP secret, add it to your authenticator app, then enter the 6-digit code to enable login protection for this account.

Integrations

MPESA + MikroTik RouterOS API

Payment Provider

Provider Config (JSON, optional)

Run network probe

MPESA Shortcode

MPESA Consumer Key

MPESA Consumer Secret

MPESA Passkey

Callback URL

MPESA Environment

In API mode these are stored in DB and used by backend services. For custom providers, supply Daraja-compatible endpoint URLs in Provider Config JSON.

SMS Provider

Default is Africa’s Talking, but you can switch providers.

Provider

Environment

Username

API Key

Sender ID (optional)

Custom Provider Configuration (JSON)

Stored separately for this tenant. Supports custom URLs, headers, JSON/form bodies, field names, and response paths.

Leave blank to disable SMS. For Africa's Talking sandbox, environment should be sandbox and username can stay sandbox.

Hotspot Voucher Receipt SMS

After a confirmed payment, send the buyer their voucher and clear portal instructions. Delivery history redacts the voucher code.

Receipt delivery

SMS template key (optional)

Portal URL in instructions (optional)

If no active template matches, SmartWaves uses a safe default: plan details, voucher, and “use the voucher as both username and password.” Failed deliveries may be retried explicitly from delivery logs; automatic retries are avoided to prevent duplicate credentials.

KRA eTIMS

Optional electronic tax invoicing through certified OSCU integration.

eTIMS

Integration Mode

OSCU Configuration (JSON)

Use the official OSCU fields: environment, pin, branch_id, device_serial, cmc_key, item_code, item_class_code, and taxation values. The communication key is returned only during successful device initialization.

SMS Center

Send one-off messages, queue bulk campaigns, and review message history.

Manual SMS

Recipient Phone

Message

Bulk SMS Campaigns

Build an audience from PPPoE and hotspot data, preview recipients, then queue a campaign without affecting manual SMS.

Audience

Branch Filter

Campaign Title (optional)

Campaign Message

Choose an audience, then click Preview Audience to see how many recipients will be reached.

Sent Messages & Delivery Reports

Every manual, voucher, customer, invoice, and bulk SMS is recorded here. Provider delivery callbacks update the final handset status.

Campaign Status

Audience Type

Time	Audience	Status	Recipients	By	Message	Actions

Status Filter

Kind

Time	Phone	Kind	Status	Provider	Cost	By	Message

Email & WhatsApp

Consent-aware provider templates with truthful delivery state. Providers remain fail-closed until configured.

Provider status not loaded.

Channel

Template key

Template name

Approved WhatsApp template

Email subject

Text body

HTML body (email only)

Destination

Variables (JSON)

WhatsApp consent

Scheduled Campaign

Recipient payloads are rendered once, consent-filtered, throttled per channel, and delivered by the durable worker.

Campaign name

Active template

Deliver at

Recipients (JSON)

Duplicate destinations must use identical variables. Email opt-outs and WhatsApp recipients without explicit opt-in are suppressed.

Campaign	Channel	Schedule	Status	Recipients	Outcome
No campaigns loaded.

Time	Channel	Destination	Status	Attempts	Provider	Detail / Action

Multi-Tenant Hosting

Create separate databases per business (subdomain routing)

Tenant Override (super-admin)

Current DB Status

Not checked

Tenant Key (subdomain)

Used in URL/subdomain and tenant routing. Use lowercase letters, numbers, and hyphen only.

Tenant Name

Display/business name shown in admin tenant list.

Tenant DB URL (optional)

If blank, backend uses TENANT_DB_URL_TEMPLATE. Fill this when a tenant uses a custom DB.

Owner Email (optional)

Initial login email for that tenant owner.

Owner Full Name (optional)

Profile name saved for the first owner account.

Owner Password (optional)

Required if Owner Email is set (minimum 6 characters).

Owner Phone (optional)

Tenant contact/support number shown in tenant list and seeded settings.

Create DB if missing Run migrations

Subdomain format: tenant.yourdomain.com. If DB URL is blank, the backend uses the template from .env. If owner email + password are provided, the tenant is ready to log in immediately (no bootstrap needed).

Tenants

Key	Name	Phone	DB URL	Status	Actions
No tenants loaded.

Platform / Tenant Licensing

Global Owner workflow for SaaS pricing plans, tenant license assignment, renewal state, and platform collections.

Plan Name

Base Price

Included Customers

Additional Customer Price

Cycle

Currency

Grace Days

Features / Modules

Default formula: KES 1,500/month includes 100 billable service seats, then KES 15 for each additional seat. You can record a separate contract for one tenant without changing the shared plan used by others.

Tenant

Pricing Plan

Billable count

Status

Pricing mode

Contract name (optional)

Custom base price

Custom included clients

Custom extra/client

Custom cycle

Custom currency

Custom grace days

Tenant options are resolved from the platform registry. Database URLs are intentionally never entered or displayed here.

Global Owner — Tenant Reports & Monthly Rent Review

Read-only cross-tenant report from registered tenant databases. Dates filter recorded payments. Customer totals and SaaS rent amounts are separate current/last-calculated snapshots; automatic invoices, account locking and service disconnections are not enabled.

From date

To date (inclusive)

Select dates or leave both blank for the current Nairobi calendar month. Reports are isolated by tenant database.

Tenant	Payments in period	Current customers / PPPoE	Rent last calculated	License / Renewal	Data
Load the Global Owner tenant portfolio report.

Monthly Rent & Grace — Shadow Calculator

Fresh tenant counts and contract pricing, preview only

No automatic invoices, M-Pesa charges, account suspension or network disconnections will result from this calculation.

Tenant	Fresh billable count	Rent quote	Due / grace	Would restrict Admin?	Quote availability
Click Calculate rent to preview existing tenant contracts.

Commercial Activation Readiness

Owner-only check of approved tenant setup and payment safety, without charging anyone

No commercial activation check loaded. Billing and overdue restrictions remain disabled.

Tenant	Plan / Contract	Billable clients	Preview readiness	Outstanding setup
Select Check readiness.

Platform Rent Invoices & Settlement

Invoice records and owner-certified payment evidence; subscriber payments are separate

Tenant key

Approved rent due date (Nairobi local)

Rent invoice issuance, settlement, and Admin restriction require separate Global Owner activation.

Invoice / Tenant	Period / Due	Frozen count	Amount	Verified / Balance	State
Select Refresh invoices.

Invoice ID

Externally verified amount

Payment reference

Verification evidence

Original payment reference

Unique reversal reference

Reversal evidence

Plan	Base	Included	Extra	Cycle	Features
No pricing plans loaded.

Tenant	Plan	Usage	Breakdown	Renewal	Status	Actions
No tenant licenses loaded.

License / Billing

Tenant-owner view of your SmartWaves platform subscription.

No license loaded.

Tenant rent preview not loaded. Real account enforcement and customer disconnections are disabled.

Current Plan

—

Billable Customers

—

Renewal Total

—

Your Rent Invoices

Official issued invoices and certified payment balances

Your invoices have not been loaded. Unconfirmed M-Pesa messages do not settle invoices.

Invoice	Due / Grace	Rent	Paid	Outstanding	Status
Refresh to view invoices.

Pay Platform Rent by M-Pesa

Dedicated platform merchant only. STK acceptance is not proof of payment.

Issued rent invoice ID

M-Pesa phone

The platform-rent STK payment method is not enabled. Manual payment may be certified by the Global Owner after external verification.

Legacy Platform Renewal Phone (not invoice settlement)

Tenant DB Diagnostics

Shows stored DB URLs, runtime-normalized URLs, and live connection health.

Load diagnostics to inspect registry alignment and tenant DB reachability.

Tenant	Stored DB URL	Runtime DB URL	Registry	Connection	Database	Error
No diagnostics loaded.

Ops Health & Alerts

Background worker heartbeat, database health, backups, and alert state.

No health snapshot loaded.

Check	Status	Detail
No health checks loaded.

Alerts

Check	Status	Detail
No alerts loaded.

Network Operations Center (NOC)

Router reachability, latency, CPU, memory, RouterOS inventory, interface health, and configuration drift.

No router health snapshot loaded.

Router	Status	Latency	CPU / Memory	RouterOS / Board	Interfaces	Sampled	Actions
Click Refresh NOC to load routers.

Downstream Network Equipment & Switch Port Map

One source of truth: Infrastructure Registry router-assigned assets + saved Access Point switch-port attachments. A registered switch is NOT automatically online. Its port links are operator records, not SNMP or LLDP observations.

Click Refresh NOC to load equipment linked to your MikroTik routers.

Serving MikroTik	Registered equipment	Router uplink evidence	Downstream switch ports	Monitoring	Inventory
Downstream inventory not loaded.

Unmatched switch identifiers will appear here for reconciliation with asset tags.

Future Hardware Management — Capability & Enrollment

SNMPv3 device uptime and interface monitoring use the existing external telemetry collector when hardware is enrolled. LLDP requires a supported collector adapter. PoE, VLAN and OLT/ONU write controls have no enabled executor until hardware-specific staging, backup, approval and rollback testing.

Refresh NOC to check registered hardware and existing collector observations. No hardware is polled by this page.

Hardware / asset	SNMPv3 uptime & port metrics	LLDP	PoE/VLAN	OLT/ONU / CPE controls
Hardware capabilities not loaded.

Safe change-plan preview

Validation only. No device command is generated or executed.

Registered network asset

Operation template

Verified switch port (PoE/VLAN)

VLAN ID (where applicable)

Select a registered, router-assigned device after loading hardware readiness.

ACS / CPE Inventory

Tenant-tagged GenieACS inventory and real NBI task execution. Disabled or unreachable providers remain fail-closed.

Not checked

Serial Number

MAC Address

Manufacturer

Model

Firmware

Remote actions require a protected GenieACS NBI. Factory reset asks for a strong confirmation phrase and requires network manage permission.

Device	Identity	Status	Firmware	Last Seen	Actions
No ACS devices loaded.

Provider task evidence

Pending tasks are polled from GenieACS. A task disappearing from its pending queue is shown as outcome unknown until the device result is independently verified.

Time	Device	Action	Local state	Provider state	Evidence
No ACS actions loaded.

RADIUS Reconcile

Dry-run compares PPPoE desired state with radcheck/radreply before optional apply.

No reconcile run yet.

Type	Username	Current	Desired
Run dry-run first.

Admin Notifications

Persistent alerts from expiry automation, support tickets, licensing, and system events.

Time	Level	Category	Title	Message	Related
No notifications loaded.

Support Tickets

Customer portal requests and service issues.

Time	Branch	Customer	Phone	Subject	Status	Priority
No support tickets loaded.

Automated Backups

Compressed logical backups across tenants plus quick manual runs and safe temp restores for DB backups.

No backup list loaded.

Time	Type	Tenant	Database	Trigger	Items	Rows/Files	Size	Status	Action
No backups loaded.

Recovery Access

Owner-only token for emergency password reset

Recovery Token

Keep this token private. Use it only if you are locked out. Global-owner emergency recovery also requires the separate break-glass code configured on the backend.

Audit Logs

Recent admin actions

Time	Action	Details	IP

Branch MPESA Overrides

Optional per-branch credentials (overrides global)

Branch

MPESA Shortcode

Consumer Key

Consumer Secret

Passkey

Callback URL

Payment Provider

Provider Config (JSON, optional)

Environment

Leave fields blank to use global credentials, provider, and provider config. This lets one branch use Daraja while another uses KCB or Equity.

Users & Roles

Create human-friendly roles, select module permissions, then assign them to admin users.

Role Name

Description

Tenant owners can create tenant roles only. Global/platform permissions are visible only to the Global Owner.

Role	Description	Permissions	Users	System	Actions
No roles loaded.

Admin Users

Create and manage additional admin accounts

Full Name

Password

Role

Status

Create a new admin user. Password is required for new users.

Email	Name	Role	2FA	Status

Track admin login attempts

Time	Email	IP	Status

Credits: Axoryn Labs

Axoryn Labs