Documentation and credentials

Documentation is where your team writes down what it knows about a client’s estate: the runbook for a backup, the firewall’s admin password, the domain that renews next month, the license count for the accounting software. Outpost keeps it in the console beside the endpoints it describes, with credentials encrypted and every reveal recorded. Documentation is included on every plan. This page explains what the section holds, how access works, and where to go for each task.

What the section holds

The console lists everything under Documentation in the navigation rail.

Item	What it holds
Overview	Counts of articles past review, records expiring within the first reminder or overdue, and credentials with a health finding, each a link to the matching list. Links to Password health with vault:read, and to the Termination report and Still at risk with vault:manage. See Password health and at-risk reports.
Articles	Written documentation in Markdown, with revisions, review dates, and an option to show an article to end users in the Outpost tray app. See Write documentation articles.
Assets	Structured records, such as a firewall or a phone system, whose fields come from an asset layout. See Assets and asset layouts.
Credentials	The encrypted vault for passwords, keys, and other secrets. See Credentials vault.
Domains and certificates	Domains, their registration expiry, mail authentication records, and certificates. See Monitor domains and certificates.
Vendors	Suppliers, their contacts, and contract dates.
Licenses	Software licenses, seat counts, renewal dates, and the license key, which is stored as a credential. See Vendors, licenses, and processes.
Processes	Checklists, and each run of a checklist for a client.
Expirations	Everything with a date on it, soonest first. See Track expirations.
Settings	Reminder lead times, reveal rules, sharing limits, and the outside checks. Shown to holders of docs:manage.

On the MSP plan, the rail has two Documentation sections. At practice level, Documentation holds what belongs to your practice rather than to one client: practice articles, Asset layouts, the practice’s own Credentials, My vault, process templates under Processes, Expirations, Import, Export, and Settings. Inside a client, Documentation holds that client’s records.

Records are linked

A record can point at other records and at the things in your estate it concerns: endpoints, network devices, device groups, sites, people, tickets, projects, and other documentation. Links show on a record’s Relations tab. Outpost adds some links itself, such as when an article mentions a record. Links Outpost matched by name alone are listed as Suggested by name and are not saved until someone accepts them.

Who can see what

Documentation and credentials have separate permissions, so a technician can read articles without being able to see a single password.

Permission	Allows
docs:read	Opening the Documentation section and reading articles, assets, domains, vendors, licenses, processes, and expirations
docs:write	Creating and changing those records, and starting process runs
docs:manage	Asset layouts, import, export, and Settings
vault:read	Seeing that credentials exist, with their names, usernames, web addresses, and health. Never the secret.
vault:use	Using a credential in a remote session or shell without seeing it
vault:reveal	Showing a secret, a one-time code, or a previous value
vault:write	Creating and changing credentials and collections, and checking credentials out and in
vault:rotate	Changing a credential’s password, and asking Outpost to rotate a managed local administrator password now
vault:manage	Deleting collections, access tables, breaking another person’s hold, and the departure reports
vault:share	Sending a credential as a one-time link

The built-in roles hold these by default:

Role	Documentation and credential permissions
Owner	All of them
Support Manager	docs:read, docs:write, docs:manage, and every vault permission
Field Technician	docs:read, docs:write, vault:read, vault:use, vault:reveal, vault:write, and vault:share
Support Rep	docs:read and vault:read
Sales and Project manager	docs:read
Accounting	None

A collection of credentials, an article, or an asset can be restricted further to named roles and people. A padlock in each list marks a restricted record. See Roles and permissions.

What is encrypted

A credential’s secret, its notes, its one-time code seed, and its previous values are encrypted. So are Hidden value fields on assets, attachment file names, and a vendor’s named contact. Names, usernames, web addresses, dates, and article text are stored readable so they can be searched and sorted. A list, a search result, a report, or an export made without vault:reveal never contains a secret.

Alerts

Records with dates raise alerts in the documentation category as they come due: domain and certificate expiry, license renewals, vendor contracts, credential rotation dates, article reviews, and dated asset fields. A credential found in a known breach raises a critical alert. See Track expirations.

Remote Outpost

A Remote Outpost has no route to the internet, so domain monitoring and breach checks do not run. Domains are still documented and their dates still come due. The console says the checks are unavailable rather than reporting that nothing was found. See Remote Outpost.

Related

• Credentials vault
• Share a credential securely
• Import and export documentation
• Reports