---
title: "Documentation and credentials"
description: "Keep each client's articles, assets, credentials, domains, licenses, and processes in the console, tied to the endpoints and people they describe."
url: "https://support.outpostplatform.com/documentation/"
product: "depot"
type: "concept"
status: "draft"
ai_summary: "Overview of the Documentation section of the Outpost console: articles with revisions and review dates, assets built from asset layouts, an encrypted credentials vault with audited reveal, domains and certificates with monitoring, vendors, licenses, processes, expirations, import from IT Glue, Hudu, or CSV, and export. Included on every plan. Permissions docs:* and vault:*."
availability:
  plans: ["home-lab", "essentials", "enterprise", "msp"]
  permission: "docs:read"
  preview: false
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/documentation/index.md"
license: "CC BY 4.0"
---

# Documentation and credentials

Documentation is where your team writes down what it knows about a client's
estate: the runbook for a backup, the firewall's admin password, the domain
that renews next month, the license count for the accounting software. Outpost
keeps it in the console beside the endpoints it describes, with credentials
encrypted and every reveal recorded. Documentation is included on every plan.
This page explains what the section holds, how access works, and where to go
for each task.

## What the section holds

The console lists everything under **Documentation** in the navigation rail.

| Item | What it holds |
| --- | --- |
| **Overview** | Counts of articles past review, records expiring within the first reminder or overdue, and credentials with a health finding, each a link to the matching list. Links to **Password health** with `vault:read`, and to the **Termination report** and **Still at risk** with `vault:manage`. See [Password health and at-risk reports](/documentation/password-health/). |
| **Articles** | Written documentation in Markdown, with revisions, review dates, and an option to show an article to end users in the Outpost tray app. See [Write documentation articles](/documentation/articles/). |
| **Assets** | Structured records, such as a firewall or a phone system, whose fields come from an asset layout. See [Assets and asset layouts](/documentation/assets/). |
| **Credentials** | The encrypted vault for passwords, keys, and other secrets. See [Credentials vault](/documentation/credentials-vault/). |
| **Domains and certificates** | Domains, their registration expiry, mail authentication records, and certificates. See [Monitor domains and certificates](/documentation/domains-and-certificates/). |
| **Vendors** | Suppliers, their contacts, and contract dates. |
| **Licenses** | Software licenses, seat counts, renewal dates, and the license key, which is stored as a credential. See [Vendors, licenses, and processes](/documentation/vendors-licenses-processes/). |
| **Processes** | Checklists, and each run of a checklist for a client. |
| **Expirations** | Everything with a date on it, soonest first. See [Track expirations](/documentation/expirations/). |
| **Settings** | Reminder lead times, reveal rules, sharing limits, and the outside checks. Shown to holders of `docs:manage`. |

On the MSP plan, the rail has two Documentation sections. At practice level,
**Documentation** holds what belongs to your practice rather than to one
client: practice articles, **Asset layouts**, the practice's own
**Credentials**, **My vault**, process templates under **Processes**,
**Expirations**, **Import**, **Export**, and **Settings**. Inside a client,
**Documentation** holds that client's records.

## Records are linked

A record can point at other records and at the things in your estate it
concerns: endpoints, network devices, device groups, sites, people, tickets,
projects, and other documentation. Links show on a record's **Relations** tab.
Outpost adds some links itself, such as when an article mentions a record.
Links Outpost matched by name alone are listed as **Suggested by name** and are
not saved until someone accepts them.

## Who can see what

Documentation and credentials have separate permissions, so a technician can
read articles without being able to see a single password.

| Permission | Allows |
| --- | --- |
| `docs:read` | Opening the Documentation section and reading articles, assets, domains, vendors, licenses, processes, and expirations |
| `docs:write` | Creating and changing those records, and starting process runs |
| `docs:manage` | Asset layouts, import, export, and **Settings** |
| `vault:read` | Seeing that credentials exist, with their names, usernames, web addresses, and health. Never the secret. |
| `vault:use` | Using a credential in a remote session or shell without seeing it |
| `vault:reveal` | Showing a secret, a one-time code, or a previous value |
| `vault:write` | Creating and changing credentials and collections, and checking credentials out and in |
| `vault:rotate` | Changing a credential's password, and asking Outpost to rotate a managed local administrator password now |
| `vault:manage` | Deleting collections, access tables, breaking another person's hold, and the departure reports |
| `vault:share` | Sending a credential as a one-time link |

The built-in roles hold these by default:

| Role | Documentation and credential permissions |
| --- | --- |
| **Owner** | All of them |
| **Support Manager** | `docs:read`, `docs:write`, `docs:manage`, and every `vault` permission |
| **Field Technician** | `docs:read`, `docs:write`, `vault:read`, `vault:use`, `vault:reveal`, `vault:write`, and `vault:share` |
| **Support Rep** | `docs:read` and `vault:read` |
| **Sales** and **Project manager** | `docs:read` |
| **Accounting** | None |

A collection of credentials, an article, or an asset can be restricted further
to named roles and people. A padlock in each list marks a restricted record.
See [Roles and permissions](/depot/roles-and-permissions/).

## What is encrypted

A credential's secret, its notes, its one-time code seed, and its previous
values are encrypted. So are **Hidden value** fields on assets, attachment file
names, and a vendor's named contact. Names, usernames, web addresses, dates,
and article text are stored readable so they can be searched and sorted. A
list, a search result, a report, or an export made without `vault:reveal`
never contains a secret.

## Alerts

Records with dates raise alerts in the `documentation` category as they come
due: domain and certificate expiry, license renewals, vendor contracts,
credential rotation dates, article reviews, and dated asset fields. A
credential found in a known breach raises a critical alert. See
[Track expirations](/documentation/expirations/).

## Remote Outpost

A Remote Outpost has no route to the internet, so domain monitoring and breach
checks do not run. Domains are still documented and their dates still come
due. The console says the checks are unavailable rather than reporting that
nothing was found. See [Remote Outpost](/remote-outpost/).

## Related

- [Credentials vault](/documentation/credentials-vault/)
- [Share a credential securely](/documentation/share-credentials/)
- [Import and export documentation](/documentation/import-and-export/)
- [Reports](/reports/)