Skip to content
NovaVMS Manual

Request help from Novalien platform support

When an issue is genuinely cross-org, or when diagnostic data only Novalien can see is needed, you open a platform-support ticket. A Novalien platform admin then mints a 30-minute scoped impersonation token and joins your org with role: admin — never owner. Every action they take is audited on both sides. Per D80, platform admins never hold standing access, so you authorise each incident individually.

When to request platform help

  • A change you made on the Admin pages did not stick, and the audit log shows no error entry.
  • A cross-org issue — for example, multiple tenants on the same cloud region all report the same failure at the same time.
  • A bug that only reproduces with a scoped view Novalien holds (infrastructure logs, billing events, deep diagnostic traces).
  • You cannot log in as Owner and the self-service reset also fails.

Before you request, check:

  1. Is this solvable in-org? Many symptoms — camera offline, events missing, alerts firing wrong — have in-org troubleshooting paths. Skim Troubleshooting first.
  2. Is your Owner available? Some operations (transfer ownership, delete org, billing) are Owner-only by design (D79). Platform support cannot do these for you — the scoped impersonation token is issued with role: admin, not owner (US-PLAT-13).
  3. Is “Allow NovaVMS Support Access” on? Check Owner → Danger Zone. If the Owner has toggled it off, platform support cannot impersonate even after you request — they will email you to ask for it to be re-enabled.

Prerequisites

  • Admin or Owner role in your org.
  • Your org ID (visible on Admin → Organisation, or in the URL of any admin page).
  • A concise description of the symptom and the steps to reproduce.

Step 1 — Collect evidence before you write

Platform admins resolve tickets faster when they have evidence up front. Collect:

  • Org ID — from Admin → Organisation.
  • Affected user(s) — email or user ID, not display name.
  • Affected camera or gateway — ID from the URL of that resource’s detail page.
  • Timeframe — start and end timestamps in UTC. “This morning” does not survive a handover.
  • What you tried — the in-org troubleshooting path you already walked.
  • Audit log snippet — if the action in question has an audit entry, include the entry ID or export a filtered CSV. See Export the audit log.

Step 2 — Open the ticket

  1. Email [email protected] with the subject [<org_id>] <one-line symptom>.
  2. Paste the evidence checklist from Step 1 into the body. One field per line.
  3. Attach screenshots or exports only where they add evidence — do not attach clips or recordings unless platform support asks.

Step 3 — Authorise the scoped session

  1. When the platform admin starts work, NovaVMS logs platform.impersonation_started with the platform admin’s name, the reason they typed in, and a session ID. The entry appears in your Admin → Audit Log within seconds.
  2. The session lasts up to 30 minutes. It cannot be refreshed — if the work takes longer, the platform admin ends the session and mints a new one with a new reason. You see both entries.
  3. Every action they take during the session writes an audit entry with actor_type: platform_admin_impersonating and the same session ID, so you can trace the full timeline.

Verify

  • The ticket receives an acknowledgement from Novalien within the support SLO.
  • Once resolved, the audit log shows platform.impersonation_ended matching the earlier start entry. If it does not, the session timed out after 30 minutes instead of an explicit end; both are fine.
  • Whatever the platform admin changed is visible in the audit log under their session ID. You can verify each change one by one.

What platform support can do

  • Read your org’s cameras, events, alerts, gateways, users, and audit log.
  • Change operator-tier configuration — alert rules, prompt packs, camera settings — to resolve the ticket.
  • Change admin-tier governance — user roles (except Owner), site access grants, LLM model — when the ticket calls for it.
  • Mint a new scoped token for the same org later if you open a follow-up ticket.

What platform support cannot do

  • Transfer ownership, delete your org, change billing. Owner-only operations require a real Owner (D79, D80, US-PLAT-13).
  • Hold standing access. Every session is 30 minutes, reason-tagged, and revocable.
  • See passwords, reset tokens, or any cryptographic secret — these are hashed or redacted in the same database the platform admin queries.
  • Escape your org boundary during the session. The scoped token is locked to your org_id (US-PLAT-14).

Common variations

  • Revoke in the middle of a session: open Owner → Danger Zone and toggle Allow NovaVMS Support Access off. Any active impersonation into your org is invalidated within seconds.
  • Permanently disable platform support access: same toggle, left off. Future mint attempts return 403 IMPERSONATION_BLOCKED. You can still reach Novalien via email; they cannot act inside your org until the toggle is on.
  • Platform support requires more than 30 minutes: normal. They end and re-mint, writing a new reason. You see every mint in the audit log.