# Customize the login page Source: https://docs.firstresonance.io/administration/authentication-settings/customize-login-page Add your organization's logo and brand colors to the ION sign-in page. ## Customize the login page 1. In ION, go to **Settings > Organization > Authentication**. 2. In the **Login Page Branding** card, enter: * **Logo URL**: a publicly accessible URL to your logo image (for example, `https://example.com/logo.png`). * **Primary Color**: a hex color for buttons and accents (for example, `#16A34A`). * **Background Color**: a hex color for the page background (for example, `#FFFFFF`). 3. Click **Save Branding**. Your branding applies to the login page. # Enforce MFA Source: https://docs.firstresonance.io/administration/authentication-settings/enforce-mfa Require multi-factor authentication for everyone in your organization or just yourself. For what MFA adds to either sign-in method, see the [Overview](/administration/authentication-settings). ## Enforce MFA for all users 1. In ION, go to **Settings > Organization > Authentication**. 2. In the **Multi-Factor Authentication** card, turn on **Require MFA for all users**. Org-wide MFA applies to everyone the moment you turn it on. To avoid locking users out, confirm your team can enroll an authenticator app, and validate the change in a sandbox tenant first if you have one. ## Enforce MFA for yourself You can enable MFA on your own profile without org-wide enforcement enabled. After enabling, log out and sign back in to start the MFA setup flow. If you lose access to your MFA device, see [Troubleshooting sign-in issues](/administration/authentication-settings/sign-in#troubleshooting). ## Related * [Troubleshooting sign-in issues](/administration/authentication-settings/sign-in#troubleshooting) # Overview Source: https://docs.firstresonance.io/administration/authentication-settings/index How authentication works in ION: email and password or SSO, and the domain verification that ties users to your organization. ION identifies every user by their company email address. When someone [signs in](/administration/authentication-settings/sign-in), ION looks at the email's domain to decide what happens next: if the domain has an SSO connection, ION redirects to your identity provider to authenticate; otherwise the user enters an ION password. Everything you configure on the **Settings > Organization > Authentication** page shapes that flow: which domains belong to your organization, whether SSO is on, whether MFA is required, and what the sign-in page looks like. ## Two ways to sign in * **Email and password**: ION manages the credential. New users get an invite email with a link to set their password, and a forgotten password is [reset from the sign-in page](/administration/authentication-settings/reset-your-password). * **Single sign-on (SSO)**: your identity provider manages the credential. ION creates a user profile automatically on first SSO sign-in with the default **User** role, and removing someone from your IdP stops their SSO access to ION. Passwords, in this case, are reset in your IdP, not in ION. For connecting and maintaining an IdP, see the [SSO overview](/administration/authentication-settings/sso). The two coexist per domain, not per user: once SSO is active for a verified domain, users on that domain are routed to the IdP. ## Domains A claimed, verified domain tells ION that email addresses on that domain belong to your organization. Verification works by DNS: ION gives you a TXT record to publish, then confirms you own the domain. A verified domain acts as an allowlist that associates matching users with your organization at sign-up, and it's the prerequisite for SSO. See [Manage domains](/administration/authentication-settings/manage-domains). # Manage domains Source: https://docs.firstresonance.io/administration/authentication-settings/manage-domains Claim and verify your company's email domain so ION can route users to your organization at login. A verified domain is required before you can set up enterprise SSO or automatic user provisioning. For what domain verification does, see the [Overview](/administration/authentication-settings). Coordinate a full domain change, such as migrating your organization to a new company email domain, with [First Resonance support](https://support.firstresonance.io) in advance. Claiming a new domain associates matching users with your organization going forward. It doesn't move your existing users, who keep signing in with their current email addresses until each account is updated individually. ## Add a domain 1. In ION, go to **Settings > Organization > Authentication**. 2. In the **Domain Management** card, enter your domain in the **Add Domain** field and click **Add Domain**. The domain appears in your **Claimed Domains** list with a **Pending** status. ## Verify the domain After you add a domain, ION displays the name and value of a DNS TXT record to publish. 1. Give the TXT record name and value to whoever manages your DNS, and have them add it to the domain's DNS settings. 2. Once the record is live, click **Check Verification** next to the domain. ION checks for the record and updates the domain's status. DNS changes can take a few minutes to propagate. If verification is still **Pending**, wait and try again. ## Domain statuses | Status | Meaning | | ------------ | ---------------------------------------------------------------------------------------------------------- | | **Verified** | Ownership confirmed. ION routes users on this domain to your organization. | | **Pending** | Waiting on the DNS record, or DNS hasn't propagated yet. | | **Failed** | ION couldn't find the expected TXT record. Double-check the record and click **Check Verification** again. | ## Remove a domain 1. In the **Domain Management** card, click the remove icon next to the domain. 2. In the **Remove domain** dialog, click **Remove domain** to confirm. Removing a domain means users with email addresses on that domain are no longer automatically associated with your organization at login. Only remove a domain you no longer use. If you're transferring your organization to a different domain, work with [First Resonance support](https://support.firstresonance.io) to move accounts over before you remove the old domain. ## Related * [Set up SSO](/administration/authentication-settings/sso/set-up-sso) # Reset your password Source: https://docs.firstresonance.io/administration/authentication-settings/reset-your-password How to reset a forgotten ION password from the sign-in page. 1. On the ION sign-in page, click **Don't remember your password?** 2. Enter your email address and submit. 3. Check your inbox for a reset email from `invites@firstresonance.io` and follow the link to set a new password. If your organization uses SSO, reset your password in your identity provider, not in ION. If the reset email doesn't arrive, check your spam folder. IT teams: allowlist `invites@firstresonance.io` to ensure password reset and invite emails are delivered. ## Related * [Sign in to ION](/administration/authentication-settings/sign-in) # Sign in to ION Source: https://docs.firstresonance.io/administration/authentication-settings/sign-in How to sign in to ION with email and password or single sign-on. Go to your organization's ION URL and enter your **company email address**, then click **Continue**. ION either prompts you for your ION password or, if your email domain uses SSO, redirects you to your identity provider and back. For how this routing works, see the [Overview](/administration/authentication-settings). ## Sign in for the first time With SSO, just sign in through your identity provider. The very first person to sign in to a new ION organization becomes its administrator; every subsequent user gets the default **User** role, which an admin can extend. With email and password, an administrator at your company sends you an invite email with a link to set your password. ## Troubleshooting Verify that you're signing in with the correct URL: `app-v2.buildwithion.com`, `app-v2.gov.buildwithion.com`, or `app-v2.ap.buildwithion.com` (or the correct sandbox URL if applicable). Your ION environment might still be setting up. Wait 15 minutes and try again. Contact an administrator at your company to reactivate your ION account. A required permission isn't enabled for your role. An admin can grant it. See [Create a role](/administration/users-and-permissions/manage-roles). Contact [support](https://support.firstresonance.io/) to reset it. ## Related * [Reset your password](/administration/authentication-settings/reset-your-password) # Disable SSO Source: https://docs.firstresonance.io/administration/authentication-settings/sso/disable-sso Turn off your SSO connection so users sign in with email and password instead. For what disabling SSO means for your team, see the [Overview](/administration/authentication-settings). Disabling SSO removes the connection entirely. Turning SSO back on later requires running the setup wizard again. Anyone already signed in stays signed in until their session ends. ## Disable SSO 1. In ION, go to **Settings > Organization > Authentication**. 2. In the **Enterprise SSO** card, click **Disable SSO**. ## Related * [Set up SSO](/administration/authentication-settings/sso/set-up-sso) * [Rotate your SAML signing certificate](/administration/authentication-settings/sso/rotate-saml-certificate) # Overview Source: https://docs.firstresonance.io/administration/authentication-settings/sso/index The life of an SSO connection in ION: set it up, keep its certificate current, and retire it. An SSO connection hands authentication to your identity provider (Okta, Microsoft Entra ID, Google Workspace, ADFS, or another SAML or OIDC provider) and has a life beyond initial setup: 1. **Set up**: after verifying your domain, you connect your IdP through a self-service wizard that exchanges SAML or OIDC details and maps user attributes. See [Set up SSO](/administration/authentication-settings/sso/set-up-sso). 2. **Maintain**: SAML connections verify each login against your IdP's signing certificate. When that certificate expires or your security team rotates it, you update ION with the new one, coordinated with the IdP switch. OIDC keys rotate automatically. See [Rotate your SAML signing certificate](/administration/authentication-settings/sso/rotate-saml-certificate). 3. **Retire**: disabling SSO removes the connection and returns your team to email and password sign-in without deleting any accounts. See [Disable SSO](/administration/authentication-settings/sso/disable-sso). A misconfigured SSO connection or an out-of-sync certificate rotation blocks fresh sign-ins to production. Validate authentication changes in a sandbox tenant when you have one, and keep the previous certificate on hand during a rotation. # Rotate your SAML signing certificate Source: https://docs.firstresonance.io/administration/authentication-settings/sso/rotate-saml-certificate Replace an expiring or rotated SAML signing certificate on your SSO connection without opening a support ticket. This page applies to SAML connections only. OIDC connections have no signing certificate to rotate. For how certificate rotation fits into the SSO lifecycle, see the [Overview](/administration/authentication-settings). ## When you'll need to do this * **Certificate expiry.** Most IdP signing certificates are valid for one to three years. Your IdP or security team issues a replacement before the old one expires. * **Scheduled key rotation.** Routine security hygiene, or a response to a suspected key compromise. * **IdP changes.** Switching identity providers, or upgrading the signing algorithm (for example, moving from SHA-1 to SHA-256). * **Auto-rolled keys.** Your IdP changed its signing key on its own (for example, Microsoft Entra auto-rolled its certificate). ## Before you start The **Rotate certificate** button is only visible to org administrators with SSO management permission. Rotating the certificate requires updating both your IdP and ION at roughly the same time. If they're out of sync, logins fail. ION holds one signing certificate per connection at a time. There's no overlap period where both the old and new certificates are valid. New sign-ins briefly fail in the window between your IdP switching to the new key and ION being updated to match. Anyone already signed in stays signed in; the certificate is only checked on fresh logins. Keep your previous certificate available until you've confirmed a successful login. Rolling back means pasting the old certificate back. ## What you'll need From your IdP administrator, get one of the following for the new certificate: * The new **X.509 certificate** in PEM format (a text block beginning with `-----BEGIN CERTIFICATE-----`), or * Your IdP's **SAML 2.0 metadata XML** (beginning with ` Organization > Authentication**. 2. In the **Enterprise SSO** card, click **Rotate certificate**. 3. Paste the new PEM certificate or SAML metadata XML into the dialog, or use **Upload from file** to select it. ION confirms the format it detected below the input. 4. Have your IdP administrator activate the new signing key. 5. Click **Rotate**. ION immediately starts verifying logins with the new certificate and displays a SHA-256 fingerprint of the new certificate. ION's fingerprint is SHA-256, but most IdP consoles (Okta, Microsoft Entra, ADFS) display a SHA-1 thumbprint, so the two won't match by eye even when everything is correct. To compare, generate the SHA-256 yourself: `openssl x509 -noout -fingerprint -sha256 -in cert.pem`. 6. Ask someone (not yourself) to sign out and sign back in through SSO to verify the new certificate works. ## If sign-ins start failing This is recoverable and does not affect anyone already signed in. * **Most likely cause**: ION and your IdP are temporarily out of sync. One is using the new certificate and the other is still on the old one. * **Fastest fix**: open **Rotate certificate** again and paste the previous certificate back. New sign-ins recover immediately. Then retry the rotation once both sides are ready to switch together. * If logins still fail after both sides are confirmed on the new certificate, [contact support](https://support.firstresonance.io/) with the fingerprint ION displayed and the time of the change. ## Frequently asked questions No. The signing certificate is only checked when someone signs in fresh. Everyone with an active session keeps working uninterrupted. Not without a brief interruption. Because ION holds only one certificate at a time, loading the new one before your IdP starts signing with it causes new sign-ins to fail until the IdP catches up. Switch both sides together instead. The action is restricted to administrators with SSO management permission. Ask an admin on your team, or [contact support](https://support.firstresonance.io/). For a routine certificate swap, paste the PEM. It updates only the signing certificate and leaves the rest of your connection untouched. Use metadata XML only when you intend to refresh the whole connection (new endpoints or attribute mappings). Paste the certificate your IdP will sign with after the cutover, coordinated with the switch. This action updates only the IdP signing certificate ION uses to verify login tokens. It does not change ION's request-signing certificate or any assertion-encryption keys. If you need to rotate those, contact [support](https://support.firstresonance.io/). ## Provider-specific notes Entra downloads its certificate as a binary `.cer` (DER) file. Convert it to PEM, or use the federation metadata. Entra auto-rolls its signing certificate and lists multiple certificates in its federation metadata during the overlap, so paste the one it will use after the switch. GovCloud tenants live under `login.microsoftonline.us`. Generate the next certificate in Okta, then paste its signing certificate (PEM) or Okta's metadata URL/file. Okta metadata lists both encryption and signing certificates. ION automatically picks the signing one. ADFS's AutoCertificateRollover publishes a primary and secondary token-signing certificate, exported as binary `.cer` (DER). Convert to PEM and paste the one that will be primary after the rollover. Download the SAML app's signing certificate as PEM and paste it. If your provider only offers metadata, paste the metadata XML. ## Related * [Set up SSO](/administration/authentication-settings/sso/set-up-sso) * [Disable SSO](/administration/authentication-settings/sso/disable-sso) # Set up SSO Source: https://docs.firstresonance.io/administration/authentication-settings/sso/set-up-sso Connect your identity provider to ION so your team can sign in with their existing company credentials. For how SSO fits into ION authentication, including how accounts are provisioned on first sign-in, see the [Overview](/administration/authentication-settings). ## Before you start [Claim and verify your email domain](/administration/authentication-settings/manage-domains) before setting up SSO. Adding SSO after you onboard many users means reconciling existing accounts with your identity provider. A misconfigured SSO connection can lock users out of production. If you have a sandbox tenant, validate the connection there before enabling it in production. ## Set up SSO 1. In ION, go to **Settings > Organization > Authentication**. 2. In the **Enterprise SSO** card, click **Configure SSO**, then click **Open SSO Setup Wizard** and follow the steps to connect your identity provider. The wizard walks you through selecting your provider, exchanging SAML or OIDC details, mapping user attributes, and enabling the connection. 3. When the wizard is complete, return to ION and click **Check Status**. Once your IdP connection is live, the card shows **SSO Active** with your provider and connection name. You can hand the setup wizard link to whoever manages your IdP if you don't have access to configure it yourself. The wizard shows you the values to enter into your identity provider and collects your provider's metadata or signing certificate directly. You don't need to send anything to First Resonance to complete setup. For more information, see Auth0's [self-service SSO documentation](https://auth0.com/docs/authenticate/enterprise-connections/self-service-SSO). ## Troubleshooting The wizard must fully complete and the connection must be enabled before ION can verify it. Return to the wizard and confirm the final step shows the connection as enabled, then try **Check Status** again. Confirm your email domain is claimed and verified in ION before enabling SSO. See [Manage domains](/administration/authentication-settings/manage-domains). Unverified domains won't route users to your IdP. Check the attribute mapping step in the wizard. ION expects the email attribute to be mapped correctly from your IdP. For SAML providers, the email attribute is typically `email` or `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress`. Confirm with your IdP's documentation. If your IdP uses SAML and rotated its signing certificate, ION needs to be updated with the new certificate. See [Rotate your SAML signing certificate](/administration/authentication-settings/sso/rotate-saml-certificate). ## Provider-specific notes The wizard is the same for every provider and shows you the exact service-provider values to enter into your IdP. These notes cover what's specific to the most common providers. Create a **SAML 2.0** app integration in Okta and paste in the **Single sign-on URL** and **Audience URI (SP Entity ID)** the wizard displays. They take the form `https://firstresonance.auth0.com/login/callback?connection=` and `urn:auth0:firstresonance:`, with the connection name filled in by the wizard. Okta sends the user's `email` in the SAML assertion by default. When you provide Okta's metadata, ION automatically picks the **signing** certificate if both signing and encryption certificates are listed. Background: [Auth0 community guide to Okta as the SAML IdP](https://community.auth0.com/t/saml-setup-okta-as-idp-and-auth0-as-sp/91164). Register the application in the Microsoft Entra admin center using the **Reply URL (ACS)** the wizard displays (based on `https://firstresonance.auth0.com/login/callback`), then provide your application's **federation metadata** (URL or XML) back in the wizard. Confirm Entra releases the user's **email** claim. **GovCloud** tenants sign in under `login.microsoftonline.us`. Entra **auto-rolls** its signing certificate and lists multiple certificates during the overlap. This matters when you later [rotate the signing certificate](/administration/authentication-settings/sso/rotate-saml-certificate). Configure the relying party in ADFS following [Auth0's ADFS connection documentation](https://auth0.com/docs/connections/enterprise/adfs), using **Realm Identifier** `urn:auth0:firstresonance` and **Endpoint** `https://firstresonance.auth0.com/login/callback`. Then provide your ADFS **federation metadata URL** (for example, `https://adfs.yourcompany.com/FederationMetadata/2007-06/FederationMetadata.xml`) in the wizard. ## Related * [Rotate your SAML signing certificate](/administration/authentication-settings/sso/rotate-saml-certificate) * [Disable SSO](/administration/authentication-settings/sso/disable-sso) * [Manage domains](/administration/authentication-settings/manage-domains) # Custom attributes Source: https://docs.firstresonance.io/administration/custom-attributes Add org-defined metadata fields to ION records (procedures, runs, parts, issues, and more) from Settings. Custom attributes let you capture additional metadata on ION records beyond the default fields. They are available for the following entity types: | Entity | Where in Settings | | --------------- | --------------------------------------------- | | Procedures | **Settings > Production > Procedures** | | Standard steps | **Settings > Production > Standard Steps** | | Runs | **Settings > Production > Runs** | | Issues | **Settings > Quality > Issues** | | Parts | **Settings > Supply Chain > Parts** | | Purchases | **Settings > Supply Chain > Purchases** | | Receipts | **Settings > Supply Chain > Receipts** | | Suppliers | **Settings > Supply Chain > Suppliers** | | Part kits | **Settings > Supply Chain > Part Kits** | | Locations | **Settings > Supply Chain > Locations** | | Parts Inventory | **Settings > Supply Chain > Parts Inventory** | | Plans | **Settings > Supply Chain > Plans** | | Further Actions | **Settings > Quality > Further Actions** | The **Purchases** page defines two separate attribute sets: **Purchase Order Attributes** apply to the order, and **Purchase Order Line Attributes** apply to each line on the order. ## Add a custom attribute To add a custom attribute: 1. Go to the Settings page for the entity you want to extend (see table above). 2. In the **Attributes** section, enter a **Name** for the attribute. 3. Select a **Type** from the dropdown. 4. Click **Add**. The attribute is saved immediately. ### Attribute types The **Type** dropdown lists these options. After you save the attribute, ION shows the type as a badge, which can use a different label than the dropdown option. | Dropdown option | Badge label | Description | | ------------------ | ------------ | ---------------------------------------------------------------------- | | **String** | String | Free-text input. | | **Number** | Number | Numeric value. | | **Boolean** | Boolean | On or off toggle. | | **Datetime** | Date & Time | Date and time picker. | | **FileAttachment** | File | File attachment. | | **Select** | Select | Single-choice dropdown. You define the options after creation. | | **Multiselect** | Multi-Select | Multiple-choice dropdown. You define the options after creation. | | **ION: Parts** | ION: Parts | Reference to a part record. | | **ION: Users** | ION: Users | Reference to a user. | | **Rich Text** | Rich Text | Formatted text. Available only on entity types that support rich text. | ## Manage options for select and multi-select attributes Select and multi-select attributes require you to define their options separately after creation. Options follow an archive-then-delete lifecycle: archiving takes an option out of circulation while leaving the records that already use it intact, and permanent deletion is only available once an option is archived. To manage an attribute's options: 1. In the **Attributes** section, find the attribute and click the expand arrow next to it. 2. To add an option, type the option name in the input field and press **Enter** or click **Add**. 3. To archive an option, click the archive icon on the option. 4. To work with an option you already archived, expand **Archived**, which shows the archived count, and use one of the icons on the option: * The restore icon returns the option to the active list. * The delete icon removes the option from the attribute permanently. Archived options stay out of the pick list on new entries, so nobody can select one again until you unarchive it. A record that already holds an archived option keeps that value. Expanded Finish attribute of type Select showing an input reading Type option name and press Enter, an Add button, active options Anodized and Powder Coat each with an archive icon, and an ARCHIVED (1) list containing the struck-through option Bare with a restore icon and a delete icon Deleting an archived option can't be undone. ION blocks the deletion if any record still holds the option, so archive it instead when you need to retire an option that's in use. ## Edit a custom attribute The name and type of a custom attribute can't be changed after creation. To rename an attribute or change its type, delete it and create a new one. For **Select** and **Multi-Select** attributes, you can add and archive options at any time. For more information, see [Manage options for select and multi-select attributes](#manage-options-for-select-and-multi-select-attributes). ## Archive a custom attribute Archiving an attribute hides it from data entry across ION: it stops appearing on create forms, table column pickers, and the panels that add an attribute to a record. Records that already carry a value for the attribute keep it, and you can still edit that value. 1. In the **Attributes** section, find the attribute you want to archive. 2. Click the archive icon at the end of the attribute row. To bring an attribute back, expand **Archived** and click the restore icon on the attribute row. ## Delete a custom attribute Delete is only available on an archived attribute, so archive it first. To delete a custom attribute: 1. In the **Attributes** section, expand **Archived**. 2. Click the delete button on the attribute row. 3. In the **Delete Attribute** dialog, click **Delete**. If you accidentally deleted a custom attribute that other records still used, create a new attribute with the exact same name and type. ION will restore the attribute and its values on each record. ## Archived values on records When a record holds a value whose option has since been archived, the value pickers mark it with an **Archived** badge so you can tell it apart from an active option. Because an archived option can't be selected again, ION asks you to confirm in the **Deselect archived option?** dialog before it removes the value. ## How attribute values copy between records When you duplicate a record, ION carries its custom attribute values to the new record in these cases: * Splitting an inventory line copies the parent's attribute values to the new line. * Copying a purchase order copies attribute values on both the order and its lines. * Creating a new part revision copies the source revision's attribute values. Creating a brand-new part does not copy attribute values, since there is no source record to copy from. # Customer S3 Delivery Setup Source: https://docs.firstresonance.io/administration/customer-s3-delivery-setup Set up an S3 bucket in your AWS account to receive automated data snapshots from ION. ## Overview ION delivers automated data snapshots directly to an S3 bucket in your AWS account as `.tar` archives, once you set up the bucket and grant First Resonance access to write to it. ## What you need * An S3 bucket in your AWS account * An IAM role that First Resonance assumes to write to your bucket * An external ID (provided by First Resonance) for secure role assumption Once configured, snapshots are delivered to: ``` s3:///// ``` ## Set up delivery Create a bucket in your preferred AWS region, either through the AWS console or using the CLI: ```bash theme={null} aws s3 mb s3:// --region ``` We recommend enabling: * **Versioning**: protects against accidental overwrites. * **Server-side encryption** (SSE-S3 or SSE-KMS): encrypts data at rest. Create an IAM role that First Resonance assumes to deliver snapshots to your bucket. ### Trust policy The trust policy allows First Resonance to assume the role using an external ID. Replace `` with the First Resonance AWS account ID for your environment (provided by your account team), and `` with the external ID we provide. ```json theme={null} { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam:::root" }, "Action": "sts:AssumeRole", "Condition": { "StringEquals": { "sts:ExternalId": "" } } } ] } ``` The external ID prevents the [confused deputy problem](https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html) and ensures only First Resonance can assume this role. ### Permission policy Attach the following policy to the role. Replace `` with your bucket name. ```json theme={null} { "Version": "2012-10-17", "Statement": [ { "Sid": "SnapshotDeliveryBucketAccess", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:AbortMultipartUpload", "s3:ListBucketMultipartUploads", "s3:ListMultipartUploadParts", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::", "arn:aws:s3:::/*" ] } ] } ``` `s3:PutObject` handles the core upload. The additional permissions allow First Resonance to clean up incomplete uploads and list bucket contents for verification. Provide the following details to your account team: | Field | Description | | ------------- | -------------------------------------------- | | Bucket name | Your S3 bucket name. | | Bucket region | The AWS region where your bucket is located. | | Role ARN | The full ARN of the IAM role you created. | First Resonance provides the external ID and configures your snapshot schedule. After we receive your configuration, our system validates access by: 1. Assuming the IAM role with the external ID. 2. Verifying the bucket exists and is accessible. 3. Writing and deleting a small test object. If validation fails, we reach out with the specific error so you can adjust permissions. ## What gets delivered Each snapshot creates files under your bucket with this structure: ``` s3:/// └── / └── / ├── snapshot_tables_.tar └── snapshot_attachments_.tar ``` For large snapshots that are split into multiple files, each file includes a part number (for example, `snapshot_tables_part1_.tar` and `snapshot_tables_part2_.tar`). * **snapshot\_tables**: all database tables as compressed CSV files, bundled into a tar archive. * **snapshot\_attachments**: file attachments bundled into a tar archive. ## Troubleshooting **Cause:** Trust policy does not allow the First Resonance account. **Fix:** Verify the `Principal` in the trust policy matches the account ID provided by your account team. **Cause:** External ID mismatch. **Fix:** Verify the `sts:ExternalId` condition matches the value provided by First Resonance. **Cause:** Missing or incorrect permission policy. **Fix:** Verify the permission policy is attached to the role and the bucket name matches. **Cause:** Role lacks `s3:PutObject` permission. **Fix:** Check the permission policy includes `PutObject` on the bucket resource. **Cause:** Wrong bucket name or region. **Fix:** Verify the bucket name and that it exists in the expected region. ## Security notes * First Resonance uses **STS AssumeRole** with short-lived credentials that are automatically refreshed during long-running snapshots. No credentials are stored. * The **external ID** ensures only First Resonance can assume the role. * First Resonance only writes to your tenant's prefix and does not read or modify other data in your bucket. * All data is transmitted over HTTPS (TLS). ## Related pages For an overview of data snapshots, see [Data Snapshots](/administration/data-snapshots). # Data Snapshots Source: https://docs.firstresonance.io/administration/data-snapshots Create a full snapshot of your organization's data and attachments from ION for backup, compliance, or analytics purposes. ## Overview Data snapshots let you create a complete copy of your organization's data from ION. Snapshots are useful for backups, compliance requirements, data warehousing, or feeding external analytics tools. By default, a snapshot includes both: * **Tables**: all of your organization's structured data, such as parts, inventory, BOMs, runs, and issues. * **Attachments**: all documents, images, and other files uploaded across ION, including those attached to runs, procedures, and issues. If needed, you can choose to snapshot only tables or only attachments. Data snapshots are available depending on your organization's plan and settings. To find out whether snapshots are enabled for your organization, contact your account team. ## How data snapshots work Data snapshots run automatically on a scheduled cadence configured for your organization. To get started, reach out to your account team to set up your snapshot schedule and delivery destination. Once a snapshot completes, you can download the resulting files from the **data snapshots page**. You can also track the status of all snapshots from the snapshot history table. The data snapshots page is only accessible to organization admins for security purposes. All snapshot data is encrypted at rest and in transit using TLS. ## What you receive Snapshots are delivered as `.tar` archives. A tables snapshot contains one compressed file per table (`.csv.gz` or `.jsonl.gz`), and an attachments snapshot contains all uploaded files. For large snapshots, ION automatically splits the output into multiple `.tar` files labeled with a part number, such as `snapshot_tables_part1_2026-03-31-143022.tar` and `snapshot_tables_part2_2026-03-31-143022.tar`. ## Delivery destinations By default, snapshots are stored in ION and made available for download through the UI. Snapshots stored in ION are retained for **30 days**, after which they are automatically deleted. You can set up [Customer S3 delivery](/administration/customer-s3-delivery-setup) to have snapshots delivered directly to your own AWS S3 bucket. Delivering to your own bucket gives you ownership of the snapshot files and lets you apply your own retention and access policies. ## Scheduling Snapshots can be scheduled to run weekly or monthly. Your account team configures the cadence during onboarding. ## Onboarding To get started with data snapshots: 1. **Contact your account team.** Let them know you want to set up data snapshots and whether you need tables, attachments, or both. 2. **Choose a delivery destination.** Snapshots can be downloaded from ION directly, or delivered to your own S3 bucket. 3. **Set up customer-managed S3 delivery, if applicable.** Follow the [Customer S3 delivery setup](/administration/customer-s3-delivery-setup) guide to create your bucket, configure an IAM role, and share your configuration for validation. 4. **Go live.** Once configured, snapshots run on your chosen schedule and are delivered automatically. ## Snapshot history The data snapshots page shows the status of all snapshots for your organization: | Status | Description | | ----------- | -------------------------------------------------------------------------------- | | Pending | The snapshot is waiting to be processed. | | In Progress | The snapshot is currently running. | | Completed | The snapshot finished successfully and files are available for download. | | Failed | The snapshot encountered an error. Check the error details for more information. | Data snapshots page with the download panel for a completed snapshot. # Export data Source: https://docs.firstresonance.io/administration/export-data Export ION data to CSV or Excel on demand or on a schedule, track each export job, and download the finished file. The Exports page delivers a data view from ION as a CSV or Excel file, either once on demand or on a recurring schedule. Each run of an export is a job whose status and output you can check from the export's detail page. ION can email the file to the recipients you set, or download it straight to your browser. ## Request an export 1. In ION, go to **OS > Exports**. 2. Click **New Export**. 3. In the **Create export** dialog, fill in: * **Name**: what to call this export. This field is required. * **View name**: the data view to export. Start typing to search your available views, listed under **Available views**, or enter any view name you have access to. This field is required. * **Format**: **CSV** or **Excel**. * **Delivery**: how you get the file, **Email** or **Download**. This choice is available on the **Run once** tab; scheduled exports always deliver by email. * **Delivery recipients**: the email addresses that receive the file. At least one is required. This field appears only for **Email** delivery. 4. Choose when it runs: * On the **Run once** tab, click **Run now** to run the export immediately. With **Download** delivery, ION prepares the file and saves it to your browser once it's ready. With **Email** delivery, ION emails the recipients when the file is ready. * On the **Schedule** tab, enter a **Cron expression** and pick a **Timezone**, then click **Save schedule** to run it on a recurring cadence. ION emails the recipients each time the file is ready. ## Manage exports The Exports table lists each export with its **Name**, **View**, **Schedule**, and **Last updated**. Use the **Enabled** toggle to pause or resume a scheduled export. The actions menu on each row offers **Run now**, **View details**, **Enable** or **Disable**, and **Delete**. ## Check job status and download the file 1. On the **Exports** page, open the actions menu on an export and click **View details**, or click the export's name. 2. The detail page shows the export's **View**, **Format**, **Schedule**, **Recipients**, and whether it is **Enabled**, with a **Run now** button to trigger it again. 3. Under **Recent jobs**, each row is one run: * **Status**: **Pending**, **In progress**, **Completed**, or **Failed**. A failed job shows its error message under **Details**. * **Trigger**, **Started**, and **Completed**: how and when the job ran. * **Rows** and **Size**: what the job produced. 4. On a completed job, click **Download** to save the file. ## Related * [Data snapshots](/administration/data-snapshots) * [Export run data](/build-hardware/runs-and-execution/export-runs-data) # Overview Source: https://docs.firstresonance.io/administration/ion-importers/index Use CSV imports to bulk-create or update records in ION. ION's import feature lets you upload a CSV file to create or update records in bulk. Instead of entering data one row at a time through the UI, you can prepare a spreadsheet offline and import it all at once. ## How imports work To start an import, navigate to **Imports** in the sidebar, then pick an import type from the **New Import** tab. The importer cards are grouped by category (**Production**, **Supply Chain**, **Quality**, and **OS**) to match where each record type lives in ION. Imports are processed **asynchronously**, so you can navigate away and continue working while the import runs. You receive a notification when the import completes or fails. Clicking **Start Import** on any card opens the import wizard, which walks you through **Upload**, **Match**, and **Review** steps. On the **Upload** step you can download the CSV template, toggle the importer's options (the option set varies by importer), or choose **Enter data manually** to type rows into the grid instead of uploading a file. The editable preview covers files up to 5,000 rows. Upload a larger file and ION says so, skips the **Match** and **Review** steps, and offers **Import file as-is**, which sends the file unedited. A file above 1,000,000 rows is rejected outright. The **Match** step maps your file's columns to ION fields. ION auto-maps each column to the field whose name it matches, and you can adjust any mapping in that column's **Maps To** dropdown: pick a different field, keep the column as a custom attribute, or skip the column so it isn't imported. Required fields must stay mapped. When you enter data manually instead of uploading, this step becomes a column picker where you choose which fields to include. On the **Review** step, ION shows your rows in an editable grid. Edit any cell inline, then use the validate control to check the data. ION flags each failing cell with its error and highlights the affected rows, so you can fix them and revalidate before importing. The control reads **Validate** before the first check and **Revalidate** after, and editing a validated file prompts you to revalidate before you can import. Import wizard Review step showing an editable grid with three rows flagged Name is required and a banner reading 3 issues in rows 1, 2, 3 Imports are **all-or-nothing**. If any row fails validation, no rows are written and you receive an error report. You never end up with a partially imported file. You can track the status of all imports from the **Import History** tab. Expand any failed job to see its per-row error messages, or click **Download** to pull the full error CSV. ## Video walkthrough The end-to-end import flow is the same for every importer: pick a type, download the template, upload your CSV, run validation, then commit. The walkthrough below uses the mBOM importer as an example.