--- title: Console basics description: How the Operations Console behaves; navigation, caching and auto-refresh, the HELP overlay, Settings and API tokens, and deep links. --- # Console basics **Goal:** understand how the console renders, refreshes, and authenticates so nothing it does surprises you. ## Prerequisites * You are signed in at `ops.useargus.co` (see [Logging in](/docs/getting-started/logging-in)). ## Navigation and deep links The console is hash-routed: every page has a stable `#/route` URL you can bookmark or share with another operator, for example `#/tenants`, `#/compute`, `#/incidents/:id`, `#/profile`, or `#/settings/tokens`. The rail starts with GET STARTED (Stream Setup), then four groups: MONITOR (Tenants, Pipeline, Incidents), COMPUTE (Architecture, Compute, Planner), REMOTE SUPPORT (Agents, Fleet), and DATA & ADMIN (Records, Webhook DLQ, Onboarding). Start on TENANTS: the tenant row you select there scopes the per-tenant panels, so PIPELINE and AGENTS both render for the selected tenant. Full page-by-page detail is in the [console reference](/docs/console). Which tabs you see can also depend on your role: the console derives a role from your token's preset and hides tabs accordingly. This gating is visibility-only; the real enforcement is the token's scopes, checked server-side on every endpoint. See the role notes in the [console reference](/docs/console). ## Caching and in-place auto-refresh The console is built to feel like a live control panel, not a dashboard that blinks on every poll: * Polled pages refresh on a **15 second** timer and update values **in place**. There is no `LOADING` flash on a tick: each page builds its shell once per navigation, and the timer repaints only the data sections. * Each panel caches its last payload. On a refresh error, the last good data stays on screen instead of being replaced by an error box. Changed table cells flash a brief pulse so you can see what moved. * Records and the incident list are intentionally manual-refresh; incident detail is manual too (mutations repaint in place). * Actions (compute RESUME/STOP/TERMINATE, tenant ARM/DISARM, DLQ retry, and similar) run through a modal, then show a toast and update in place. Sensitive mutations require a step-up confirmation (type the tenant or worker id plus a reason). If you hit the per-operator rate limit, the modal disables submit with a countdown from the server's `Retry-After`. ## The HELP overlay and CONSOLE GUIDE The HELP overlay (titled OPERATOR MANUAL, closable with Esc) contains: * **CONSOLE GUIDE**: a table of every tab with its group, hash route, and what it does; a glossary (Armed, Enroll ticket, PAT, Scope, Step-up, Connect-out, Fleet vs Agents, Selected tenant, DLQ, Planner grade); and prechecks to run before acting. * The **rating rubric** ARGUS assigns to each incident: the composite formula, confidence and data-quality factor tables, the bucketing from composite score to letter grade, and the classification enum. Click any rating chip in a table to see the exact factor scores that produced that grade. The guide's prechecks, verbatim in spirit: (1) paste your PAT in SETTINGS, since mutations return 401 without it; (2) pick a tenant on the TENANTS tab; (3) on AGENTS, the readiness checklist must be green before Tunnel In will succeed; (4) compute STOP/RESUME/TERMINATE and ARM/DISARM each need a step-up confirmation. ## Settings and API tokens (PATs) A PAT (Personal Access Token, `pat_...`) is your scoped, attributed, revocable operator credential. The Settings drawer is where you paste it; the console reports only its presence and last 4 characters, never the value. Settings also offers backend-URL validation with a test-connection probe, your identity and session details, and sign-out. Tokens are minted and revoked on the **API Tokens** page (`#/settings/tokens`): a "New token" wizard collects a name, a preset (or custom scopes), and an expiry, and displays the plaintext exactly once. The server stores only a digest. This is the same token argusctl uses; see [CLI setup](/docs/getting-started/cli-setup). ## With no token: graceful fallback The console does not break without a PAT; it degrades: * Read pages that need auth show a 401 empty state that routes you to the token prompt. * Stream Setup still renders its full explainer with all status pills reading UNKNOWN and a nudge to set your token. * Any mutation returns 401 until a PAT with the matching scope is set. --- For a semantic overview of all documentation, see [/sitemap.md](/sitemap.md) For an index of all available documentation, see [/llms.txt](/llms.txt) For agent-facing discovery, including API and MCP surfaces, see [/agents.md](/agents.md)