User Management

User management is in Settings → Users. Inviting and editing users requires Admin access. From here you can invite new users, change roles, configure default subscribers, and manage service accounts for API access.

Inviting users

Go to Settings → Users

Click Add User.

Enter the user's details and role

Enter the user’s name and email, check Invite to VISO TRUST, and select their role: Admin, Program Manager, Contributor, or Viewer. See Role-Based Access for a breakdown of what each role can do.

Send the invitation

The user receives an email with a link to set up their account. If SSO is configured, their first login must go through your SAML identity provider. Social logins (Google, Microsoft) work after the first successful SSO login.

The users table

Settings → Users lists every user with their business unit, role, and Status, along with a Last active date. Each row also shows the user’s workload: Subscriptions, Business owner assignments, and Assessment lead assignments. The Business owner assignments column splits the count into active and archived relationships. Click either count to open the matching relationships on the Relationships list. VISO TRUST checks those assignment counts before it lets you remove someone.

Reactivating a bounced email

When a VISO TRUST email to a user bounces, the email provider stops sending to that address. A warning icon appears next to the user’s email in Settings → Users. Hover over it to see why delivery failed. If the address is correct, for example after a temporary mailbox outage, click the three-dot menu next to the user and select Reactivate email. This option appears only for users with a bounced email and requires Admin access. VISO TRUST then resumes sending email to that address. If the address is misspelled or no longer active, select Edit and correct the email instead. Reactivation can fail in these cases:

Message	What to do
This address cannot be reactivated.	The email provider has permanently blocked the address. Update the user’s email.
This address is already able to receive email.	No action needed.
Could not reactivate this address. Please try again later.	Try again later.

VISO TRUST also reactivates a bounced address automatically when that user logs in. Automatic reactivation skips addresses that hard bounced more than three times in the last 30 days.

Changing a user’s role

From Settings → Users, click the three-dot menu next to any user and select Edit. Update their role and click Save. Role changes take effect immediately.

Reassigning a user’s work

You don’t have to remove a user to hand off their relationships. Click the three-dot menu and select Reassign to move their subscriptions, Business Owner assignments, and Assessment Lead assignments to someone else. The option is unavailable when the user holds none of the three.

Removing a user

Click the three-dot menu next to the user and select Delete. If the user has relationship subscriptions, Business Owner assignments, or Assessment Lead assignments, the delete dialog prompts you to reassign them first. Select another user to receive the assignments, then click Reassign and Delete Contact. These counts include archived relationships, so a user may need reassignment even if they own nothing in your active portfolio. Relationships that VISO TRUST has permanently deleted at your request don’t count and never block removal. Removing a user:

Revokes their platform access immediately
Does not delete their past activity, comments, or audit trail entries

Users managed by your identity provider

When your organization syncs users from an identity provider, the IdP manages those accounts rather than VISO TRUST, and the menu next to them differs:

Action	Managed by your IdP	Managed in VISO TRUST
Edit (role, business unit, default subscriber)	Yes	Yes
Reassign	Yes	Yes
Send / re-send invitation, copy invite link	No — access comes from the IdP	Yes
Delete	No	Yes
Deactivate / Activate	Yes	No

To take away an IdP-managed user’s access from within VISO TRUST, select Deactivate instead of Delete. Their Status reads Active or Inactive rather than Pending invite, because there is no VISO TRUST invitation in the flow. Removing them from the application in your IdP is what revokes access at the source.

Deactivating a user does not reassign their relationships. Use Reassign first if they hold Business Owner, Assessment Lead, or subscription assignments.

Default subscribers

A Default Subscriber is automatically subscribed to every relationship in the organization, both existing and future. Use this for centralized risk or compliance teams that need visibility across the entire vendor portfolio. To enable:

Click the three-dot menu next to the user → Edit
Check Default Subscriber
Click Save

The change is immediate: VISO TRUST adds the user as a subscriber to all current relationships and any new ones going forward.

A Default Subscriber cannot be removed from an individual relationship unless you first uncheck the Default Subscriber setting on their user profile.

You can configure multiple Default Subscribers. See Inviting Your Team for more context on how to use this feature.

Business Units

Every user belongs to a Business Unit, which is set when they’re created or edited. Business Units determine which unit a relationship is attributed to when the user is assigned as Business Owner. To manage Business Units, go to Settings → Business Units. See Business Units for details.

Creating users in a Business Unit through the API

If you provision users through the API, you can assign each new user to a Business Unit when you create them. Both endpoints require an API token from an Admin or Program Manager account. See Authentication.

Call GET /api/v1/business-units to list your organization’s Business Units. Each entry has an id and a name, sorted by name. You can also use the id values in the businessUnitIds filter of POST /api/v1/relationships/search.
Pass one of those names as businessUnit in your POST /api/v1/users request. The user’s email must belong to one of your organization’s domains.

curl -X POST https://app.visotrust.com/api/v1/users \
  -H "Authorization: Bearer YOUR_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "jane.doe@yourorg.com",
    "firstName": "Jane",
    "lastName": "Doe",
    "businessUnit": "Engineering"
  }'

The businessUnit match is case-insensitive. If you omit it, VISO TRUST assigns the user to the Unassigned Business Unit. If no Business Unit with that name exists in your organization, the API returns 400 Bad Request and doesn’t create the user.

Service accounts for API access

If you’re using the VISO TRUST API for automation or integration, use a dedicated service account rather than a personal user account. This ensures API access isn’t tied to an individual’s employment status and makes it easier to manage token lifecycle. To create a service account:

Invite a new user with a service account email (e.g., viso-api@yourorg.com)
Assign the Admin or Program Manager role, because the API endpoints require program-level access
Log in as that user to generate an API token from the user profile

See Authentication for API token generation and usage.

User activity and audit trail

The platform’s audit trail records all user actions that affect relationships, assessments, and settings. This includes who created a relationship, who uploaded an artifact, who accepted risk, and who changed a setting. The activity log for a relationship is visible in its Activity tab. Organization-level audit events are available to Admins and Program Managers through the API, without needing to ask support:

Endpoint	What it returns
`POST /api/v1/audit-log/user-events`	User activity — logins, first logins, artifact uploads, downloads and exports, user creation and updates, and subscription changes
`POST /api/v1/audit-log/events`	Any event category, filtered by the types you pass

Both take a start and end timestamp and return up to 500 records per request, so pull a narrower window if you hit the cap. POST /api/v1/audit-log/events also takes an eventTypes array; omit it to get every type. Events are grouped into four categories:

Category	Examples
User	`USER_LOGGED_IN`, `USER_UPLOADED_ARTIFACT`, `USER_DOWNLOADED_ARTIFACT`, `USER_CREATED`, `USER_SUBSCRIBED`
Organization	`ORG_UPDATED`, `ORG_FIRST_LOGIN`, `ORG_SUBDOMAIN_SET`, `ORG_ASSESSMENT_DEFAULTS_UPDATED`
Assessment	`ASSESSMENT_CREATED`, `ASSESSMENT_COMPLETED`, `ASSESSMENT_CANCELLED`, `ASSESSMENT_EXPIRED`, `ASSESSMENT_STATUS_CHANGED`
Relationship	`RELATIONSHIP_CREATED`, `RELATIONSHIP_ONBOARDED`, `RELATIONSHIP_ARCHIVED`, `RISK_ACCEPTED`, `PRIMARY_CONTACT_CHANGED`

The full list of accepted eventTypes values is on the endpoint’s page under API Reference → Audit Log. See Authentication for how to generate a token.

Getting Started

Third Parties

Risk & Monitoring

Trust & Questionnaires

VISO Chat Agent

Integrations

Organization Settings

Inviting users

The users table

Reactivating a bounced email

Changing a user’s role

Reassigning a user’s work

Removing a user

Users managed by your identity provider

Default subscribers

Business Units

Creating users in a Business Unit through the API

Service accounts for API access

User activity and audit trail

​Inviting users

​The users table

​Reactivating a bounced email

​Changing a user’s role

​Reassigning a user’s work

​Removing a user

​Users managed by your identity provider

​Default subscribers

​Business Units

​Creating users in a Business Unit through the API

​Service accounts for API access

​User activity and audit trail

Inviting users

The users table

Reactivating a bounced email

Changing a user’s role

Reassigning a user’s work

Removing a user

Users managed by your identity provider

Default subscribers

Business Units

Creating users in a Business Unit through the API

Service accounts for API access

User activity and audit trail