A PhotoPrism® Portal serves a management interface for the whole cluster: which instances are registered, who may open them, which sessions are active, and what has been happening. It complements the photoprism cluster commands — anything you can do here can also be scripted from a terminal, and the commands are the better choice for automation.
The interface lives under the Portal’s frontend path, /portal by default (see PHOTOPRISM_FRONTEND_URI). It is available to accounts holding the cluster admin role; other roles sign in through the Portal to reach their instances and do not see these views. How roles are assigned is covered in Access & Authentication.
Instances
/portal/cluster/nodes lists every registered instance with its UUID, when it was created and when it was last seen. The last-seen time is the quickest way to tell whether an instance is still checking in, so it is usually where you start when a tenant looks unreachable.
Opening an instance shows its details and an Accounts tab for managing accounts on that instance without leaving the Portal. Instance display names can be edited here; identifiers and credentials are managed with photoprism cluster nodes on the command line.
Activity
/portal/cluster/activity shows what the cluster has been doing — sign-ins, instance registrations, credential rotations and administrative actions. Entries follow a who → what → outcome shape, so a row reads as the actor, the action, and whether it was granted, denied or failed.
Each entry records the client address it came from as its own field. A search whose whole query is an address matches that field, in either IP family; anything else is matched against the level and text as usual. The view updates live, so an action taken in another window or from a terminal appears without reloading.
How much is recorded is set by PHOTOPRISM_AUDIT_LEVEL, which is documented together with the other logging options in Config Options.
Accounts
/portal/admin/users lists the accounts known to the Portal, their role, and which instances each may open. Editing an account opens a dialog with an Instances tab, where per-instance access is granted or removed; changes save as you make them.
Per-instance access offers No access, Account default — resolve the instance role from the account’s Portal role at sign-in — or a specific instance role. The Portal operator role is never offered as an instance role.
To keep an operator from locking themselves out, the Role, Cluster Admin and Web Login controls are disabled when you edit your own account. The server rejects those self-changes regardless of what the interface allows.
/portal/admin/groups maps identity-provider groups to a Portal account role. This is not the same as admitting a group to an instance: instance admission is per-instance and managed with photoprism cluster nodes allow-group, described in Access & Authentication.
Sessions
/portal/admin/sessions lists active sessions with the account, the authentication provider, the client address, and when the session was created and expires. Sessions can be ended here, which is the fastest way to sign out a specific client without changing an account.
PhotoPrism® Documentation
For the cluster as a whole, see Path-Based Proxy for how instances are served under one domain, Access & Authentication for sign-in and access control, and Config Options for the environment variables referenced above.