> ## Documentation Index > Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt > Use this file to discover all available pages before exploring further. # Manage partners in the Console > Create a partner step by step, create its applications, change what it can reach, suspend it, and delete it from Settings in Lerian Console. This guide shows how to manage [partners](https://docs.lerian.studio/en/platform/access-manager/features/partners/overview) from the Console. You create the partner, create its applications, and change or end its access later. ## Before you start *** To manage partners, a user needs the `partners` permissions of `plugin-identity`: `get` to see Partners in Settings, `post` to create a partner, `patch` to change one and `delete` to delete one. Managing its applications needs the `applications` permissions `get`, `post` and `delete`. The `plugin-identity-editor-role` role holds all of them. Creating a partner, changing its permissions or scope, and creating its applications need Access Manager 3.11.0 or later. With an earlier version, the Console shows "Requires Access Manager 3.11.0 or later" in place of those controls. Collect this information before you start: * The products the partner needs, and what it may do in each one. * The identifiers of the items the partner may reach, for each dimension you restrict. Each product that offers restrictions needs at least one. Copy them from the product's own API or Console. The Console does not check that they exist. * What each product's restrictions reach: see [Partners in Midaz](https://docs.lerian.studio/en/platform/access-manager/features/partners/midaz.md) and [Partners in Pix JD](https://docs.lerian.studio/en/platform/access-manager/features/partners/pix-jd.md). * The network addresses the partner calls from, if you want to restrict them. * The start and end dates of its access, if it has a time limit. ## Open the Partners page *** **1. Open Settings** Click the gear icon () in the top navigation bar. **2. Select Partners** Select **Partners**. The subtitle reads "Give each customer its own credentials and limit what it can reach." The **Give partners access** card on the Console home page opens the same page. The list shows each partner's **Name**, **Status**, **Validity window**, **Applications**, and **Creation Date**. The status is **Active**, **Suspended**, **Expired**, or **Not yet valid**. The Console shows **Expired** and **Not yet valid** from the validity window. With no partners yet, the page reads "You haven't registered any partners yet". ## Create a partner *** Click **New partner**. The **New partner** panel opens, with five steps: **Details**, **Products**, **Scope**, **Permissions**, and **Review**. The **Next** button opens only when the current step is complete. The **Back** button keeps what you entered. If you close the panel before you save, the Console asks "Discard this new partner?". Nothing is created until you save. **1. Details** Type the partner's **Name**. It must be unique in your tenant. Under **Validity window**, fill in **Valid from** and **Valid until** if the access has a time limit. Leave **Valid from** empty to start now. Leave **Valid until** empty so it never expires. After the partner's **Valid until** date, Access Manager refuses its requests, also with a token it already holds, and refuses new tokens. Under **Where it calls from**, choose one option: * **Use your organization's IP list**: the partner uses your tenant's IP allowlist. * **Give it its own list**: type each **IP address or CIDR range** and an optional **Description**. Click **Add IP** for each new line. When a partner has its own IP list, that list replaces the tenant's IP list for the partner's requests. **2. Products** Choose the products the partner can use. The list shows only what your tenant can give. A product that does not accept partners is unavailable, with one of these messages: * "This product isn't ready for partners yet." The product has not published its scope catalog. * "This product hasn't enabled partner access yet." The product's scope catalog does not accept partners. **3. Scope** Say where the partner can act on each product. A restriction that the product requires is already open, with **(Required)** after its name. To add a restriction, check **Restrict by** followed by the name of the restriction. Type one identifier, or several identifiers separated by commas. Give the partner at least one restriction with an ID on each product that offers restrictions. **4. Permissions** Check the resources and the actions the partner can use on each product. To give a different set of actions on other resources, click **Add another line on** followed by the product name. The Console offers only what your tenant can give. It shows a reason next to each entry that it cannot save: * **Not allowed**: the product's editor role in your tenant does not hold this permission. * **Outside the scope**: the write acts at a level wider than the partner's scope. * **Granted twice**: another line already grants the same action on the same resource. **5. Review** Read the summary under "Check what this partner can and can't do". The **Only inside** part lists the restrictions. The **It can** part lists the actions on each resource. The **It can't** part lists what stays outside. Click **Save**. The Console creates the partner with no applications and opens its **Overview** tab. If Access Manager refuses the partner, the Console shows "The Access Manager refused this change". It also shows the reason and the error code, and opens the step that holds the field to fix. ## Create the partner's applications *** A partner calls a product with an application that belongs to it. Create one application per product. **1. Open the Applications tab** In the partner list, click the partner. Select the **Applications** tab. **2. Create the application** Click **New Application**. In the **New application** side sheet, choose the **Product**. The list shows only the products that the partner has permissions on. Fill in **Description** and click **Create application**. **3. Save the credentials** The dialog "Save the credentials" shows the **Client ID** and the **Client secret**. The Console shows the client secret only when you create the application. Store it then. Click **I've saved them** to close the dialog. Partner applications do not appear in **Settings → Applications**. They appear only on the partner's **Applications** tab. ## Change a partner *** Open the partner from the list. The detail page has five tabs: | Tab | What you do there | | - | - | | **Overview** | Rename the partner, change its **Validity window**, suspend or reactivate it, and delete it. | | **Permissions** | Add or remove products, resources, and actions. | | **Scope** | Add, change, or remove restrictions. Click **Add restriction** and choose the item under **Restrict by**. | | **IPs** | Give the partner its own list, change it, or go back to **Use your organization's list**. | | **Applications** | Create and delete the partner's applications. | Saving on **Permissions** or **Scope** replaces the permissions and the scope together. ## Suspend or reactivate a partner *** On the **Overview** tab, click **Suspend** and confirm. This deletes nothing. To end the suspension, click **Reactivate** and confirm. Suspending a partner in Access Manager stops its access, including the tokens it already holds. Reactivating the partner inside its validity window restores access with the same credentials. ## Delete a partner *** You can delete only a partner without applications. **1. Delete its applications** On the **Applications** tab, delete each application of the partner. Deleting an application stops its tokens from working. **2. Delete the partner** On the **Overview** tab, under **Delete partner**, click **Delete** and confirm with **Yes, delete it**. Access Manager also deletes its permissions, scope, and IP list. You cannot undo this. If the partner still has applications, the Console lists them and offers **Go to Applications**. ## Partners that use your tenant's IP list *** When some partners have no IP list of their own, **Settings → Security** shows a notice on the **IP allowlist** tab. The notice says how many partners use your tenant's list, and its button lists them. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.