Kestrel

Guide

IT

Version 1.0 ·Updated 2026-09-17

Next reviewed by 2027-03-17.

Written for each member of a school's staff, from the registrar to IT, and the families using the portal.

For IT, who administers the system without reading the record: who holds which role, sign-in, integrations and devices.

All guides, including the first steps each member of staff takes. The training for this role takes these tasks in sessions.

Give somebody a role

Settings, "Staff accounts"

It's under Settings, which only an administrator can open.

  1. Open Settings from your initials and choose "Staff accounts".
  2. Press "Roles" on the person's row, tick the roles they hold, and press "Save the roles".
  3. Press "Make an administrator" only for somebody who changes the school's settings.

Compose a role of the school's own

Settings, "Roles"

Needs tenant.settings.write. It's under Settings, which only an administrator can open.

  1. Press "Compose a role", and fill "Name", "Title" and "Why this set".
  2. Tick the capabilities the role has under each area of the record.
  3. Press "Save the role".

Connect the school's directory

Settings, "Directory"

Needs tenant.settings.write. It's under Settings, which only an administrator can open.

  1. Choose the "Directory" and the "Protocol", and fill the "Button label".
  2. Fill the client ID and secret for OpenID Connect, or the sign-on address, entity id and certificate for SAML 2.0.
  3. Tick "Offer this directory on the sign-in screen" and press "Save".
  4. Under "Groups", press "Add a group", map it to a standing and roles, and press "Save groups".

Issue an API token

Settings, "API tokens"

Needs tenant.settings.write. It's under Settings, which only an administrator can open.

  1. Under "Issue a token", fill "What it is for" and "How long it lasts".
  2. Tick only the scopes the integration needs, and press "Issue token".
  3. Press "Copy". The secret is shown once. Press "Revoke" once the integration stops.

Pair a kiosk

Settings, "Kiosks"

Needs tenant.settings.write. It's under Settings, which only an administrator can open.

  1. Under "Issue a kiosk", fill "Name" and press "Issue the credential".
  2. Press "Copy". The credential is shown once.
  3. On the device, open the address shown under "Open on the device", paste the credential and press "Pair this kiosk".

Connect the timetabling engine over LISS

Settings, "LISS"

Needs tenant.settings.write. It's under Settings, which only an administrator can open.

  1. Under "Issue a credential", fill "Name" and press "Issue credential".
  2. Copy the "Endpoint", "School", "UserName" and "Password" into the engine. The password is shown once.

Set the bells and rooms

Settings, "Bells and rooms"

Needs timetable.structure.write. It's under Settings, which only an administrator can open.

  1. Press "Add bells", fill "Name" and "Days in the cycle", and press "Add a period" for each period.
  2. Press "Save the bells".
  3. Under "Rooms", press "Add a room", fill "Code", "Name", "Kind" and "Seats", and press "Save the room".

Design and publish a form

Settings, "Forms"

Needs forms.definition.write. It's under Settings, which only an administrator can open.

  1. Press "Start a form", fill "Key" and "Title", choose "Who fills it in", and press "Start it".
  2. Press "Add a question" for each question, and fill "Label", "Type" and "Tier".
  3. Press "Save the draft", check the "Preview", then press "Publish this version".