Graticula

Folders

Folders

Services

⋯
Picture Service Type Folder Status Actions

Content

What you own, and what other people have shared with you.

Filter

TitleTypeShared withActions

Publish a service

Compose a service from tables in the databases this server is pointed at, then publish it. Nothing is served until you press Publish, and a service is published whole — its layers and its groups arrive together or not at all.

Add a table to publish
Contents drawing order
Preview
Databases

Data sources

Databases and folders this server reads layers from. Only administrators register one, because a source holds the credentials to someone else's database.

NameConnectionLayers
What registering does

A PostGIS database this server reads from, or a folder of GeoParquet files it reads in place. Registering a database stores the credential, sealed, because the server connects again every time somebody opens a map on it; a folder stores only its path. Nothing is published by registering: you choose the tables or files afterwards, in Publish a service.

Map

What every new map in this organization starts on, and the basemaps it offers.

Basemap gallery

The group whose vector tile services (in Web Mercator) and web maps appear as basemaps in Map Viewer, ArcGIS Pro and Maps SDK apps, as an ArcGIS Enterprise basemap gallery does. Anybody who can share into the group can add one.

Default basemap

What a new map starts on.

No unsaved changes

Utility services

This server's own services, which every organization on it uses, and the geometry service ArcGIS clients are pointed at.

ServiceStatusWho can reach it Actions
Reading this server's own services…

Geometry service

The geometry service ArcGIS clients signed in to this portal use for measuring, buffering and projecting — what Portal's clients read from it. Leave it empty to use this server's own. Name another, such as an ArcGIS Server's, and clients use that one instead; it answers them under its own sharing. ArcGIS Enterprise has this under Organization › Settings › Utility services › Geometry.

Machines

The servers that share this site's database and serve its requests together. Each one says it is alive every ten seconds; one not heard from for thirty is shown down.

MachineStatusRuns Actions
Reading the machines…

Backups

Copies of this server's whole database — every organization, its content and its settings — with its imagery and its certificate, taken while it serves.

TakenSizeServer versionActions
Reading the backups…

Daily schedule

In UTC, the server's clock; your own time is beside it. A day that already has a backup is skipped.

backups

1 to 365. After each scheduled backup the older ones are deleted. Backups you took by hand count too.

Before you rely on one

  • Copy it elsewhere. A backup on this server's own disk is lost with the disk. Download it, or set Graticula:BackupPath to storage that is somewhere else.
  • The secret key is not in it. Only a server with the same key can restore it, so store the key separately and as safely.
  • Restore with the server stopped: graticula restore name. It replaces the database this server uses, which is why this page has no Restore button.

General

What this organization is called and what it says about itself.

Name and description

Where its people sign in

    Partnered collaborations

    Partner with another organization on this server so that your groups and theirs can take each other's members. Each organization keeps its own members and content, and each decides whether the other may search for its members.

    Reading this organization's collaborations…

    Start a collaboration

    The host name its people sign in at, or its key if its administrator gave you that. A pasted address works too. Its administrator accepts or declines the invitation in their own Collaborations page.

    Member visibility

    Accept the invitation

    Member visibility

    Either choice can be changed later, here.

    End the collaboration

    Groups this changes

      Webhooks

      Tell another system — an integration server, Power Automate, Make, FME — when items, groups, members or roles of this organization change. Each webhook posts a JSON message to its payload URL, signed if it has a secret.

      Reading this organization's webhooks…

      General

      What this whole server does unless a service sets its own: the page size, the sources styles may use and the ground under every map. Basemaps and how people sign in are Studio's, under Organization › Settings, and each organization's own.

      Query results

      How many features a query returns when it does not ask for a number, and the most it returns when it does — ArcGIS's maxRecordCount, which every service document gives. Larger pages mean fewer requests and heavier responses. A service that sets its own page size in its Parameters tab keeps it; empty here means the server's default.

      features

      Style sources

      Other servers a vector tile style may fetch tiles, fonts or icons from, such as a basemap vendor. A style is fetched by every viewer's browser, so only an administrator decides where it may send them. Write each as https://host, https://host:port or https://*.host for every name under a host. With none listed, a style may use only this server's own resources.

      Map ground

      Your own vector tile services, such as an OpenStreetMap extract you imported, drawn under the data when an organization's default basemap is Your own tile services. With none chosen, OpenStreetMap's public tiles are drawn. People who chose their own ground in the viewer keep it.

      Drawing order, top first

        Tile services on this server
        Reading this server's tile services…

        No unsaved changes
        No unsaved changes

        Status

        Whether anything is wrong with this server right now, and where.

        Reading the services…

          Platform store

          If the store goes down, layers shared with everyone keep answering for a while and everything else is refused.

          Runtime

          This process, now. Time in garbage collection is the figure that limits how much load it takes.

          Caches

          Who may read a service, and whether it is started, are never cached.

          Datastore

          Sizes as PostgreSQL reports them. No quota is set.

          Route governance

          Every address this server answers has a rule that decides who may reach it. The figure to watch is without a rule, which should be zero.

          Every route this server answers
          RouteMethodsWho may reach it

          Logs

          What this server and its studio have been doing.

          About these logs

          When What Who From Resource

          Organizations

          Each organization is a portal of its own on this server, with its own members, groups and content, reached at its own host name. A host name works once DNS points it at this server and the server's certificate covers it.

          OrganizationHost namesStatusOrganization ID Actions

          New organization

          The first is the address its people sign in at. Each needs a DNS record that points at this server, and a certificate that covers it.

          A new account, made inside the organization. The name must not be in use anywhere on this server. The server picks the password and shows it to you once.

          Organization created

          This password is shown only now. Copy it and give it to . It has to be changed the first time they sign in.

          Remove organization

          Groups

          A set of members, and the services shared with them. What is shared with a group is readable by its members and by nobody else.

          New group

          What people see in lists, for example Flood response team.

          What members may do with items shared into it

          This choice is permanent. To change it later, make another group and move the shares to it.
          GroupMembers mayYou areOwner MembersItems

          Member roles

          What members may do. Every role's privileges can be changed except the administrator's, whose authority is a property of the server rather than a set of rows.

          New role

          It starts granting nothing; its privileges are chosen beside the list once it is made, or copied from another role there.
          RoleActions

          Security

          How people sign in to this organization, and which apps may sign them in.

          Require two-step sign-in?

          New service account

          Never the administrator role: a machine does not administer. Whatever its role says, it cannot create content, publish, register data or make groups.

          Key created

          This key is shown only now. The server keeps only a fingerprint of it, so it cannot be shown again. Copy it into the script or the app that uses it.

          Send it as an ArcGIS token: token= or Authorization: Bearer. The Maps SDK takes it as apiKey, and the ArcGIS API for Python as api_key.

          Client secret created

          This secret is shown only now. The server keeps only a fingerprint of it, so it cannot be shown again. Copy it into the app that uses it, with the client ID.

          The app posts both to /sharing/rest/oauth2/token with grant_type=client_credentials, as ArcGIS app credentials are, and sends the token it gets back. The secret itself is not a token.

          Sign-in

          Where people can sign in besides a password on this server: an OpenID Connect or SAML 2.0 provider such as Microsoft Entra ID, AD FS, Keycloak, Okta or Google, or an LDAP directory such as Active Directory. Their groups there can decide their role and groups here.

          Add a provider

          ProviderAddressFirst sign-inAccounts Actions

          Apps

          Apps that sign people in to this server through OAuth — a web app with an app ID, or ArcGIS Field Maps. A person signs in on this server's own page, and the app receives a code only at an address registered here.

          Register an app

          An address must be https://, http://localhost, a custom scheme such as my-app://auth/, or urn:ietf:wg:oauth:2.0:oob. A code is never sent anywhere else.

          AppApp IDReturns toActions

          Members

          Who has an account, and what each of them may do.

          New member

          The server picks the password, not you. You see it once, on this screen, and you pass it on. It is marked as needing replacement, so their first act after signing in has to be setting their own — nothing else answers until they do. There is no invitation e-mail because this server cannot send a message at all.

          Filter

          Filters
          Categories
          Role
          User type
          Status
          Last login
          Group
          Actions

          Removing a member asks what happens to what they own; disabling stops their sign-in and leaves everything they own where it is.

          New domain

          Profile photo

          Drag and drop a JPG, PNG or GIF file.

          For best results, the image should be 200 × 200 pixels, and at most a megabyte.

          Categories

          Change role

          —

          Update data

          Create view

          Create scene layer

          Analyze

          Folder

          Change owner

          Share

          Share

          Export data

          Share

          New item

          Publish

          Symbol

          Map properties

          Every layer is drawn and served in this. Leave it empty and the service serves each layer in whatever its own table is stored in.

          Pause a database

          Rename

          Are you sure?

          Create webhook

          Where each message is posted: the full address, starting with https://, of a receiver on the internet. An address on this server's own network (private, loopback or link-local) is refused unless the administrator allows such addresses with Graticula:WebhooksAllowPrivate; plain http:// is then accepted too, but only for those addresses. No user name or password in the address, and a redirect is not followed.

          Signs every message: the receiver checks the x-esriHook-Signature header, an HMAC-SHA256 of the body under this secret. It is never shown again.

          Events

          Database connection

          —

          The password the server issued:

          This is the only time it is shown. Nothing on this server can retrieve it again — closing this without copying it means issuing another one.