4 Where to go next
4.1 User Manual chapters by role
The User Manual is the complete reference. Start with the chapters for your role:
| Role | Chapters |
|---|---|
| Every user | Getting Started; Policy Management (Policy portal and acknowledgements); Security Awareness (Taking a test) |
| Data Liaison | Data Privacy (Data mapping questionnaires) |
| Risk owner | Risk Management (The risk detail page, Treatments, Reviews, Exceptions) |
| Control owner | Risk Management (Controls); Internal Audits (Working with findings) |
| Compliance manager | Compliance Management; Projects; Report Center |
| Policy owner or approver | Policy Management |
| Vendor or third-party risk manager | Third-Party Management; Online Assessments |
| Security operations | Incident Management |
| Data Protection Officer | Data Privacy; Incident Management (Personal data breaches); Third-Party Management (Data protection) |
| Internal auditor | Internal Audits; Account Reviews; Report Center |
| CISO or executive | Getting Started (The Dashboard); Report Center |
4.2 The Administrator's Guide
Read the Administrator's Guide to install and run TraxrGRC: deployment, the first administrator, sign-in with SAML SSO or LDAP, outgoing email, users, groups and roles, notification rules, branding, backups and the audit log.
Every Settings screen has a card on the Settings page, shown only to people who may open it. The Settings entry in the sidebar appears for anyone with at least one card: administrators see them all, and a GRC Manager, for example, sees Custom Fields, Notifications and Audit Log.
4.3 The REST API
Scripts and other systems can read and maintain records through the REST API
at /api/v1. The machine-readable OpenAPI document is served at
/api/v1/openapi on your installation and needs no token.
- A user with Create on API tokens (an administrator, by default) creates a
token at
/settings/api-tokens, with a name, an optional expiry date and the module scopes it may use. - The token, starting with
aat_, is shown once. Store it safely. - Send it in the
Authorizationheader:
curl -H "Authorization: Bearer aat_your_token_here" \
https://grc.example.com/api/v1/risks
A token acts as the user who created it, limited to its scopes, and every change it makes is recorded in the audit log.
Full details: User Manual, REST API.
4.4 Getting help
- A module or button is missing. Your role does not grant it. Ask your administrator which group to join.
- An email never arrived. Check that outgoing email is configured, and on My profile that you have not switched the rule or report off.
- You cannot sign in. Read the message under the form (see Signing in) and contact your administrator; they can reset a password, reset two-step verification after a lost device, or reactivate an account in Settings → Users.