A tour of the Versus web console — the collapsible sidebar, the workspace switcher that reshapes the menu per module, global search, favorites, per-user defaults, and how role and license gating decide what you see.
The Versus console is a single-page web application: one origin, one login, and a layout that stays put while the content underneath it changes. This page is a tour of that shell — the sidebar, the workspace switcher, the header, and the search-and-favorites tooling — so you know where things live and why the menu looks different for you than for the operator sitting next to you.
Everything here is presentation. The console never talks to the database or to your devices directly; it speaks only to the versioned REST API, and the API is the final authority on what any action is allowed to do. The navigation simply tries not to offer you doors that are already locked. See Platform Architecture for the layers beneath the UI.
Three regions frame every screen:
Collapse the sidebar with the toggle in the header or the chevron next to the logo. Collapsed, it shows icons only and reveals labels on hover; expanded, it shows the full tree. The footer of an expanded sidebar reads Network Automation Platform · v2.0.
A workspace is a curated slice of the platform built around one job. Rather than one giant flat menu, the sidebar shows the items for the workspace you're currently in, bracketed by a small set of items that are always present.
The console ships these workspaces:
| Workspace | What it covers |
|---|---|
| TLS Cert LCM | Certificate lifecycle — issuance, CA accounts, profiles, discovery, deploy jobs, internal CA |
| Application Delivery Controller | Local, global, and cloud traffic — virtual servers, pools, WideIPs, iRules, TLS profiles, policies |
| Firewall Policy | Firewall rules, PCI audit, access and change requests, and rule governance |
| Secret Vault | Secrets, enrollments, checkouts, rotation, reveals, and privileged sessions |
| Versus Desk | Service desk (incidents, problems, changes, requests), agile projects, and the knowledge base |
| IPAM / DDI | Networks, IP addresses, DNS zones and servers, and IPAM connections |
| Client End-point Security | Zscaler and CrowdStrike endpoint integrations |
| Versus Platform | The cross-cutting plane — inventory, collector fleet, integrations, App Builder, system settings, and tenant administration |
Versus Platform is deliberately set apart: in the switcher it sits on its own row beneath a divider, because it holds the platform-wide plumbing (inventory, collector fleet, integrations, licensing, users, and — for the right roles — tenant provisioning) rather than one functional domain.
Two groups of items appear in every workspace, so the things you reach for constantly never move:
So the sidebar you see at any moment is: the top-common items, then the selected workspace's items, then the common block — role and license permitting.
Click the workspace button at the top of the sidebar to open the switcher. It gives you:
Picking a workspace selects it and navigates you to that workspace's landing page — the first navigable item in its menu (for example, Application Delivery Controller opens on Cloud Traffic). Your selection is remembered across reloads.
You don't have to use the switcher to change context. When you follow a direct link, a global-search result, or a favorite into a page that belongs to another workspace, the sidebar quietly switches to the workspace that owns that route, so the active-item highlight and the surrounding menu stay coherent with where you actually are.
The console gives you three distinct ways to get somewhere, and they do different jobs.
The Filter menu… box under the workspace switcher searches the navigation tree. Type a few letters and the sidebar collapses to just the matching items, with the matched text highlighted. Crucially, the filter searches every workspace, not just the one you're in — each result is grouped under its workspace's heading — so an item in another workspace is never unreachable. Clear the box to return to the normal per-workspace view.
The Search anything… box in the header — or the ⌘K / Ctrl+K shortcut — searches your data, not the menu. It queries the API and returns live objects grouped by type:
GET /api/search/?q=<term>&limit=8
Results cover devices, virtual servers, certificates, WideIPs, and firewall rules, each with a name, a subtitle, and a status badge. Use the arrow keys to move, Enter to jump straight to the object's page, and Esc to close. This is how you go from "I need that one VIP" to its detail page without knowing which workspace it lives in.
Hover any leaf item in the sidebar and a star appears. Star it to pin it to the Favorites menu in the header — a flat, cross-workspace shortcut list for the handful of pages you live in. Favorites are per-browser and persist across sessions; unstar from either the sidebar or the favorites menu to remove.
Beyond search and favorites, the header carries a few per-session tools on the right:
Sign out performs a full OIDC single logout rather than just dropping local tokens: it ends your session at the identity provider and returns you to your organization's login page. Identity, SSO, and MFA are covered in OIDC / SSO and MFA & TOTP.
Two personalization settings live in your Profile:
Your workspace selection, recent list, default workspace, and favorites are stored client-side in your browser, so they follow your session on that machine without any server round-trip.
Two independent filters decide whether a given item — or an entire workspace — shows up for you. If either says no, the item is hidden.
Every menu item can declare a minimum role level, and you only see items at or below your own. Levels run:
| Level | Role |
|---|---|
| 5 | Super Admin |
| 4 | Network Admin |
| 3 | Operator |
| 2 | Viewer |
| 1 | Guest |
Your level comes from the API when the console loads your profile (GET /api/users/me/). A Viewer (2) sees read-oriented areas like the Network map; an Operator (3) gains most day-to-day workflow and vault operations; a Network Admin (4) sees system, integrations, and tenant admin; a Super Admin (5) additionally sees the control-plane tenant-provisioning tools. A workspace with no items you're allowed to see is dropped from the switcher entirely.
This is a UI convenience, not the security boundary — the API re-checks your role on every request regardless of what the menu offered. See Security & Compliance.
Several workspaces map to a licensed module, and the switcher hides any workspace your tenant isn't entitled to:
| Workspace | Module key |
|---|---|
| TLS Cert LCM | tls_clm |
| Firewall Policy | firewall |
| Secret Vault | secure_vault |
| Application Delivery Controller | adc |
| IPAM / DDI | ipam_ddi |
Versus Desk, Client End-point Security, and Versus Platform are Platform Core — they carry no module gate and always appear (subject to role). Entitlements are resolved from the API:
GET /api/tenants/my-entitlement/
{
"enforced": true,
"bundle": "Continuum",
"modules": ["adc", "firewall", "tls_clm", "ipam_ddi", "secure_vault"],
"plan": "standard",
"status": "active",
"expires_at": null,
"limits": {}
}
Modules can be licensed individually or as a bundle — Keystone, Perimeter, Fabric, or Continuum. The gate fails open: if entitlement enforcement is switched off, or the tenant has no entitlement on file, every module is treated as licensed and nothing is hidden. Self-hosted installs and demos therefore see the full menu by default. Licensing internals are described alongside the platform architecture.
The console shell is intentionally thin. Workspaces are just a way to organize the same API-backed pages into task-shaped groups; the switcher, filter, search, and favorites are all client-side conveniences layered on top. Nothing you see in the navigation grants access — role and entitlement checks are enforced server-side on every call, and the menu merely mirrors those decisions so you aren't offered dead ends.
That separation is what lets the same console serve a read-only Viewer, a hands-on Operator, and a Super Admin managing tenants, all from one build — and lets a hosted tenant and a self-hosted appliance run the identical UI while their menus differ only by license and role.