Administration
Account administrators are identified by username in {admin, Name} and auth_admins. A live login session establishes which administrator is making a request; the configuration supplies the authority to act on other accounts. Changes to that list apply on the next API call. The administrator PKI key file is a separate identity and does not grant this role.
Allowlisted users see User administration on /account. The panel lists users 100 per page, with status, provider logins, whether a password is set, and how many sessions are active.
Every change needs your live session, a fresh authenticator code, and a reason of 3 to 512 bytes:
{"user":"target","otp":"123456","reason":"support case 123"}mesgd refuses a change aimed at your own account. The calls are in Administration API.
| Action | What happens to that person |
|---|---|
| Create | Reserves the username and returns an invitation handoff. They choose a password and enroll an authenticator. You do not see the authenticator secret |
| Disable | Blocks password login, OAuth login, recovery, and existing sessions |
| Enable | Allows login again. Sessions that were ended stay ended. An account disabled during invitation or recovery needs a new recovery code |
| Revoke sessions | Ends all of that user's mesgd sessions |
| Unlock | Clears the failure lockout. A disabled account stays disabled |
| Recover OTP | After you have verified identity, invalidates the old authenticator, recovery codes, and sessions, and returns a ten-minute handoff. See Recovery |
| Remove | Clears the password, authenticator, recovery codes, sessions, and public keys. The username and the provider identity stay reserved so public signup cannot take them. This is not a personal-data erasure |
From the node shell, mesgd user can do the same account actions. hard-reset is the extra one: it drops the reservation and the provider links and enrolls new credentials. Grants and other properties stay. There is no HTTP route for hard-reset. See Command line.
Older metadata-only users can appear in the list. Credential operations apply after the account has credentials.
GET /auth/admin/audit returns the latest 200 administrator events. mesgd keeps 1000. Each event has actor, target, action, time, and reason, and no secrets.
Message access, on the same admin panel and on the console, is a different job. It stores path patterns, roles, and assignments, and it issues a one-hour routing token. See Grants.