Administration API
The administration API lets an authorized operator manage other accounts through an application or the account UI. Requests require Authorization: Bearer TOKEN for a live session whose username appears in {admin, Name} or auth_admins. A valid session without that role receives 403 with {"error":"unauthorized"}; a missing session receives 401.
What each action does to the person is in Administration.
Mutations are POST with Content-Type: application/json. The common body is:
{"user":"target@example.com","otp":"123456","reason":"support case 123"}reason is 3 to 512 bytes. mesgd consumes your authenticator code. The target user's code is not accepted in its place.
| Method and path | Extra fields | What you get back |
|---|---|---|
GET /auth/admin/me | admin: true when you may open the panel | |
GET /auth/admin/users?after=USERNAME | users and next. next is null on the last page. Page size is 100 | |
GET /auth/admin/audit | Latest 200 events. 1000 are retained | |
POST /auth/admin/create | email | user, recovery_token, expires_in |
POST /auth/admin/disable | The named action | |
POST /auth/admin/enable | The named action | |
POST /auth/admin/revoke | Sessions revoked | |
POST /auth/admin/unlock | Lockout cleared | |
POST /auth/admin/remove | The username stays reserved | |
POST /auth/admin/recover | identity_verified: true | Handoff code |
The person redeems a handoff at POST /auth/recovery/enroll, which is public and is documented in Authentication.
Grant and sample routes use the same administrator session and are documented in Grants. Statistics routes are in Statistics.
From the node shell, and with no HTTP route, you can still run mesgd user hard-reset, mesgd user password, and mesgd_http_auth:bootstrap_admin/1. See Command line.