Enter a keyword to search published documentation.
mywebdrive
User Administration
Inspect users and change roles or quota while respecting the active administrative boundary.
Confirm identity and target
Only server-recognized administrators can use /admin/users and administrative APIs. 401 means invalid authentication; 403 means the identity is not an administrator. Editing browser state or token contents cannot grant authority.
GET /api/v1/admin/users supports query or q, page and pageSize, defaulting to 20 records and allowing at most 100. Read an individual record with GET /api/v1/admin/users/{userId}. Act on an explicitly checked userId, not list position or a similar-looking email.
Inspect files and limits
Details help confirm role and space usage. GET /api/v1/admin/users/{userId}/files lists the specified user's files with cursor pagination. Permission to inspect records is not ownership permission to share or publish them.
Change quota with PATCH /api/v1/admin/users/{userId}/quota and string limitBytes. The server rejects limits below committed plus reserved usage. Read before changing and reread afterward. Missing values, null and failed requests are not zero. See Quota.
Change roles
PATCH /api/v1/admin/users/{userId}/role accepts {"role":"user"} or {"role":"admin"}. This changes permissions: verify the target and purpose first. Reread the user details afterward and have the affected user re-enter the administrative page as appropriate.
CORE_ADMIN_EMAILS selects the initial admin role when a user is first created. It does not overwrite an existing user's role on each login. Changing that environment list alone does not prove an existing role changed.
Operations not exposed here
The active user routes have no general delete-user, suspend/reactivate, password-reset or all-device logout management API. A status field in the database does not expose its whole lifecycle. Archived management instructions and demonstration components are not evidence of currently available operations.
A server-side permission change does not erase information already obtained by browsers. Avoid putting user emails, file records, cookies or authorization values into screenshots or public reports. Report operation type, redacted status, time and sanitized correlation identifiers.
Verify administration safely
Use disposable local state and dedicated test accounts for queries, pagination and quota conflicts. A role change affects later permission checks; avoid experimenting on the only administrator account. Read Dashboard and Notifications for the other administrative domains.