Enter a keyword to search published documentation.
mywebdrive
User Administration
Look up users, adjust roles and quota, and understand what management operations are currently available.
Confirm identity and target
Only server-recognized administrators can use /admin/users and administrative APIs. 401 means invalid authentication; 403 means the identity isn't an administrator. Editing browser state or token contents can't grant authority.
GET /api/v1/admin/users supports query or q, page, and pageSize, defaulting to 20 records and allowing at most 100. Read an individual record with GET /api/v1/admin/users/{userId}. Act on an explicitly checked userId, not list position or a similar-looking email.
Inspect files and limits
Details help confirm role and space usage. GET /api/v1/admin/users/{userId}/files lists the specified user's files with cursor pagination. Permission to inspect records isn't ownership permission to share or publish them.
Change quota with PATCH /api/v1/admin/users/{userId}/quota and string limitBytes. The server rejects limits below committed plus reserved usage. Read before changing and reread afterward. Missing values, null, and failed requests aren't zero. See Quota.
Change roles
PATCH /api/v1/admin/users/{userId}/role accepts {"role":"user"} or {"role":"admin"}. This changes permissions, so verify the target and purpose first. Reread the user details afterward and have the affected user re-enter the administrative page as appropriate.
CORE_ADMIN_EMAILS selects the initial admin role when a user is first created. It doesn't overwrite an existing user's role on each login. Changing that environment list alone doesn't prove an existing role changed.
Operations not exposed here
The active user routes have no general delete-user, suspend/reactivate, password-reset, or all-device logout management API. A status field in the database doesn't expose its whole lifecycle. Archived management instructions and demonstration components aren't evidence of currently available operations.
A server-side permission change doesn't erase information already obtained by browsers. Avoid putting user emails, file records, cookies, or authorization values into screenshots or public reports. Report operation type, redacted status, time, and sanitized correlation identifiers.
Verify administration safely
Use disposable local state and dedicated test accounts for queries, pagination, and quota conflicts. A role change affects later permission checks—avoid experimenting on the only administrator account. Read Dashboard and Notifications for the other administrative domains.