Users & Permissions

User Types

Superuser

A superuser has unrestricted access to all panel features. The initial admin created during installation is a superuser. Superusers can:

• Manage all websites (not just their own)
• Access all settings, including PHP installation, web server switching, mail settings
• Enable/disable plugins
• View the activity log
• Manage other users

Regular User

Regular users have access controlled by a granular permission set. You can scope a user to specific websites and specific operations.

Permissions

Each user has a set of boolean permission flags:

Permission	Description
websites_management	View and manage websites (files, databases, DNS, stats)
websites_create	Create new websites
websites_administration	Advanced website ops: delete, duplicate, change domain, SSL, SSH keys, backups, cron jobs, ACL
administrative_operations	Server-level ops: PHP management, network stats, Redis, MySQL admin, MongoDB admin
firewall_management	Manage CSF firewall rules, ports, countries
plugins_management	Manage replication servers
booting_users_management	Create, edit, delete other panel users

Website Access Control

In addition to global permissions, website access can be scoped per-user:

• Grant access: POST /api/webapps/:id/access { user_id } - gives a user access to a specific website
• Revoke access: DELETE /api/webapps/:id/access/:uid

A user with websites_management but no explicit website grants will see all websites (admin behaviour). If any website grants exist for a user, they see only their assigned websites.

API Keys

Every user can have multiple API keys for programmatic access:

# Create an API key
curl -X POST https://<server>:2087/api/users/<uid>/api-keys \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{"name": "my-script"}'

API keys authenticate using the same Bearer token mechanism as session tokens.

Two-Factor Authentication (2FA)

TOTP-based 2FA is available per user:

• GET /api/auth/2fa/setup - returns a QR code / secret
• POST /api/auth/2fa/enable { "code": "123456" } - activates 2FA
• POST /api/auth/2fa/disable { "code": "123456" } - deactivates 2FA

When 2FA is enabled, login returns a requires_2fa: true flag and the client must POST the TOTP code to complete authentication.

Sudo (System Shell Access)

Superusers can grant individual panel users shell (terminal) access via:

• GET /api/users/:uid/sudo - check sudo status
• POST /api/users/:uid/sudo { "enabled": true } - grant/revoke

User Management API

# List users
GET /api/users

# Create user
POST /api/users
{
  "username": "john",
  "password": "secret",
  "email": "[email protected]"
}

# Update user
PATCH /api/users/:uid
{ "email": "[email protected]" }

# Delete user
DELETE /api/users/:uid

# Set permissions
POST /api/users/:uid/permissions
{
  "websites_management": true,
  "websites_create": true,
  "websites_administration": false,
  "administrative_operations": false,
  "firewall_management": false
}

All user management endpoints require the booting_users_management permission.