Skip to main content

Admins

The current source filters Admins to user level 0 and exposes authenticated identity and account-action surfaces. This page documents those source contracts without reading personal data or changing an account, credential, role, session, or assignment.

Source-only access boundary

The /users/admins route allows level 0. Its Users sidebar parent also excludes read-only account types. Route and menu visibility do not establish API permission or deployed behavior.

Source-defined list​

  1. The page fixes the list filter to Administrator (level 0).
  2. Query state can include active state, pagination, identity/contact search, and additional filters.
  3. Selecting a row can request profile and related account data.
Admins list controls with Active and Inactive account views

Read and privacy boundary​

Fixed source requests fields that can include names, contact details, addresses, birth date, photo, verification state, order count, enabled state, wallets, and push tokens. No list or detail request was executed; GET is not presumed safe by verb.

The general detail menu can expose:

  • Profile
  • Saved places
  • Orders

The panel does not provide the Business owner Businesses tab. It can expose Push tokens on Enterprise projects and School students when the school module is enabled.

Persistent action boundaries​

Account controls are writes

The list and detail enabled-state controls submit an immediate user update. Confirmation UI does not make the operation safe or prove the resulting access state.

API source can reject protected-user changes. It also restricts self-level change and administrator deletion, and can block deletion through project configuration.

Profile, credential, and session boundary​

The shared editor can expose configuration-driven profile, contact, timezone, password, image, enabled-state, and role fields. API source validates identity changes; password updates can alter session strategy and revoke other stored sessions. No values or sessions were inspected and no update was sent.

Deletion and disclosure boundary​

The detail panel can offer Custom fields and can omit Delete for the signed-in Administrator. List source also contains export and bulk-delete surfaces. Deletion can mutate stored identity fields before soft deletion; export can disclose personal data. None is authorized for documentation validation.

Re-entry required​

Positive operational guidance requires immutable Dashboard/API serving receipts and an approved synthetic level-0 fixture with PII, credential, session, role, deletion, export, and outbound effects intercepted. Until then, all reads and writes remain unverified.