# Users, roles and permissions

> Create and edit FeatherPanel users, ban accounts, find alt accounts, send SSO login links, and build roles from permission nodes.

Source: https://featherpanel.com/docs/admin/users-and-roles/

## Users

Admin area, Users lists every account with its role, status, sign-in type (Local, LDAP or OIDC/SSO), 2FA and Discord
badges, and when it was last seen. Filter by role, status (active or banned), email verification or IP, and sort by
creation date, activity, username or email.

**Create User** needs a username (3 to 32 letters, numbers or underscores), first and last name, email and a password of
at least 8 characters. The email domain is checked against [blocked email domains](https://featherpanel.com/docs/admin/security).

### Editing a user

The edit page has these sections:

- **User Details.** Name, email, role, WebSpace limit, external ID for integrations, and a new password (leave blank to
  keep the current one).
- **Account Information.** User ID, UUID, first and last IP, linked Discord account. Ban IP blocks new registrations
  from the user's IP.
- **Actions.** Ban or unban, disable 2FA, unlink Discord.
- **Single Sign-On.** Generate SSO Link creates a login link for this user. It lasts 5 minutes by default
  (`app_sso_token_lifetime_minutes`, 1 to 1440) and lands on `app_sso_redirect_path`.
- **Direct Email.** Send an HTML email to the user. Sent mail appears under Mails, where failed mail can be resent.
- **Servers, VDS, Activities** for this user.
- **Potential Alts.** Other accounts that share IP addresses or browser sync IDs with this one, with a confidence
  score. Matches are a hint, not proof.

Force verify email, on the user list, marks the address verified so the user can log in without the link.

### Banning

Banning needs a reason for staff, and the user is notified by email. The panel also stops and suspends every WebSpace the user owns.
Unbanning restores access and sends an email.

### Alt detection

The panel records browser fingerprints and IPs. Clear device fingerprints on a user lets them register again from the
same device. On the user list, Clear all device fingerprints and Reset alt detection for all users wipe that data for
everyone. A reset also ignores all IP evidence recorded before it. Activity logs are kept.

### Deleting

A user who owns servers, VDS instances or WebSpaces, or has an active subscription, cannot be deleted (HTTP 409).

## Roles

Admin area, Roles. A role has a display name, an internal name generated from it, an optional badge label and icon
(JPG, PNG, GIF or WebP up to 5 MB) and a color. Save the role first, then open the Permissions tab to grant permission
nodes. The tab groups them by category, with Enable all and Disable all per category and a search box. Duplicate copies
an existing role.

`admin.root` grants everything. It shows as Locked on your own role so you cannot take it away from yourself.

Built-in roles: Admin (1), Moderator (2), User (3) and Banned (4). They can be edited but not deleted. Every permission
node is listed in the [permission reference](https://featherpanel.com/docs/reference/permissions).

## API keys

Admin area, API Keys opens the same API client manager as the account page (`/api/user/api-clients`): the keys belong
to your account and act with your permissions. See [API authentication](https://featherpanel.com/docs/api/authentication).

## API

| Method | Path | Permission |
| --- | --- | --- |
| GET | `/api/admin/users`, `/api/admin/users/{uuid}` | admin.users.list |
| GET | `/api/admin/users/external/{externalId}` | admin.users.list |
| PUT | `/api/admin/users` | admin.users.create |
| PATCH | `/api/admin/users/{uuid}` | admin.users.edit |
| DELETE | `/api/admin/users/{uuid}` | admin.users.delete |
| POST | `/api/admin/users/{uuid}/ban`, `/unban`, `/verify-email`, `/sso-token`, `/send-email` | admin.users.edit |
| GET | `/api/admin/users/{uuid}/potential-alts` | admin.users.list |

## Frequently asked questions

### Why can I not delete a user?

A user who still owns servers, VDS instances or WebSpaces, or has an active subscription, cannot be deleted. Move or remove those first.

### Can I lock myself out by editing my own role?

The panel stops you from removing admin.root from the role you are using, both in the editor and in the API.

### Which roles cannot be deleted?

The four built-in roles, Admin, Moderator, User and Banned (IDs 1 to 4).