Admin routes

User administration: ban, search, list, dashboard, and edit role or username. Requires elevated roles.

Admin routes

All admin routes require Authorization: Bearer <accessToken> and pass through requireAuth. Routes that need elevated privileges also enforce a role allow-list, returning 403 for anything below the threshold. See Roles & permissions.

Ban a user

POSThttps://api.lunargroup.dev/admin/banAuth required
Ban a user. Requires admin or owner.

Provide userId, username, or both. You cannot ban yourself or any account whose priority is greater than or equal to yours.

Body
userId
stringoptional
The target user's ID. Required if username is omitted.
username
stringoptional
The target username. Required if userId is omitted.

Response 200:

{
  "status": 200,
  "message": "User winter_fe has been banned",
  "user": {
    "id": "user_id",
    "username": "winter_fe",
    "role": "user",
    "banned": true
  }
}

Errors:

{ "status": 400, "message": "userId or username is required" }
{ "status": 400, "message": "You cannot ban yourself" }
{ "status": 400, "message": "User is already banned" }
{ "status": 403, "message": "You do not have permission to ban this user" }
{ "status": 404, "message": "User not found" }
{ "status": 500, "message": "Failed to ban user" }

Search for a user

Requires support, moderator, admin, or owner. Provide one of userId or username as a query param.

Query
userId
stringoptional
Look up by ID. One of userId or username is required.
username
stringoptional
Look up by username. One of userId or username is required.
GET /admin/user/search?username=winter_fe
GET /admin/user/search?userId=user_id

Response 200:

{
  "status": 200,
  "user": {
    "id": "user_id",
    "username": "winter_fe",
    "role": "user",
    "banned": false,
    "createdAt": "2026-03-30T12:00:00.000Z",
    "updatedAt": "2026-03-31T08:15:00.000Z",
    "collection": "users"
  },
  "requests": {
    "id": "requests_id",
    "auth": 5,
    "admin": 0,
    "images": 12,
    "total": 17,
    "createdAt": "2026-03-30T12:00:00.000Z",
    "updatedAt": "2026-03-31T08:15:00.000Z",
    "collection": "requests"
  }
}

Errors:

{ "status": 400, "message": "userId or username is required" }
{ "status": 404, "message": "User not found" }

List all users

GEThttps://api.lunargroup.dev/admin/usersAuth required
List every user keyed by username, each with their counters. Requires admin or owner.

Response 200:

{
  "status": 200,
  "users": {
    "winter_fe": {
      "user": {
        "id": "user_id",
        "username": "winter_fe",
        "role": "user",
        "banned": false,
        "createdAt": "2026-03-30T12:00:00.000Z",
        "updatedAt": "2026-03-31T08:15:00.000Z",
        "collection": "users"
      },
      "requests": {
        "id": "requests_id",
        "auth": 5,
        "admin": 0,
        "images": 12,
        "total": 17,
        "createdAt": "2026-03-30T12:00:00.000Z",
        "updatedAt": "2026-03-31T08:15:00.000Z",
        "collection": "requests"
      }
    }
  }
}

Users dashboard

GEThttps://api.lunargroup.dev/admin/users/dashboardAuth required
Flat row layout plus aggregate totals, optimised for dashboard tables. Requires admin or owner.

Response 200:

{
  "status": 200,
  "summary": {
    "totalUsers": 42,
    "bannedUsers": 1,
    "totalRequests": 9001,
    "adminRequests": 120,
    "authRequests": 350,
    "imageRequests": 8531
  },
  "users": [
    {
      "id": "user_id",
      "username": "winter_fe",
      "role": "user",
      "banned": false,
      "createdAt": "2026-03-30T12:00:00.000Z",
      "updatedAt": "2026-03-31T08:15:00.000Z",
      "collection": "users",
      "requestsId": "requests_id",
      "auth": 5,
      "admin": 0,
      "images": 12,
      "total": 17,
      "requestsCreatedAt": "2026-03-30T12:00:00.000Z",
      "requestsUpdatedAt": "2026-03-31T08:15:00.000Z",
      "requestsCollection": "requests"
    }
  ]
}

Edit a user's role

POSThttps://api.lunargroup.dev/admin/user/edit/roleAuth required
Change a user's role. Requires admin or owner.

Refuses admin-on-admin and owner-on-owner edits, and refuses to promote a user above your own priority.

Body
userId
stringoptional
Target user ID. One of userId or username is required.
username
stringoptional
Target username. One of userId or username is required.
role
stringrequired
One of user, support, moderator, admin, owner.

Response 200:

{
  "status": 200,
  "message": "User winter_fe has been changed to support",
  "user": {
    "id": "user_id",
    "username": "winter_fe",
    "role": "support",
    "banned": false
  }
}

Errors:

{ "status": 400, "message": "userId or username is required" }
{ "status": 400, "message": "role is required and must be a string" }
{ "status": 400, "message": "Invalid role provided" }
{ "status": 400, "message": "You cannot change your own role" }
{ "status": 403, "message": "You do not have permission to change this user's role" }
{ "status": 404, "message": "User not found" }
{ "status": 500, "message": "Failed to update user role" }

Edit a user's username

POSThttps://api.lunargroup.dev/admin/user/edit/usernameAuth required
Change another user's username. Requires admin or owner.

Same admin-on-admin / owner-on-owner restrictions as role edits.

Body
userId
stringoptional
Target user ID. One of userId or username is required.
username
stringoptional
Target's current username. One of userId or username is required.
newUsername
stringrequired
The new username. 3–32 chars matching ^[a-zA-Z0-9_.-]+$.

Response 200:

{
  "status": 200,
  "message": "User username has been changed to new_name",
  "user": {
    "id": "user_id",
    "username": "new_name",
    "role": "user",
    "banned": false
  }
}

Errors:

{ "status": 400, "message": "userId or username is required" }
{ "status": 400, "message": "newUsername is required" }
{ "status": 400, "message": "Invalid username format. Must be 3-32 characters with only alphanumeric, underscore, hyphen, or dot" }
{ "status": 400, "message": "You cannot change your own username" }
{ "status": 403, "message": "You do not have permission to change this user's username" }
{ "status": 404, "message": "User not found" }
{ "status": 409, "message": "Username already exists" }
{ "status": 500, "message": "Failed to update user username" }