Roles & permissions
Lunar API's five roles, their priority levels, and the rules for ban, role, and username changes.
Roles and permissions
Every account has a role. Roles are ranked by an integer priority; higher priority unlocks more routes and grants authority over lower-priority users.
| Role | Priority | Capabilities |
|---|---|---|
user | 0 | Default for new accounts. Authenticated routes such as /images/*. |
support | 1 | Everything user can do, plus GET /admin/user/search. |
moderator | 2 | Same as support. |
admin | 3 | Ban, list users, edit role, edit username, and all /admin/s3/* routes. |
owner | 4 | Same as admin. |
Permission rules
Admin actions compare the actor's priority against the target's priority:
- Ban (
canBan) — the actor's priority must be strictly greater than the target's. You cannot ban yourself. - Change role (
canChangeRole) — the actor's priority must exceed both the target's priority and the priority of the new role. Admin-on-admin and owner-on-owner edits are refused. - Change username (
canChangeUsername) — the same rule as ban, plus the same admin-on-admin / owner-on-owner refusal.