# Handwrite Admin ## Docs - Root [Start here — staff console](https://docs.handwrites.io/admin/start-here-staff-console-2496399m0.md): - Root [Admin API specification notes](https://docs.handwrites.io/admin/admin-api-specification-notes-2496400m0.md): - Root [Admin socket specification notes](https://docs.handwrites.io/admin/admin-socket-specification-notes-2496401m0.md): - Root [Staff role and permission matrix](https://docs.handwrites.io/admin/staff-role-and-permission-matrix-2496403m0.md): - Root [Staff workflows and architecture](https://docs.handwrites.io/admin/staff-workflows-and-architecture-2496406m0.md): - Root [Admin source and validation status](https://docs.handwrites.io/admin/admin-source-and-validation-status-2496409m0.md): - Root > Customer accounts [README — GET /api/admin/accounts/{sub}/billing](https://docs.handwrites.io/admin/readme-get-apiadminaccountssubbilling-2496412m0.md): - Root > Customer accounts [README — GET /api/admin/accounts/{sub}/cloud/documents/{id}](https://docs.handwrites.io/admin/readme-get-apiadminaccountssubclouddocumentsid-2496415m0.md): - Root > Customer accounts [README — GET /api/admin/accounts/{sub}/cloud/documents](https://docs.handwrites.io/admin/readme-get-apiadminaccountssubclouddocuments-2496418m0.md): - Root > Customer accounts [README — POST /api/admin/accounts/{sub}/cloud/keys/{keyId}/revoke](https://docs.handwrites.io/admin/readme-post-apiadminaccountssubcloudkeyskeyidrevoke-2496421m0.md): - Root > Customer accounts [README — GET /api/admin/accounts/{sub}/cloud/keys](https://docs.handwrites.io/admin/readme-get-apiadminaccountssubcloudkeys-2496424m0.md): - Root > Customer accounts [README — GET /api/admin/accounts/{sub}/cloud/oauth](https://docs.handwrites.io/admin/readme-get-apiadminaccountssubcloudoauth-2496427m0.md): - Root > Customer accounts [README — GET /api/admin/accounts/{sub}/cloud/orgs](https://docs.handwrites.io/admin/readme-get-apiadminaccountssubcloudorgs-2496430m0.md): - Root > Customer accounts [README — GET /api/admin/accounts/{sub}/cloud/settings](https://docs.handwrites.io/admin/readme-get-apiadminaccountssubcloudsettings-2496433m0.md): - Root > Customer accounts [README — GET /api/admin/accounts/{sub}/cloud/usage](https://docs.handwrites.io/admin/readme-get-apiadminaccountssubcloudusage-2496436m0.md): - Root > Customer accounts [README — GET /api/admin/accounts/{sub}/cloud/webhooks](https://docs.handwrites.io/admin/readme-get-apiadminaccountssubcloudwebhooks-2496439m0.md): - Root > Customer accounts [README — POST /api/admin/accounts/{sub}/delete](https://docs.handwrites.io/admin/readme-post-apiadminaccountssubdelete-2496442m0.md): - Root > Customer accounts [README — POST /api/admin/accounts/{sub}/disable](https://docs.handwrites.io/admin/readme-post-apiadminaccountssubdisable-2496445m0.md): - Root > Customer accounts [README — POST /api/admin/accounts/{sub}/enable](https://docs.handwrites.io/admin/readme-post-apiadminaccountssubenable-2496448m0.md): - Root > Customer accounts [README — POST /api/admin/accounts/{sub}/mfa-reset](https://docs.handwrites.io/admin/readme-post-apiadminaccountssubmfa-reset-2496451m0.md): - Root > Customer accounts [README — POST /api/admin/accounts/{sub}/password-reset](https://docs.handwrites.io/admin/readme-post-apiadminaccountssubpassword-reset-2496454m0.md): - Root > Customer accounts [README — POST /api/admin/accounts/{sub}/purge](https://docs.handwrites.io/admin/readme-post-apiadminaccountssubpurge-2496457m0.md): - Root > Customer accounts [README — POST /api/admin/accounts/{sub}/restore](https://docs.handwrites.io/admin/readme-post-apiadminaccountssubrestore-2496460m0.md): - Root > Customer accounts [README — GET /api/admin/accounts/{sub}](https://docs.handwrites.io/admin/readme-get-apiadminaccountssub-2496463m0.md): - Root > Customer accounts [README — PATCH /api/admin/accounts/{sub}](https://docs.handwrites.io/admin/readme-patch-apiadminaccountssub-2496466m0.md): - Root > Customer accounts [README — POST /api/admin/accounts/{sub}/sign-out](https://docs.handwrites.io/admin/readme-post-apiadminaccountssubsign-out-2496469m0.md): - Root > Customer accounts [README — GET /api/admin/accounts](https://docs.handwrites.io/admin/readme-get-apiadminaccounts-2496472m0.md): - Root > Staff administration [README — POST /api/admin/admins/{sub}/password-reset](https://docs.handwrites.io/admin/readme-post-apiadminadminssubpassword-reset-2496475m0.md): - Root > Staff administration [README — PATCH /api/admin/admins/{sub}](https://docs.handwrites.io/admin/readme-patch-apiadminadminssub-2496478m0.md): - Root > Staff administration [README — DELETE /api/admin/admins/{sub}/sessions](https://docs.handwrites.io/admin/readme-delete-apiadminadminssubsessions-2496481m0.md): - Root > Staff administration [README — GET /api/admin/admins](https://docs.handwrites.io/admin/readme-get-apiadminadmins-2496484m0.md): - Root > Staff administration [README — POST /api/admin/admins](https://docs.handwrites.io/admin/readme-post-apiadminadmins-2496487m0.md): - Root > Operations [README — GET /api/admin/alarms](https://docs.handwrites.io/admin/readme-get-apiadminalarms-2496490m0.md): - Root > Operations [README — GET /api/admin/audit](https://docs.handwrites.io/admin/readme-get-apiadminaudit-2496493m0.md): - Root > Operations [README — GET /api/admin/billing](https://docs.handwrites.io/admin/readme-get-apiadminbilling-2496511m0.md): - Root > Operations [README — GET /api/admin/config](https://docs.handwrites.io/admin/readme-get-apiadminconfig-2496514m0.md): - Root > Operations [README — PUT /api/admin/config](https://docs.handwrites.io/admin/readme-put-apiadminconfig-2496517m0.md): - Root > Operations [README — GET /api/admin/deletions](https://docs.handwrites.io/admin/readme-get-apiadmindeletions-2496521m0.md): - Root > Operations [README — GET /api/admin/icloud/probe](https://docs.handwrites.io/admin/readme-get-apiadminicloudprobe-2496530m0.md): - Root > Operations [README — POST /api/admin/jobs/rollup](https://docs.handwrites.io/admin/readme-post-apiadminjobsrollup-2496532m0.md): - Root > Operations [README — GET /api/admin/me](https://docs.handwrites.io/admin/readme-get-apiadminme-2496533m0.md): - Root > Operations [README — GET /api/admin/overview](https://docs.handwrites.io/admin/readme-get-apiadminoverview-2496541m0.md): - Root > Operations [README — GET /api/admin/usage/accounts/{sub}](https://docs.handwrites.io/admin/readme-get-apiadminusageaccountssub-2496564m0.md): - Root > Operations [README — GET /api/admin/usage/orgs/{id}](https://docs.handwrites.io/admin/readme-get-apiadminusageorgsid-2496565m0.md): - Root > Operations [README — GET /api/admin/usage/rollup](https://docs.handwrites.io/admin/readme-get-apiadminusagerollup-2496566m0.md): - Root > Authentication [README — POST /api/admin/auth/challenge](https://docs.handwrites.io/admin/readme-post-apiadminauthchallenge-2496496m0.md): - Root > Authentication [README — POST /api/admin/auth/sign-in](https://docs.handwrites.io/admin/readme-post-apiadminauthsign-in-2496499m0.md): - Root > Authentication [README — POST /api/admin/auth/sign-out-all](https://docs.handwrites.io/admin/readme-post-apiadminauthsign-out-all-2496502m0.md): - Root > Authentication [README — POST /api/admin/auth/sign-out](https://docs.handwrites.io/admin/readme-post-apiadminauthsign-out-2496505m0.md): - Root > Authentication [README — POST /api/admin/auth/step-up](https://docs.handwrites.io/admin/readme-post-apiadminauthstep-up-2496508m0.md): - Root > Staff webhooks [README — DELETE /api/admin/hooks/{id}](https://docs.handwrites.io/admin/readme-delete-apiadminhooksid-2496523m0.md): - Root > Staff webhooks [README — POST /api/admin/hooks/{id}/test](https://docs.handwrites.io/admin/readme-post-apiadminhooksidtest-2496524m0.md): - Root > Staff webhooks [README — GET /api/admin/hooks](https://docs.handwrites.io/admin/readme-get-apiadminhooks-2496526m0.md): - Root > Staff webhooks [README — POST /api/admin/hooks](https://docs.handwrites.io/admin/readme-post-apiadminhooks-2496528m0.md): - Root > Staff webhooks [README — staff webhook delivery](https://docs.handwrites.io/admin/readme-staff-webhook-delivery-2496569m0.md): - Root > Organisations [README — POST /api/admin/orgs/{id}/api-access](https://docs.handwrites.io/admin/readme-post-apiadminorgsidapi-access-2496534m0.md): - Root > Organisations [README — GET /api/admin/orgs/{id}/audit](https://docs.handwrites.io/admin/readme-get-apiadminorgsidaudit-2496536m0.md): - Root > Organisations [README — GET /api/admin/orgs/{id}/members](https://docs.handwrites.io/admin/readme-get-apiadminorgsidmembers-2496537m0.md): - Root > Organisations [README — GET /api/admin/orgs/{id}](https://docs.handwrites.io/admin/readme-get-apiadminorgsid-2496538m0.md): - Root > Organisations [README — GET /api/admin/orgs/{id}/usage](https://docs.handwrites.io/admin/readme-get-apiadminorgsidusage-2496540m0.md): - Root > Schools [README — POST /api/admin/schools/{orgId}/close](https://docs.handwrites.io/admin/readme-post-apiadminschoolsorgidclose-2496542m0.md): - Root > Schools [README — GET /api/admin/schools/{orgId}](https://docs.handwrites.io/admin/readme-get-apiadminschoolsorgid-2496543m0.md): - Root > Schools [README — PATCH /api/admin/schools/{orgId}](https://docs.handwrites.io/admin/readme-patch-apiadminschoolsorgid-2496544m0.md): - Root > Schools [README — GET /api/admin/schools](https://docs.handwrites.io/admin/readme-get-apiadminschools-2496545m0.md): - Root > Sessions [README — DELETE /api/admin/sessions/{id}](https://docs.handwrites.io/admin/readme-delete-apiadminsessionsid-2496546m0.md): - Root > Sessions [README — GET /api/admin/sessions](https://docs.handwrites.io/admin/readme-get-apiadminsessions-2496547m0.md): - Root > Support [README — GET /api/admin/support/canned/{id}](https://docs.handwrites.io/admin/readme-get-apiadminsupportcannedid-2496548m0.md): - Root > Support [README — PUT /api/admin/support/canned/{id}](https://docs.handwrites.io/admin/readme-put-apiadminsupportcannedid-2496549m0.md): - Root > Support [README — DELETE /api/admin/support/canned/{id}](https://docs.handwrites.io/admin/readme-delete-apiadminsupportcannedid-2496550m0.md): - Root > Support [README — GET /api/admin/support/canned](https://docs.handwrites.io/admin/readme-get-apiadminsupportcanned-2496551m0.md): - Root > Support [README — POST /api/admin/support/canned](https://docs.handwrites.io/admin/readme-post-apiadminsupportcanned-2496552m0.md): - Root > Support [README — GET /api/admin/support/tickets/{id}/attachments/{n}](https://docs.handwrites.io/admin/readme-get-apiadminsupportticketsidattachmentsn-2496553m0.md): - Root > Support [README — GET /api/admin/support/tickets/{id}/link](https://docs.handwrites.io/admin/readme-get-apiadminsupportticketsidlink-2496554m0.md): - Root > Support [README — POST /api/admin/support/tickets/{id}/link](https://docs.handwrites.io/admin/readme-post-apiadminsupportticketsidlink-2496555m0.md): - Root > Support [README — POST /api/admin/support/tickets/{id}/note](https://docs.handwrites.io/admin/readme-post-apiadminsupportticketsidnote-2496556m0.md): - Root > Support [README — POST /api/admin/support/tickets/{id}/reply](https://docs.handwrites.io/admin/readme-post-apiadminsupportticketsidreply-2496557m0.md): - Root > Support [README — GET /api/admin/support/tickets/{id}](https://docs.handwrites.io/admin/readme-get-apiadminsupportticketsid-2496558m0.md): - Root > Support [README — PATCH /api/admin/support/tickets/{id}](https://docs.handwrites.io/admin/readme-patch-apiadminsupportticketsid-2496559m0.md): - Root > Support [README — POST /api/admin/support/tickets/{id}/school](https://docs.handwrites.io/admin/readme-post-apiadminsupportticketsidschool-2496560m0.md): - Root > Support [README — POST /api/admin/support/tickets/{id}/spam](https://docs.handwrites.io/admin/readme-post-apiadminsupportticketsidspam-2496561m0.md): - Root > Support [README — GET /api/admin/support/tickets](https://docs.handwrites.io/admin/readme-get-apiadminsupporttickets-2496562m0.md): - Root > Health [README — GET /api/health](https://docs.handwrites.io/admin/readme-get-apihealth-2496567m0.md): ## API Docs - Root > Customer accounts [GET /api/admin/accounts/{sub}/billing](https://docs.handwrites.io/admin/get-apiadminaccountssubbilling-45899770e0.md): GET /api/admin/accounts/:sub/billing (billing.read + a reason): the account's Voices plan, credit purchases, balance - Root > Customer accounts [GET /api/admin/accounts/{sub}/cloud/documents/{id}](https://docs.handwrites.io/admin/get-apiadminaccountssubclouddocumentsid-45899771e0.md): GET /api/admin/accounts/:sub/cloud/documents/:id[?content=1]: one document the account owns, with its shares, - Root > Customer accounts [GET /api/admin/accounts/{sub}/cloud/documents](https://docs.handwrites.io/admin/get-apiadminaccountssubclouddocuments-45899772e0.md): GET /api/admin/accounts/:sub/cloud/documents?cursor&limit[&content=1]: the account's own documents, newest change first (metadata only). - Root > Customer accounts [POST /api/admin/accounts/{sub}/cloud/keys/{keyId}/revoke](https://docs.handwrites.io/admin/post-apiadminaccountssubcloudkeyskeyidrevoke-45899773e0.md): POST /api/admin/accounts/:sub/cloud/keys/:keyId/revoke (keys.revoke: owner/support, step-up, X-Admin-Reason; §8) → {keyId, revoked, managedBy}. - Root > Customer accounts [GET /api/admin/accounts/{sub}/cloud/keys](https://docs.handwrites.io/admin/get-apiadminaccountssubcloudkeys-45899774e0.md): GET /api/admin/accounts/:sub/cloud/keys[?content=1]: API keys (legacy and fine-grained); names only with content, never hashes. - Root > Customer accounts [GET /api/admin/accounts/{sub}/cloud/oauth](https://docs.handwrites.io/admin/get-apiadminaccountssubcloudoauth-45899775e0.md): GET /api/admin/accounts/:sub/cloud/oauth[?content=1]: OAuth apps the account registered and the grants it gave. - Root > Customer accounts [GET /api/admin/accounts/{sub}/cloud/orgs](https://docs.handwrites.io/admin/get-apiadminaccountssubcloudorgs-45899776e0.md): GET /api/admin/accounts/:sub/cloud/orgs[?content=1]: the account's team and class memberships (org names only with content). - Root > Customer accounts [GET /api/admin/accounts/{sub}/cloud/settings](https://docs.handwrites.io/admin/get-apiadminaccountssubcloudsettings-45899777e0.md): GET /api/admin/accounts/:sub/cloud/settings[?content=1]: synced setting keys and when they changed; values only with content. - Root > Customer accounts [GET /api/admin/accounts/{sub}/cloud/usage](https://docs.handwrites.io/admin/get-apiadminaccountssubcloudusage-45899778e0.md): GET /api/admin/accounts/:sub/cloud/usage?days: daily API usage (sessions and each key) for up to 35 days (UsageDay retention). - Root > Customer accounts [GET /api/admin/accounts/{sub}/cloud/webhooks](https://docs.handwrites.io/admin/get-apiadminaccountssubcloudwebhooks-45899779e0.md): GET /api/admin/accounts/:sub/cloud/webhooks: endpoints (URL host only, events, last delivery outcome). - Root > Customer accounts [POST /api/admin/accounts/{sub}/delete](https://docs.handwrites.io/admin/post-apiadminaccountssubdelete-45899780e0.md): POST /api/admin/accounts/{sub}/delete: staff-console operation. - Root > Customer accounts [POST /api/admin/accounts/{sub}/disable](https://docs.handwrites.io/admin/post-apiadminaccountssubdisable-45899781e0.md): POST /api/admin/accounts/{sub}/disable: staff-console operation. - Root > Customer accounts [POST /api/admin/accounts/{sub}/enable](https://docs.handwrites.io/admin/post-apiadminaccountssubenable-45899782e0.md): POST /api/admin/accounts/{sub}/enable: staff-console operation. - Root > Customer accounts [POST /api/admin/accounts/{sub}/mfa-reset](https://docs.handwrites.io/admin/post-apiadminaccountssubmfa-reset-45899783e0.md): POST /api/admin/accounts/{sub}/mfa-reset: staff-console operation. - Root > Customer accounts [POST /api/admin/accounts/{sub}/password-reset](https://docs.handwrites.io/admin/post-apiadminaccountssubpassword-reset-45899784e0.md): POST /api/admin/accounts/{sub}/password-reset: staff-console operation. - Root > Customer accounts [POST /api/admin/accounts/{sub}/purge](https://docs.handwrites.io/admin/post-apiadminaccountssubpurge-45899785e0.md): POST /api/admin/accounts/:sub/purge {confirm: ""}: erases a scheduled account now instead of at the end of - Root > Customer accounts [POST /api/admin/accounts/{sub}/restore](https://docs.handwrites.io/admin/post-apiadminaccountssubrestore-45899786e0.md): POST /api/admin/accounts/:sub/restore: ends a scheduled deletion within the grace period (accounts.restore; step-up - Root > Customer accounts [GET /api/admin/accounts/{sub}](https://docs.handwrites.io/admin/get-apiadminaccountssub-45899787e0.md): GET /api/admin/accounts/:sub (accounts.read, the staff-console specification): the profile (full email and name), sign-in events when - Root > Customer accounts [PATCH /api/admin/accounts/{sub}](https://docs.handwrites.io/admin/patch-apiadminaccountssub-45899788e0.md): PATCH {name} | {email, verified?} (accounts.update, step-up; package 7): admin/src/admin/customer-routes.ts. - Root > Customer accounts [POST /api/admin/accounts/{sub}/sign-out](https://docs.handwrites.io/admin/post-apiadminaccountssubsign-out-45899789e0.md): POST /api/admin/accounts/{sub}/sign-out: staff-console operation. - Root > Customer accounts [GET /api/admin/accounts](https://docs.handwrites.io/admin/get-apiadminaccounts-45899790e0.md): GET /api/admin/accounts?q=&by=email|username|name|sub&cursor= (accounts.search, the staff-console specification): one filtered Cognito - Root > Staff administration [POST /api/admin/admins/{sub}/password-reset](https://docs.handwrites.io/admin/post-apiadminadminssubpassword-reset-45899791e0.md): POST /api/admin/admins/:sub/password-reset (admins.disable: owners, step-up): the staff pool's only password reset - Root > Staff administration [PATCH /api/admin/admins/{sub}](https://docs.handwrites.io/admin/patch-apiadminadminssub-45899792e0.md): PATCH /api/admin/admins/:sub {role} | {status: "active"|"disabled"} (admins.role / admins.disable, step-up). - Root > Staff administration [DELETE /api/admin/admins/{sub}/sessions](https://docs.handwrites.io/admin/delete-apiadminadminssubsessions-45899793e0.md): DELETE /api/admin/admins/:sub/sessions (admins.sessions, step-up): signs that admin out of every console session - Root > Staff administration [GET /api/admin/admins](https://docs.handwrites.io/admin/get-apiadminadmins-45899794e0.md): GET /api/admin/admins: every admin (admins.read; emails masked unless you're an owner). - Root > Staff administration [POST /api/admin/admins](https://docs.handwrites.io/admin/post-apiadminadmins-45899795e0.md): POST /api/admin/admins (admins.create, step-up): - Root > Operations [GET /api/admin/alarms](https://docs.handwrites.io/admin/get-apiadminalarms-45899796e0.md): GET /api/admin/alarms: alarm states, hourly error metrics for the last 48 h and the webhook DLQ depth. Each part - Root > Operations [GET /api/admin/audit](https://docs.handwrites.io/admin/get-apiadminaudit-45899797e0.md): GET /api/admin/audit?month=yyyy-mm&actor=&target=:&cursor=&limit= (audit.read): entries - Root > Operations [GET /api/admin/billing](https://docs.handwrites.io/admin/get-apiadminbilling-45899798e0.md): GET /api/admin/billing?from=yyyy-mm-dd&to=yyyy-mm-dd (default: the last 90 days to yesterday, at most 400 days): - Root > Operations [GET /api/admin/config](https://docs.handwrites.io/admin/get-apiadminconfig-45899799e0.md): GET /api/admin/config?cursor — the site settings and their history (config.read). - Root > Operations [PUT /api/admin/config](https://docs.handwrites.io/admin/put-apiadminconfig-45899800e0.md): PUT /api/admin/config {launchDate, appStoreUrl?, note?, expectedVersion?} — owner only, fresh step-up, audited. - Root > Operations [GET /api/admin/deletions](https://docs.handwrites.io/admin/get-apiadmindeletions-45899801e0.md): GET /api/admin/deletions?status=pending|restored|purged&cursor&limit: scheduled deletions (the staff-console specification). - Root > Operations [GET /api/admin/icloud/probe](https://docs.handwrites.io/admin/get-apiadminicloudprobe-45899802e0.md): GET /api/admin/icloud/probe[?dry=1] (icloud.read) → ProbeResult: unconfigured | configured | ok | error, never record - Root > Operations [POST /api/admin/jobs/rollup](https://docs.handwrites.io/admin/post-apiadminjobsrollup-45899803e0.md): POST /api/admin/jobs/rollup {day}: owner only, fresh step-up. Queues the AdminRollup function for one finished day - Root > Operations [GET /api/admin/me](https://docs.handwrites.io/admin/get-apiadminme-45899804e0.md): GET /api/admin/me → {sub, email, role, permissions[], stepUpUntil}. - Root > Operations [GET /api/admin/overview](https://docs.handwrites.io/admin/get-apiadminoverview-45899805e0.md): GET /api/admin/overview: the overview's tiles, queues, rollup freshness, audit chain status and recent entries. - Root > Operations [GET /api/admin/usage/accounts/{sub}](https://docs.handwrites.io/admin/get-apiadminusageaccountssub-45899806e0.md): GET /api/admin/usage/accounts/:sub: the account's last 30 days live (sessions via usageHistory, keys via Index1). Counts only. - Root > Operations [GET /api/admin/usage/orgs/{id}](https://docs.handwrites.io/admin/get-apiadminusageorgsid-45899807e0.md): GET /api/admin/usage/orgs/:id?from&to: the org's ROLLUP#org# days plus its last 48 h of UsageMinute rows (an Index1 query). - Root > Operations [GET /api/admin/usage/rollup](https://docs.handwrites.io/admin/get-apiadminusagerollup-45899808e0.md): GET /api/admin/usage/rollup?from&to&by=org|account: daily platform series for the range (default: 30 days to - Root > Authentication [POST /api/admin/auth/challenge](https://docs.handwrites.io/admin/post-apiadminauthchallenge-45899809e0.md): POST /api/admin/auth/challenge {email, challenge, session, username, answers}: answers NEW_PASSWORD_REQUIRED - Root > Authentication [POST /api/admin/auth/sign-in](https://docs.handwrites.io/admin/post-apiadminauthsign-in-45899810e0.md): POST /api/admin/auth/sign-in {email, password} → {done} with the session cookie, or {challenge, session, username, secret?, otpauth?}. - Root > Authentication [POST /api/admin/auth/sign-out-all](https://docs.handwrites.io/admin/post-apiadminauthsign-out-all-45899811e0.md): POST /api/admin/auth/sign-out-all: ends every session of the signed-in admin, this one included. - Root > Authentication [POST /api/admin/auth/sign-out](https://docs.handwrites.io/admin/post-apiadminauthsign-out-45899812e0.md): POST /api/admin/auth/sign-out: ends this session here and at Cognito (its refresh token), clears the cookie. - Root > Authentication [POST /api/admin/auth/step-up](https://docs.handwrites.io/admin/post-apiadminauthstep-up-45899813e0.md): POST /api/admin/auth/step-up {password, code}: re-proves both factors; dangerous actions then work for 10 minutes. - Root > Staff webhooks [DELETE /api/admin/hooks/{id}](https://docs.handwrites.io/admin/delete-apiadminhooksid-45899814e0.md): DELETE /api/admin/hooks/:id (hooks.manage, step-up). Audited hooks.delete. - Root > Staff webhooks [POST /api/admin/hooks/{id}/test](https://docs.handwrites.io/admin/post-apiadminhooksidtest-45899815e0.md): POST /api/admin/hooks/:id/test (hooks.manage, step-up): queues one test event. Audited hooks.test. - Root > Staff webhooks [GET /api/admin/hooks](https://docs.handwrites.io/admin/get-apiadminhooks-45899816e0.md): GET /api/admin/hooks (hooks.manage; no step-up to look): the security and retention webhooks, newest first, never their secrets. - Root > Staff webhooks [POST /api/admin/hooks](https://docs.handwrites.io/admin/post-apiadminhooks-45899817e0.md): POST /api/admin/hooks {url, categories} (hooks.manage, step-up): the secret is in the response once. Audited hooks.create. - Root > Organisations [POST /api/admin/orgs/{id}/api-access](https://docs.handwrites.io/admin/post-apiadminorgsidapi-access-45899818e0.md): POST /api/admin/orgs/:id/api-access {blocked} (orgs.api_access: owner/support, step-up, X-Admin-Reason; §8) → {orgId, apiBlocked, changed}. - Root > Organisations [GET /api/admin/orgs/{id}/audit](https://docs.handwrites.io/admin/get-apiadminorgsidaudit-45899819e0.md): GET /api/admin/orgs/:id/audit?cursor&limit[&content=1]: the organisation's own audit log, newest first (read-only). - Root > Organisations [GET /api/admin/orgs/{id}/members](https://docs.handwrites.io/admin/get-apiadminorgsidmembers-45899820e0.md): GET /api/admin/orgs/:id/members?cursor&limit[&content=1]: the roster (pseudonymous principals; emails masked without content). - Root > Organisations [GET /api/admin/orgs/{id}](https://docs.handwrites.io/admin/get-apiadminorgsid-45899821e0.md): GET /api/admin/orgs/:id[?content=1]: an organisation, its plan (no Stripe ids), seats by role and policies summary. - Root > Organisations [GET /api/admin/orgs/{id}/usage](https://docs.handwrites.io/admin/get-apiadminorgsidusage-45899822e0.md): GET /api/admin/orgs/:id/usage?days: daily totals of the members' activity (up to 90 days, OrgUsageDay retention). - Root > Schools [POST /api/admin/schools/{orgId}/close](https://docs.handwrites.io/admin/post-apiadminschoolsorgidclose-45899823e0.md): POST /api/admin/schools/:orgId/close {name, cursor?} (schools.close: owners, step-up, X-Admin-Reason; §16) → - Root > Schools [GET /api/admin/schools/{orgId}](https://docs.handwrites.io/admin/get-apiadminschoolsorgid-45899824e0.md): GET /api/admin/schools/:orgId (schools.read): the school and its seats by role (§16). - Root > Schools [PATCH /api/admin/schools/{orgId}](https://docs.handwrites.io/admin/patch-apiadminschoolsorgid-45899825e0.md): PATCH /api/admin/schools/:orgId {suspended, cursor?} | {reinvite: true} (schools.manage, step-up); each audited. A - Root > Schools [GET /api/admin/schools](https://docs.handwrites.io/admin/get-apiadminschools-45899826e0.md): GET /api/admin/schools?status=active|suspended&cursor&limit (schools.read): approved schools, newest first (§16). - Root > Sessions [DELETE /api/admin/sessions/{id}](https://docs.handwrites.io/admin/delete-apiadminsessionsid-45899827e0.md): DELETE /api/admin/sessions/:id: signs one session out. Your own: always. Another admin's: owners (admins.sessions) - Root > Sessions [GET /api/admin/sessions](https://docs.handwrites.io/admin/get-apiadminsessions-45899828e0.md): GET /api/admin/sessions[?sub=]: your sessions (newest first); another admin's need admins.sessions. - Root > Support [GET /api/admin/support/canned/{id}](https://docs.handwrites.io/admin/get-apiadminsupportcannedid-45899829e0.md): GET/PUT/DELETE /api/admin/support/canned/:id: read (support.read), replace and delete (support.manage, audited). - Root > Support [PUT /api/admin/support/canned/{id}](https://docs.handwrites.io/admin/put-apiadminsupportcannedid-45899830e0.md): PUT /api/admin/support/canned/{id}: staff-console operation. - Root > Support [DELETE /api/admin/support/canned/{id}](https://docs.handwrites.io/admin/delete-apiadminsupportcannedid-45899831e0.md): DELETE /api/admin/support/canned/{id}: staff-console operation. - Root > Support [GET /api/admin/support/canned](https://docs.handwrites.io/admin/get-apiadminsupportcanned-45899832e0.md): GET /api/admin/support/canned (support.read): every canned reply, by title. - Root > Support [POST /api/admin/support/canned](https://docs.handwrites.io/admin/post-apiadminsupportcanned-45899833e0.md): POST /api/admin/support/canned {title, body, topic?} (support.manage). Audited support.canned.create. - Root > Support [GET /api/admin/support/tickets/{id}/attachments/{n}](https://docs.handwrites.io/admin/get-apiadminsupportticketsidattachmentsn-45899834e0.md): GET /api/admin/support/tickets/:id/attachments/:n (support.read): a 5-minute presigned download URL for the thread's - Root > Support [GET /api/admin/support/tickets/{id}/link](https://docs.handwrites.io/admin/get-apiadminsupportticketsidlink-45899835e0.md): GET /api/admin/support/tickets/:id/link?q= (support.assign): exact-match customer search for the link - Root > Support [POST /api/admin/support/tickets/{id}/link](https://docs.handwrites.io/admin/post-apiadminsupportticketsidlink-45899836e0.md): POST /api/admin/support/tickets/{id}/link: staff-console operation. - Root > Support [POST /api/admin/support/tickets/{id}/note](https://docs.handwrites.io/admin/post-apiadminsupportticketsidnote-45899837e0.md): POST /api/admin/support/tickets/:id/note {text} (support.reply): an internal note, never mailed. Audited support.note. - Root > Support [POST /api/admin/support/tickets/{id}/reply](https://docs.handwrites.io/admin/post-apiadminsupportticketsidreply-45899838e0.md): POST /api/admin/support/tickets/:id/reply (support.reply): mails the reply through SES (503 mail_unavailable until set up). - Root > Support [GET /api/admin/support/tickets/{id}](https://docs.handwrites.io/admin/get-apiadminsupportticketsid-45899839e0.md): GET /api/admin/support/tickets/:id (support.read): the ticket and its thread (inbound mail as text) plus the staff - Root > Support [PATCH /api/admin/support/tickets/{id}](https://docs.handwrites.io/admin/patch-apiadminsupportticketsid-45899840e0.md): PATCH /api/admin/support/tickets/:id {status?, assignee?, tags?} (support.assign); each change audited on its own. - Root > Support [POST /api/admin/support/tickets/{id}/school](https://docs.handwrites.io/admin/post-apiadminsupportticketsidschool-45899841e0.md): POST /api/admin/support/tickets/:id/school (schools.approve, step-up; the staff-console specification). `approve` provisions the school - Root > Support [POST /api/admin/support/tickets/{id}/spam](https://docs.handwrites.io/admin/post-apiadminsupportticketsidspam-45899842e0.md): POST /api/admin/support/tickets/:id/spam {spam} (support.reply): mark spam / not spam. Audited support.spam. - Root > Support [GET /api/admin/support/tickets](https://docs.handwrites.io/admin/get-apiadminsupporttickets-45899843e0.md): GET /api/admin/support/tickets?status&assignee&email&account&cursor&limit&counts=1 (support.read): a page of tickets - Root > Health [GET /api/health](https://docs.handwrites.io/admin/get-apihealth-45899844e0.md): GET /api/health → {ok}: liveness only, no data, no session, no version (the build id stays out of public reach). ## Schemas - Root [Error](https://docs.handwrites.io/admin/error-18478525d0.md): - Root [Principal](https://docs.handwrites.io/admin/principal-18478526d0.md): - Root [Role](https://docs.handwrites.io/admin/role-18478527d0.md): - Root [Access](https://docs.handwrites.io/admin/access-18478528d0.md): - Root [ContentType](https://docs.handwrites.io/admin/contenttype-18478529d0.md): - Root [Language](https://docs.handwrites.io/admin/language-18478530d0.md): - Root [FileRef](https://docs.handwrites.io/admin/fileref-18478531d0.md): - Root [Document](https://docs.handwrites.io/admin/document-18478532d0.md): - Root [Tombstone](https://docs.handwrites.io/admin/tombstone-18478533d0.md): - Root [DocumentPage](https://docs.handwrites.io/admin/documentpage-18478534d0.md): - Root [CreateDocument](https://docs.handwrites.io/admin/createdocument-18478535d0.md): - Root [UpdateDocument](https://docs.handwrites.io/admin/updatedocument-18478536d0.md): - Root [FileInfo](https://docs.handwrites.io/admin/fileinfo-18478537d0.md): - Root [CommitUpload](https://docs.handwrites.io/admin/commitupload-18478538d0.md): - Root [Upload](https://docs.handwrites.io/admin/upload-18478539d0.md): - Root [DownloadLink](https://docs.handwrites.io/admin/downloadlink-18478540d0.md): - Root [Extracted](https://docs.handwrites.io/admin/extracted-18478541d0.md): - Root [ExtractionFailed](https://docs.handwrites.io/admin/extractionfailed-18478542d0.md): - Root [CommittedDocument](https://docs.handwrites.io/admin/committeddocument-18478543d0.md): - Root [ExtractedDocument](https://docs.handwrites.io/admin/extracteddocument-18478544d0.md): - Root [SearchHit](https://docs.handwrites.io/admin/searchhit-18478545d0.md): - Root [SearchPage](https://docs.handwrites.io/admin/searchpage-18478546d0.md): - Root [Export](https://docs.handwrites.io/admin/export-18478547d0.md): - Root [Permission](https://docs.handwrites.io/admin/permission-18478548d0.md): - Root [Share](https://docs.handwrites.io/admin/share-18478549d0.md): - Root [ChangeRole](https://docs.handwrites.io/admin/changerole-18478550d0.md): - Root [Invitation](https://docs.handwrites.io/admin/invitation-18478551d0.md): - Root [Permissions](https://docs.handwrites.io/admin/permissions-18478552d0.md): - Root [ReceivedInvitation](https://docs.handwrites.io/admin/receivedinvitation-18478553d0.md): - Root [AcceptedInvitation](https://docs.handwrites.io/admin/acceptedinvitation-18478554d0.md): - Root [Me](https://docs.handwrites.io/admin/me-18478555d0.md): - Root [WebhookEventType](https://docs.handwrites.io/admin/webhookeventtype-18478556d0.md): - Root [Webhook](https://docs.handwrites.io/admin/webhook-18478557d0.md): - Root [CreateWebhook](https://docs.handwrites.io/admin/createwebhook-18478558d0.md): - Root [CreatedWebhook](https://docs.handwrites.io/admin/createdwebhook-18478559d0.md): - Root [WebhookDelivery](https://docs.handwrites.io/admin/webhookdelivery-18478560d0.md): - Root [AudioFormat](https://docs.handwrites.io/admin/audioformat-18478561d0.md): - Root [Speech](https://docs.handwrites.io/admin/speech-18478562d0.md): - Root [WordTiming](https://docs.handwrites.io/admin/wordtiming-18478563d0.md): - Root [SpeechMarks](https://docs.handwrites.io/admin/speechmarks-18478564d0.md): - Root [AudioLink](https://docs.handwrites.io/admin/audiolink-18478565d0.md): - Root [Voice](https://docs.handwrites.io/admin/voice-18478566d0.md): - Root [Quota](https://docs.handwrites.io/admin/quota-18478567d0.md): - Root [SettingEntry](https://docs.handwrites.io/admin/settingentry-18478568d0.md): - Root [Settings](https://docs.handwrites.io/admin/settings-18478569d0.md): - Root [SettingsPatch](https://docs.handwrites.io/admin/settingspatch-18478570d0.md): - Root [PatchedSettings](https://docs.handwrites.io/admin/patchedsettings-18478571d0.md): - Root [OAuthToken](https://docs.handwrites.io/admin/oauthtoken-18478572d0.md): - Root [OAuthError](https://docs.handwrites.io/admin/oautherror-18478573d0.md): - Root [Error](https://docs.handwrites.io/admin/error-18478637d0.md): - Root [Principal](https://docs.handwrites.io/admin/principal-18478638d0.md): - Root [Access](https://docs.handwrites.io/admin/access-18478639d0.md): - Root [ContentType](https://docs.handwrites.io/admin/contenttype-18478640d0.md): - Root [Language](https://docs.handwrites.io/admin/language-18478641d0.md): - Root [FileRef](https://docs.handwrites.io/admin/fileref-18478642d0.md): - Root [Document](https://docs.handwrites.io/admin/document-18478643d0.md): - Root [Tombstone](https://docs.handwrites.io/admin/tombstone-18478644d0.md): - Root [DocumentPage](https://docs.handwrites.io/admin/documentpage-18478645d0.md): - Root [OrgKind](https://docs.handwrites.io/admin/orgkind-18478646d0.md): - Root [OrgRole](https://docs.handwrites.io/admin/orgrole-18478647d0.md): - Root [Organisation](https://docs.handwrites.io/admin/organisation-18478648d0.md): - Root [CreateOrganisation](https://docs.handwrites.io/admin/createorganisation-18478649d0.md): - Root [RenameOrganisation](https://docs.handwrites.io/admin/renameorganisation-18478650d0.md): - Root [Member](https://docs.handwrites.io/admin/member-18478651d0.md): - Root [AddMember](https://docs.handwrites.io/admin/addmember-18478652d0.md): - Root [ChangeMember](https://docs.handwrites.io/admin/changemember-18478653d0.md): - Root [InviteMember](https://docs.handwrites.io/admin/invitemember-18478654d0.md): - Root [OrgInvitation](https://docs.handwrites.io/admin/orginvitation-18478655d0.md): - Root [ReceivedOrgInvitation](https://docs.handwrites.io/admin/receivedorginvitation-18478656d0.md): - Root [Error](https://docs.handwrites.io/admin/error-18478657d0.md): - Root [Principal](https://docs.handwrites.io/admin/principal-18478658d0.md): - Root [Access](https://docs.handwrites.io/admin/access-18478659d0.md): - Root [ContentType](https://docs.handwrites.io/admin/contenttype-18478660d0.md): - Root [Language](https://docs.handwrites.io/admin/language-18478661d0.md): - Root [FileRef](https://docs.handwrites.io/admin/fileref-18478662d0.md): - Root [Document](https://docs.handwrites.io/admin/document-18478663d0.md): - Root [Tombstone](https://docs.handwrites.io/admin/tombstone-18478664d0.md): - Root [DocumentPage](https://docs.handwrites.io/admin/documentpage-18478665d0.md): - Root [OrgKind](https://docs.handwrites.io/admin/orgkind-18478666d0.md): - Root [OrgRole](https://docs.handwrites.io/admin/orgrole-18478667d0.md): - Root [Organisation](https://docs.handwrites.io/admin/organisation-18478668d0.md): - Root [CreateOrganisation](https://docs.handwrites.io/admin/createorganisation-18478669d0.md): - Root [RenameOrganisation](https://docs.handwrites.io/admin/renameorganisation-18478670d0.md): - Root [Member](https://docs.handwrites.io/admin/member-18478671d0.md): - Root [AddMember](https://docs.handwrites.io/admin/addmember-18478672d0.md): - Root [ChangeMember](https://docs.handwrites.io/admin/changemember-18478673d0.md): - Root [InviteMember](https://docs.handwrites.io/admin/invitemember-18478674d0.md): - Root [OrgInvitation](https://docs.handwrites.io/admin/orginvitation-18478675d0.md): - Root [ReceivedOrgInvitation](https://docs.handwrites.io/admin/receivedorginvitation-18478676d0.md):