1. Staff administration
Handwrite Admin
  • Handwrite Regular Accounts
    • Schemas
      • Error
      • Principal
      • Role
      • Access
      • ContentType
      • Language
      • FileRef
      • Document
      • Tombstone
      • DocumentPage
      • CreateDocument
      • UpdateDocument
      • FileInfo
      • CommitUpload
      • Upload
      • DownloadLink
      • Extracted
      • ExtractionFailed
      • CommittedDocument
      • ExtractedDocument
      • SearchHit
      • SearchPage
      • Export
      • Permission
      • Share
      • ChangeRole
      • Invitation
      • Permissions
      • ReceivedInvitation
      • AcceptedInvitation
      • Me
      • WebhookEventType
      • Webhook
      • CreateWebhook
      • CreatedWebhook
      • WebhookDelivery
      • AudioFormat
      • Speech
      • WordTiming
      • SpeechMarks
      • AudioLink
      • Voice
      • Quota
      • SettingEntry
      • Settings
      • SettingsPatch
      • PatchedSettings
      • OAuthToken
      • OAuthError
  • Handwrite Team
    • Schemas
      • Error
      • Principal
      • Access
      • ContentType
      • Language
      • FileRef
      • Document
      • Tombstone
      • DocumentPage
      • OrgKind
      • OrgRole
      • Organisation
      • CreateOrganisation
      • RenameOrganisation
      • Member
      • AddMember
      • ChangeMember
      • InviteMember
      • OrgInvitation
      • ReceivedOrgInvitation
  • Handwrite Classroom
    • Schemas
      • Error
      • Principal
      • Access
      • ContentType
      • Language
      • FileRef
      • Document
      • Tombstone
      • DocumentPage
      • OrgKind
      • OrgRole
      • Organisation
      • CreateOrganisation
      • RenameOrganisation
      • Member
      • AddMember
      • ChangeMember
      • InviteMember
      • OrgInvitation
      • ReceivedOrgInvitation
  • Handwrite Admin
    • Start here — staff console
    • Admin API specification notes
    • Admin socket specification notes
    • Staff role and permission matrix
    • Staff workflows and architecture
    • Admin source and validation status
    • Customer accounts
      • README — GET /api/admin/accounts/{sub}/billing
      • README — GET /api/admin/accounts/{sub}/cloud/documents/{id}
      • README — GET /api/admin/accounts/{sub}/cloud/documents
      • README — POST /api/admin/accounts/{sub}/cloud/keys/{keyId}/revoke
      • README — GET /api/admin/accounts/{sub}/cloud/keys
      • README — GET /api/admin/accounts/{sub}/cloud/oauth
      • README — GET /api/admin/accounts/{sub}/cloud/orgs
      • README — GET /api/admin/accounts/{sub}/cloud/settings
      • README — GET /api/admin/accounts/{sub}/cloud/usage
      • README — GET /api/admin/accounts/{sub}/cloud/webhooks
      • README — POST /api/admin/accounts/{sub}/delete
      • README — POST /api/admin/accounts/{sub}/disable
      • README — POST /api/admin/accounts/{sub}/enable
      • README — POST /api/admin/accounts/{sub}/mfa-reset
      • README — POST /api/admin/accounts/{sub}/password-reset
      • README — POST /api/admin/accounts/{sub}/purge
      • README — POST /api/admin/accounts/{sub}/restore
      • README — GET /api/admin/accounts/{sub}
      • README — PATCH /api/admin/accounts/{sub}
      • README — POST /api/admin/accounts/{sub}/sign-out
      • README — GET /api/admin/accounts
      • GET /api/admin/accounts/{sub}/billing
      • GET /api/admin/accounts/{sub}/cloud/documents/{id}
      • GET /api/admin/accounts/{sub}/cloud/documents
      • POST /api/admin/accounts/{sub}/cloud/keys/{keyId}/revoke
      • GET /api/admin/accounts/{sub}/cloud/keys
      • GET /api/admin/accounts/{sub}/cloud/oauth
      • GET /api/admin/accounts/{sub}/cloud/orgs
      • GET /api/admin/accounts/{sub}/cloud/settings
      • GET /api/admin/accounts/{sub}/cloud/usage
      • GET /api/admin/accounts/{sub}/cloud/webhooks
      • POST /api/admin/accounts/{sub}/delete
      • POST /api/admin/accounts/{sub}/disable
      • POST /api/admin/accounts/{sub}/enable
      • POST /api/admin/accounts/{sub}/mfa-reset
      • POST /api/admin/accounts/{sub}/password-reset
      • POST /api/admin/accounts/{sub}/purge
      • POST /api/admin/accounts/{sub}/restore
      • GET /api/admin/accounts/{sub}
      • PATCH /api/admin/accounts/{sub}
      • POST /api/admin/accounts/{sub}/sign-out
      • GET /api/admin/accounts
    • Staff administration
      • README — POST /api/admin/admins/{sub}/password-reset
      • README — PATCH /api/admin/admins/{sub}
      • README — DELETE /api/admin/admins/{sub}/sessions
      • README — GET /api/admin/admins
      • README — POST /api/admin/admins
      • POST /api/admin/admins/{sub}/password-reset
        POST
      • PATCH /api/admin/admins/{sub}
        PATCH
      • DELETE /api/admin/admins/{sub}/sessions
        DELETE
      • GET /api/admin/admins
        GET
      • POST /api/admin/admins
        POST
    • Operations
      • README — GET /api/admin/alarms
      • README — GET /api/admin/audit
      • README — GET /api/admin/billing
      • README — GET /api/admin/config
      • README — PUT /api/admin/config
      • README — GET /api/admin/deletions
      • README — GET /api/admin/icloud/probe
      • README — POST /api/admin/jobs/rollup
      • README — GET /api/admin/me
      • README — GET /api/admin/overview
      • README — GET /api/admin/usage/accounts/{sub}
      • README — GET /api/admin/usage/orgs/{id}
      • README — GET /api/admin/usage/rollup
      • GET /api/admin/alarms
      • GET /api/admin/audit
      • GET /api/admin/billing
      • GET /api/admin/config
      • PUT /api/admin/config
      • GET /api/admin/deletions
      • GET /api/admin/icloud/probe
      • POST /api/admin/jobs/rollup
      • GET /api/admin/me
      • GET /api/admin/overview
      • GET /api/admin/usage/accounts/{sub}
      • GET /api/admin/usage/orgs/{id}
      • GET /api/admin/usage/rollup
    • Authentication
      • README — POST /api/admin/auth/challenge
      • README — POST /api/admin/auth/sign-in
      • README — POST /api/admin/auth/sign-out-all
      • README — POST /api/admin/auth/sign-out
      • README — POST /api/admin/auth/step-up
      • POST /api/admin/auth/challenge
      • POST /api/admin/auth/sign-in
      • POST /api/admin/auth/sign-out-all
      • POST /api/admin/auth/sign-out
      • POST /api/admin/auth/step-up
    • Staff webhooks
      • README — DELETE /api/admin/hooks/{id}
      • README — POST /api/admin/hooks/{id}/test
      • README — GET /api/admin/hooks
      • README — POST /api/admin/hooks
      • README — staff webhook delivery
      • DELETE /api/admin/hooks/{id}
      • POST /api/admin/hooks/{id}/test
      • GET /api/admin/hooks
      • POST /api/admin/hooks
    • Organisations
      • README — POST /api/admin/orgs/{id}/api-access
      • README — GET /api/admin/orgs/{id}/audit
      • README — GET /api/admin/orgs/{id}/members
      • README — GET /api/admin/orgs/{id}
      • README — GET /api/admin/orgs/{id}/usage
      • POST /api/admin/orgs/{id}/api-access
      • GET /api/admin/orgs/{id}/audit
      • GET /api/admin/orgs/{id}/members
      • GET /api/admin/orgs/{id}
      • GET /api/admin/orgs/{id}/usage
    • Schools
      • README — POST /api/admin/schools/{orgId}/close
      • README — GET /api/admin/schools/{orgId}
      • README — PATCH /api/admin/schools/{orgId}
      • README — GET /api/admin/schools
      • POST /api/admin/schools/{orgId}/close
      • GET /api/admin/schools/{orgId}
      • PATCH /api/admin/schools/{orgId}
      • GET /api/admin/schools
    • Sessions
      • README — DELETE /api/admin/sessions/{id}
      • README — GET /api/admin/sessions
      • DELETE /api/admin/sessions/{id}
      • GET /api/admin/sessions
    • Support
      • README — GET /api/admin/support/canned/{id}
      • README — PUT /api/admin/support/canned/{id}
      • README — DELETE /api/admin/support/canned/{id}
      • README — GET /api/admin/support/canned
      • README — POST /api/admin/support/canned
      • README — GET /api/admin/support/tickets/{id}/attachments/{n}
      • README — GET /api/admin/support/tickets/{id}/link
      • README — POST /api/admin/support/tickets/{id}/link
      • README — POST /api/admin/support/tickets/{id}/note
      • README — POST /api/admin/support/tickets/{id}/reply
      • README — GET /api/admin/support/tickets/{id}
      • README — PATCH /api/admin/support/tickets/{id}
      • README — POST /api/admin/support/tickets/{id}/school
      • README — POST /api/admin/support/tickets/{id}/spam
      • README — GET /api/admin/support/tickets
      • GET /api/admin/support/canned/{id}
      • PUT /api/admin/support/canned/{id}
      • DELETE /api/admin/support/canned/{id}
      • GET /api/admin/support/canned
      • POST /api/admin/support/canned
      • GET /api/admin/support/tickets/{id}/attachments/{n}
      • GET /api/admin/support/tickets/{id}/link
      • POST /api/admin/support/tickets/{id}/link
      • POST /api/admin/support/tickets/{id}/note
      • POST /api/admin/support/tickets/{id}/reply
      • GET /api/admin/support/tickets/{id}
      • PATCH /api/admin/support/tickets/{id}
      • POST /api/admin/support/tickets/{id}/school
      • POST /api/admin/support/tickets/{id}/spam
      • GET /api/admin/support/tickets
    • Health
      • README — GET /api/health
      • GET /api/health
  1. Staff administration

PATCH /api/admin/admins/{sub}

Developing
PATCH
/api/admin/admins/{sub}
PATCH /api/admin/admins/:sub {role} | {status: "active"|"disabled"} (admins.role / admins.disable, step-up).
Refused (409) for your own role or status and when no active owner would remain; disabling also revokes every
session. Audited in admins.ts.
Staff cookie session; permission admins.role; fresh password + TOTP step-up (10 minutes). Write requests need same-origin JSON and X-Admin-CSRF from this session.
Source snapshot: admin/src/app/api/admin/admins/[sub]/route.ts. This reference describes the current working tree, not proof of deployment. The response service types and validators remain authoritative.

Request

Authorization
API Key
Add parameter in cookie
__Host-hwa_session
Example:
__Host-hwa_session: ********************
or
Path Params

Header Params

Body Params application/jsonRequired

Examples

Responses

🟢200
application/json
PATCH /api/admin/admins/:sub {role} | {status: "active"|"disabled"} (admins.role / admins.disable, step-up).
Refused (409) for your own role or status and when no active owner would remain; disabling also revokes every
session. Audited in admins.ts.
Bodyapplication/json

🟠400
🟠401
🟠403
🟠429
⚪default
Request Request Example
Shell
JavaScript
Java
Swift
curl --location --request PATCH '/api/admin/admins/' \
--header 'X-Admin-CSRF;' \
--header 'Content-Type: application/json' \
--data '{
    "role": "owner"
}'
Response Response Example
200 - Example 1
{}
Modified at 2026-10-26 13:41:16
Previous
POST /api/admin/admins/{sub}/password-reset
Next
DELETE /api/admin/admins/{sub}/sessions
Built with