Handwrite staff console

This edition documents the private staff console at https://admin.handwrites.io. It is for authorized Handwrite staff and maintainers, not third-party developer integrations. Regular Accounts, Team and Classroom have separate API editions. Staff authentication uses the dedicated staff identity and session; a customer API key or app-testing token cannot sign in here.

Start with API specification notes, the permission matrix, and staff workflows. The socket notes distinguish the console's HTTP calls from document collaboration. Each operation in this edition has an API reference and an individual README with its caller, request contract, response behavior, exact handler and source location. See source status for verification limits.

Use the console

Sign in with an admitted staff identity. Complete a temporary-password challenge if prompted, then enroll or enter a six-digit authenticator code. MFA is required before a staff session is issued.

Choose a workflow permitted by your role. The server rechecks permissions; the visible navigation is only a convenience.

Search for a specific customer before opening their record. Avoid broad exports or copying customer data into tickets or logs. Metadata and content access have different gates.

Supply a concrete reason when requested. For sensitive actions, confirm password and authenticator code again; the step-up lasts ten minutes.

Read the result. A queued deletion, rollup or cursor-based school change is not complete merely because the first request succeeded.

Workflow map

Area	Staff use
Customer accounts	Filtered search, profile/usage inspection, account recovery actions and scheduled deletion handling.
Cloud metadata	Review document metadata, grants, keys, OAuth configuration, usage and memberships with reason/audit checks. Document text and original file/audio bytes are not exposed by this browser.
Organisations	Review membership, policies and usage; authorized staff can block or restore API access through the signed site service.
Support	Read a thread, add an internal note, reply by email, link an account, manage tags/status and handle school applications.
Schools	Approve an application, suspend/restore access, reinvite administrators or close a school with explicit confirmation.
Staff	Owners invite staff, manage role/status and revoke sessions while preserving at least one active owner.
Operations	Inspect metrics and rollups, manage runtime site configuration and staff security/retention webhooks.

Staff API operations are internal implementation contracts. Do not distribute a session cookie, CSRF token, TOTP setup secret or staff-hook signing secret in an external application. Do not collect any of these values in documentation or request logs.

Staff integration receivers should also read the staff webhook delivery contract, including all five event categories, signature verification, retries and audit reconciliation.

Start here — staff console

Handwrite staff console#

Use the console#

Workflow map#

Handwrite staff console

Use the console

Workflow map