Subusers
5 source-verified client API operations in Aquadactyl.
Generated from Aquadactyl 2bfd6ae2a30c. Read authentication and conventions first.
GET /api/client/servers/{server}/users
Return the users associated with this server instance.
Access: Client API key or authenticated panel session; user.read.
Source: Route · Controller · Request validation
Validation is inherited from ApplicationApiRequest.php.
Path parameters: server. See identifiers.
Additional authorization checks
if (!parent::authorize()) {
return false;
}
$user = $this->route()->parameter('user');
if ($user instanceof User) {
if ($user->uuid === $this->user()->uuid) {
return false;
}
}
if ($this->method() === Request::METHOD_POST && $this->has('permissions')) {
$this->validatePermissionsCanBeAssigned(
$this->input('permissions') ?? []
);
}
return true;Response
Success: 200. Response attributes: Client SubuserTransformer. Collections use the list envelope described in conventions.
Response construction and endpoint behavior
This source excerpt includes conditional responses, metadata, pagination, and service calls for this operation.
return $this->fractal->collection($server->subusers)
->transformWith($this->getTransformer(SubuserTransformer::class))
->toArray();Example request
curl --get "${PANEL_URL}/api/client/servers/SERVER_UUID/users" \
--header "Authorization: Bearer ${CLIENT_API_KEY}" \
--header "Accept: application/json"POST /api/client/servers/{server}/users
Create a new subuser for the given server.
Access: Client API key or authenticated panel session; user.create.
Source: Route · Controller · Request validation
Path parameters: server. See identifiers.
Input fields
Rules use Laravel validation syntax. Dotted keys describe nested objects; * describes each array member. Model-derived rules are shown as their source expressions; model methods can add runtime constraints.
| Field | Validation |
|---|---|
email | 'required|email:strict|between:1,191' |
permissions | 'required|array' |
permissions.* | 'string' |
Additional authorization checks
if (!parent::authorize()) {
return false;
}
$user = $this->route()->parameter('user');
if ($user instanceof User) {
if ($user->uuid === $this->user()->uuid) {
return false;
}
}
if ($this->method() === Request::METHOD_POST && $this->has('permissions')) {
$this->validatePermissionsCanBeAssigned(
$this->input('permissions') ?? []
);
}
return true;Response
Success: 200. Response attributes: Client SubuserTransformer. Collections use the list envelope described in conventions.
Response construction and endpoint behavior
This source excerpt includes conditional responses, metadata, pagination, and service calls for this operation.
$response = $this->creationService->handle(
$server,
$request->input('email'),
$this->getDefaultPermissions($request)
);
Activity::event('server:subuser.create')
->subject($response->user)
->property(['email' => $request->input('email'), 'permissions' => $this->getDefaultPermissions($request)])
->log();
return $this->fractal->item($response)
->transformWith($this->getTransformer(SubuserTransformer::class))
->toArray();GET /api/client/servers/{server}/users/{user}
Returns a single subuser associated with this server instance.
Access: Client API key or authenticated panel session; user.read.
Source: Route · Controller · Request validation
Validation is inherited from ApplicationApiRequest.php.
Path parameters: server, user. See identifiers.
Additional authorization checks
if (!parent::authorize()) {
return false;
}
$user = $this->route()->parameter('user');
if ($user instanceof User) {
if ($user->uuid === $this->user()->uuid) {
return false;
}
}
if ($this->method() === Request::METHOD_POST && $this->has('permissions')) {
$this->validatePermissionsCanBeAssigned(
$this->input('permissions') ?? []
);
}
return true;Response
Success: 200. Response attributes: Client SubuserTransformer. Collections use the list envelope described in conventions.
Response construction and endpoint behavior
This source excerpt includes conditional responses, metadata, pagination, and service calls for this operation.
$subuser = $request->attributes->get('subuser');
return $this->fractal->item($subuser)
->transformWith($this->getTransformer(SubuserTransformer::class))
->toArray();Example request
curl --get "${PANEL_URL}/api/client/servers/SERVER_UUID/users/RESOURCE_ID" \
--header "Authorization: Bearer ${CLIENT_API_KEY}" \
--header "Accept: application/json"POST /api/client/servers/{server}/users/{user}
Update a given subuser in the system for the server.
Access: Client API key or authenticated panel session; user.update.
Source: Route · Controller · Request validation
Path parameters: server, user. See identifiers.
Input fields
Rules use Laravel validation syntax. Dotted keys describe nested objects; * describes each array member. Model-derived rules are shown as their source expressions; model methods can add runtime constraints.
| Field | Validation |
|---|---|
permissions | 'required|array' |
permissions.* | 'string' |
Additional authorization checks
if (!parent::authorize()) {
return false;
}
$user = $this->route()->parameter('user');
if ($user instanceof User) {
if ($user->uuid === $this->user()->uuid) {
return false;
}
}
if ($this->method() === Request::METHOD_POST && $this->has('permissions')) {
$this->validatePermissionsCanBeAssigned(
$this->input('permissions') ?? []
);
}
return true;Response
Success: 200. Response attributes: Client SubuserTransformer. Collections use the list envelope described in conventions.
Response construction and endpoint behavior
This source excerpt includes conditional responses, metadata, pagination, and service calls for this operation.
$subuser = $request->attributes->get('subuser');
$permissions = $this->getDefaultPermissions($request);
$current = $subuser->permissions;
sort($permissions);
sort($current);
$log = Activity::event('server:subuser.update')
->subject($subuser->user)
->property([
'email' => $subuser->user->email,
'old' => $current,
'new' => $permissions,
'revoked' => true,
]);
if ($permissions !== $current) {
$log->transaction(function () use ($request, $subuser, $server) {
$this->repository->update($subuser->id, [
'permissions' => $this->getDefaultPermissions($request),
]);
RevokeSftpAccessJob::dispatch($subuser->user->uuid, $server);
});
}
$log->reset();
return $this->fractal->item($subuser->refresh())
->transformWith($this->getTransformer(SubuserTransformer::class))
->toArray();DELETE /api/client/servers/{server}/users/{user}
Removes a subusers from a server's assignment.
Access: Client API key or authenticated panel session; user.delete.
Source: Route · Controller · Request validation
Validation is inherited from ApplicationApiRequest.php.
Path parameters: server, user. See identifiers.
Additional authorization checks
if (!parent::authorize()) {
return false;
}
$user = $this->route()->parameter('user');
if ($user instanceof User) {
if ($user->uuid === $this->user()->uuid) {
return false;
}
}
if ($this->method() === Request::METHOD_POST && $this->has('permissions')) {
$this->validatePermissionsCanBeAssigned(
$this->input('permissions') ?? []
);
}
return true;Response
Success: 204 (empty body).
Response construction and endpoint behavior
This source excerpt includes conditional responses, metadata, pagination, and service calls for this operation.
$subuser = $request->attributes->get('subuser');
$log = Activity::event('server:subuser.delete')
->subject($subuser->user)
->property('email', $subuser->user->email)
->property('revoked', true);
$log->transaction(function () use ($server, $subuser) {
$subuser->delete();
RevokeSftpAccessJob::dispatch($subuser->user->uuid, $server);
});
return new JsonResponse([], JsonResponse::HTTP_NO_CONTENT);