admin
Admin-only user, submission, log, and system tools.
List exportable log fields
Lists the activity-log columns that may be included in a CSV export; drives the Download dialog's field picker. Nested under `export` because it describes what the sibling `POST /admin/logs/export` accepts. System administrators only.
Export activity logs
Returns the selected activity-log columns within a time range, for CSV export. System administrators only. Column names are validated against the exportable allow-list before reaching the Prisma select (guards field injection), and the result is capped at MAX_EXPORT_ROWS so one export can't page the whole table into memory.
List activity (audit) logs
A single page of activity (audit) logs, newest first, with `userId` resolved to the author's display name. Search, severity filter, and sort all run server-side.
Reset a user's password (admin)
Sets another user's password on their behalf (an admin-initiated reset). System administrators only; the new password still has to meet the strength policy. Pass `isTemporary` to force a change at next login. The plaintext password is never logged, only who reset whom.
Download a backup file
Streams a single backup file to the caller as an attachment. System administrators only. A database dump contains the entire database (password hashes and all PII), so the download is always recorded as a SECURITY audit event. The filename is checked against a strict allow-list and the resolved path must stay inside the backup directory: two independent guards against path traversal.
List backups
Lists available backups, newest first, each pairing a database dump with its matching upload-files archive. System administrators only.
Trigger a backup now
Requests an on-demand backup by dropping a trigger file the db-backup container polls for. System administrators only. Returns 202 (accepted); the backup runs asynchronously in that container, not in this request.
Test the configured hCaptcha keys
Verifies an hCaptcha token against the configured secret key, so an admin can confirm their hCaptcha keys actually work before turning captcha loose on real logins. Returns `{ ok }`. Admin only; never returns the secret.
Get system settings
Returns the singleton system settings, falling back to defaults for any unset field. The hCaptcha secret is never returned; only `hcaptchaSecretConfigured` reports whether one is stored. System administrators only.
Update system settings
Updates the singleton system settings (upsert). Every field is optional, so a partial payload only touches the fields it includes; numeric fields are clamped to safe bounds and an invalid timezone is rejected. The hCaptcha secret is write-only: send a non-empty `hcaptchaSecretKey` to set it, or `hcaptchaSecretClear: true` to remove it. Changes are audited (never the secret value). System administrators only.
Get Let's Encrypt issuance progress
Live progress of an in-flight Let's Encrypt issuance. The admin UI polls this while the (blocking) request runs so it can show step-by-step status instead of a spinner. Admin only. Returns `{ phase: 'idle' }` when nothing has been recorded.
Get TLS certificate status
Returns metadata about the currently installed TLS certificate and whether a CSR is awaiting a signed cert. Admin only. Never returns key or PEM material.
Install or generate a TLS certificate
Performs a certificate operation, chosen by the `action` field. Admin only; unauthorized-but-authenticated attempts are recorded as a security event. Cert bodies and keys are accepted in the request but never echoed back or logged.
Reset TLS to a self-signed certificate
Removes the installed certificate and reverts to a self-signed one. Admin only.
Get upgrade status and available versions
Reports the deployed version, the available curated releases, and the latest progress of any in-flight upgrade. System administrators only.
Request an application upgrade or downgrade
Requests an application upgrade to a curated release by dropping a validated request for the updater sidecar to perform. System administrators only. Returns 202; the swap, health check, and rollback happen asynchronously in the sidecar. Upgrade to a curated release, or DOWNGRADE by restoring a recorded pre-upgrade backup (which permanently discards everything created since it). Returns 202.
Stream live upgrade progress (Server-Sent Events)
Server-Sent Events stream of an in-flight upgrade: the coarse phase from status.json plus new lines from the updater's progress.log, pushed as they appear so the Updates UI shows real-time progress without polling or a manual refresh. Closes when the upgrade reaches a terminal phase (or after a time cap). System administrators only.
Database status
Database tab: reachability, engine details, per-engine stats (Postgres or SQLite), and the last migration. System administrators only.
Docker/container status
Docker tab: container detection (cgroups, /.dockerenv, env hints) and container id / hostname when running inside a container. System administrators only.
Abandoned-file report
Files tab: report of orphaned uploads, files on disk that no DB row references, by category, with up to 50 samples. System administrators only.
Delete an orphaned upload
Deletes a single orphaned upload. Guards on every axis (known category, separator-free name, still unreferenced, path stays inside the category folder). System administrators only.
Network status (DNS/TLS/latency/error-rate)
Network tab: DNS resolution for the DB and auth hosts, auth-endpoint latency + TLS certificate expiry, DB round-trip latency and connection count, and recent error-rate ratios. DNS/TLS are TTL-cached. System administrators only.
Clear one IP address's rate limit (admin)
Lifts one IP's rate-limit restriction ahead of its expiry, so an administrator can let a locked-out classroom or office back in without waiting it out. System administrators only. Not idempotent by design: clearing an address that is not currently restricted returns 404 rather than a silent success, so the caller learns the restriction had already lapsed (or landed on another instance) instead of assuming it acted.
Currently rate-limited IP addresses
Rate Limits tab: every client IP currently blocked or under a captcha-challenge cooldown, with why it was restricted, since when, how hard it is still knocking, when the restriction lifts on its own, and what is known about the address itself (where it sits in the address space, its reverse-DNS name, and whether AFCT's own activity log has seen it before). The rate limiter keeps its buckets in process memory, so this reports the state of the instance that serves the request and resets when the app restarts. It exposes visitors' IP addresses, so system administrators only.
Server status (host + process + software)
Server tab: host + process metrics (uptime, CPU/memory/disk-IO sample, OS, IP addresses) and software versions (Node/Next/Java/evaluator + build metadata). System administrators only. Tool versions are TTL-cached server-side.
Active session status
Session tab: recent active sessions (last 24h, deduped) and rolling 5/15/60m counts, from the audit log. Includes other users' session PII (emails, IPs), so system administrators only.
Status summary (top cards)
Summary cards at the top of the status dashboard: DB reachability/provider, uptime, process CPU/memory, DB table count + size, 24h session counts, and this probe's own latency. Fast by design so it renders immediately while the per-tab detail loads lazily. System administrators only.
List submissions for problems (admin)
Returns every submission across a set of problems, flattened for the admin grading view: student, course, assignment/problem titles, status, and the recorded grade (joined from AssignmentProblemGrade). System administrators only. Takes the problem ids in the body rather than the query string since the list can be long.
Unlock a locked-out account (admin)
Clears an account's auto-expiring login lock ahead of its expiry, so a user locked out by failed attempts can sign in again immediately. System administrators only. Idempotent: clearing an already-unlocked account is a no-op success. This only lifts the login gate; it does not reset the in-memory rate-limiter counters for the current instance, so a fresh burst of bad passwords can re-lock the account. That is intentional - the durable lock is the thing an admin manages.
Bulk-create users
Bulk-creates user accounts from parsed spreadsheet rows (the CSV import flow). System administrators only. Accounts are created with no global role. Each row is validated independently: a bad row is collected in `failed` with a reason rather than aborting the batch, so the response always reports per-row created/failed outcomes. Duplicate emails are caught both within the batch and against existing users. `temporaryPasswords` forces a reset at first login.
List users (paginated)
One page of the admin users table. Search, filters, sort, and pagination all run server-side. System administrators only; read-only (no audit-log side effect, unlike `GET /api/admin/users`).
List users
Lists users for the admin-facing users table. System administrators only; the access itself is audited.
Create a user
Creates a single user directly (admin-provisioned account), unlike self-service signup. System administrators only. Validates email, password strength, and timezone, and rejects a duplicate email. The account is created with no global role; admin rights are granted separately via the isAdmin flag.