Accounts, invites and moderation
The admin API is the reference server’s. Every call authenticates with
HTTP basic auth as admin with PDS_ADMIN_PASSWORD, and every call is an
entry in the audit log.
The commands below assume PDS_ADMIN_PASSWORD in the environment:
read -s PDS_ADMIN_PASSWORD && export PDS_ADMIN_PASSWORDInvite codes
Section titled “Invite codes”One code for one account:
curl -s -u "admin:$PDS_ADMIN_PASSWORD" -H 'content-type: application/json' -d '{"useCount": 1}' https://pds.example.com/xrpc/com.atproto.server.createInviteCodeTen codes of five uses each:
curl -s -u "admin:$PDS_ADMIN_PASSWORD" -H 'content-type: application/json' -d '{"codeCount": 10, "useCount": 5}' https://pds.example.com/xrpc/com.atproto.server.createInviteCodesDisable a code that leaked:
curl -s -u "admin:$PDS_ADMIN_PASSWORD" -H 'content-type: application/json' -d '{"codes": ["pds-example-com-xxxxx-xxxxx"]}' https://pds.example.com/xrpc/com.atproto.admin.disableInviteCodesPDS_INVITE_REQUIRED=false opens sign-up to everyone. Leave it on unless
you want a public server, and then set up hCaptcha and watch the sign-ups.
Look up an account
Section titled “Look up an account”curl -s -u "admin:$PDS_ADMIN_PASSWORD" "https://pds.example.com/xrpc/com.atproto.admin.getAccountInfo?did=did:plc:…"The answer has the handle, the email address and whether it is confirmed, the invite code the account used, and the codes it has.
Reset a password or change an address
Section titled “Reset a password or change an address”curl -s -u "admin:$PDS_ADMIN_PASSWORD" -H 'content-type: application/json' -d '{"did": "did:plc:…", "password": "…"}' https://pds.example.com/xrpc/com.atproto.admin.updateAccountPasswordcurl -s -u "admin:$PDS_ADMIN_PASSWORD" -H 'content-type: application/json' -d '{"account": "did:plc:…", "email": "alice@example.net"}' https://pds.example.com/xrpc/com.atproto.admin.updateAccountEmailA person who still has access resets their own password from the app, through email.
Both password reset and admin password update revoke the account’s legacy and OAuth sessions, remembered sign-ins, client grants, pending authorizations, app passwords and outstanding email tokens. The person must sign in again and create replacement app passwords. Member hosts check the entryway on each authenticated request, so recovery takes effect on the next request there too.
Recovery state is part of the account database. Preserve it in backups, and check the rollback limits before using an older image.
Take an account down
Section titled “Take an account down”A takedown hides the repository and quarantines its blobs. The account cannot sign in; its data stays until you lift the takedown or delete the account.
curl -s -u "admin:$PDS_ADMIN_PASSWORD" -H 'content-type: application/json' -d '{"subject": {"$type": "com.atproto.admin.defs#repoRef", "did": "did:plc:…"}, "takedown": {"applied": true, "ref": "spam"}}' https://pds.example.com/xrpc/com.atproto.admin.updateSubjectStatusLift it with "applied": false. The same method takes down one record,
with a com.atproto.repo.strongRef subject, or one blob.
Delete an account
Section titled “Delete an account”curl -s -u "admin:$PDS_ADMIN_PASSWORD" -H 'content-type: application/json' -d '{"did": "did:plc:…"}' https://pds.example.com/xrpc/com.atproto.admin.deleteAccountThe repository, the blobs and the sessions are removed. The DID stays in the PLC directory, as every DID does; the account can move to another server later with the same DID. A person deletes their own account from the app, with a token sent by mail.
Reports
Section titled “Reports”A report from the app goes to the moderation service named by
PDS_REPORT_SERVICE_URL, Bluesky’s by default. The server keeps no
report queue of its own.
A console
Section titled “A console”The operations console does the above from a page, with a reason recorded for each action, and shows the live firehose subscribers and the audit log.