Security Settings

7 views Markdown

The five endpoints behind panel access, the password rules and the banned lists.

Overview

These five endpoints hold the installation's front door. Where the admin panel is, who can reach it, how strong passwords must be, and who cannot register at all.

Two of them can lock you out: the folder name changes the panel's address, and the address restriction narrows who gets in. One more cannot be undone and touches everyone. This article is largely about those three.

Reference

Reading the General Settings

get/api/v1/admin/settings/security/general
Settings/GetSecurityGeneral admin

Returns where the panel is, who can reach it, and the password rules.

Response fields data — 7
admin_folderstringThe folder the admin panel sits in. It is the secret part of the address and behaves like a credential.
admin_ip_restrictionstringThe addresses that may reach the panel. Empty means from anywhere.
password_lengthintThe shortest a password may be.
password_charactersstring[]The character classes a password has to contain.
password_reset_cycleintHow many days before a password has to be renewed. Zero means never.
clickjacking_protectionintStops the panel being embedded in another page.
clickjacking_protection_whiteliststringThe addresses allowed to embed it.
Errors 1
insufficient_scope403The key lacks the required scope.
Request 
curl 'https://panel.example.com/api/v1/admin/settings/security/general' \
  -H "Authorization: Bearer $API_KEY"
const res  = await fetch('https://panel.example.com/api/v1/admin/settings/security/general', {
  headers: { Authorization: `Bearer ${apiKey}` },
});
const body = await res.json();
$ch = curl_init('https://panel.example.com/api/v1/admin/settings/security/general');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => ['Authorization: Bearer ' . $apiKey],
]);

$body = json_decode(curl_exec($ch), true);
curl_close($ch);
// The admin folder name is a kind of SECRET: keep it out of your own logs and away from outsiders.
$sec = Api::Settings()->GetSecurityGeneral()['data'];

Writing the General Settings

put/api/v1/admin/settings/security/general
Settings/UpdateSecurityGeneral admin lock-out risk

Applies the settings you send. Changing the folder name changes the panel's address.

Body 7
admin_folderstringThe admin panel folder. It cannot be empty, cannot be a predictable name, and cannot clash with an existing file or folder.
admin_ip_restrictionstringThe addresses that may reach the panel.
password_lengthintThe minimum password length.
password_charactersstring[] | stringThe required character classes. The list is written whole.
password_reset_cycleintHow often passwords are renewed, in days.
clickjacking_protectionintTurns on protection against embedding.
clickjacking_protection_whiteliststringThe addresses allowed to embed it.
Response fields data — 7
dataobjectThe settings as they now stand. Same shape as the read endpoint.
——When the folder name changed, the value that comes back is the new folder. Read the panel address from here rather than assuming the rename kept the name you sent.
Errors 3
admin_folder_invalid422The folder name was refused.
admin_folder_exists422A file or folder by that name already exists.
insufficient_scope403The key lacks the required scope.
Request 
curl -X PUT 'https://panel.example.com/api/v1/admin/settings/security/general' \
  -H "Authorization: Bearer $API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{"password_length":10,"password_reset_cycle":90,"clickjacking_protection":1}'
const res = await fetch('https://panel.example.com/api/v1/admin/settings/security/general', {
  method: 'PUT',
  headers: {
    Authorization: `Bearer ${apiKey}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    password_length: 10,
    password_reset_cycle: 90,
    clickjacking_protection: 1,
  }),
});

const body = await res.json();
$ch = curl_init('https://panel.example.com/api/v1/admin/settings/security/general');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST  => 'PUT',
    CURLOPT_HTTPHEADER     => [
        'Authorization: Bearer ' . $apiKey,
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => json_encode([
        'password_length'      => 10,
        'password_reset_cycle' => 90,
    ]),
]);

$body = json_decode(curl_exec($ch), true);
curl_close($ch);
// Changing the folder changes the panel's ADDRESS; do not send it without noting the new one.
// The address restriction locks too: keep your own address on the list.
Api::Settings()->UpdateSecurityGeneral([
    'admin_ip_restriction' => $myAddress,
    'password_length'      => 10,
]);

Reading the Banned Lists

get/api/v1/admin/settings/security/prohibited
Settings/GetProhibited admin

Returns the domains, addresses, numbers and words refused at registration.

Response fields data — 5
block_temporary_emailintBlocks registration from disposable e-mail services.
domain_liststring[]The banned domains.
email_liststring[]The banned e-mail addresses.
gsm_liststring[]The banned phone numbers.
word_liststring[]The banned words.
Errors 1
insufficient_scope403The key lacks the required scope.
Request 
curl 'https://panel.example.com/api/v1/admin/settings/security/prohibited' \
  -H "Authorization: Bearer $API_KEY"
const res  = await fetch('https://panel.example.com/api/v1/admin/settings/security/prohibited', {
  headers: { Authorization: `Bearer ${apiKey}` },
});
const body = await res.json();
$ch = curl_init('https://panel.example.com/api/v1/admin/settings/security/prohibited');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => ['Authorization: Bearer ' . $apiKey],
]);

$body = json_decode(curl_exec($ch), true);
curl_close($ch);
$prohibited = Api::Settings()->GetProhibited()['data'];

Writing the Banned Lists

put/api/v1/admin/settings/security/prohibited
Settings/UpdateProhibited admin lists are written whole

Writes the banned lists. The list you send replaces the old one.

Body 5
block_temporary_emailintBlocks registration from disposable e-mail services.
domain_liststring[] | stringThe banned domains. An array or text, one per line.
email_liststring[] | stringThe banned e-mail addresses.
gsm_liststring[] | stringThe banned phone numbers.
word_liststring[] | stringThe banned words.
Response fields data — 5
dataobjectThe lists as they now stand. Same shape as the read endpoint.
Errors 1
insufficient_scope403The key lacks the required scope.
Request 
curl -X PUT 'https://panel.example.com/api/v1/admin/settings/security/prohibited' \
  -H "Authorization: Bearer $API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{"block_temporary_email":1,"domain_list":["example-spam.com"]}'
const res = await fetch('https://panel.example.com/api/v1/admin/settings/security/prohibited', {
  method: 'PUT',
  headers: {
    Authorization: `Bearer ${apiKey}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    block_temporary_email: 1,
    domain_list: ['example-spam.com'],
  }),
});

const body = await res.json();
$ch = curl_init('https://panel.example.com/api/v1/admin/settings/security/prohibited');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST  => 'PUT',
    CURLOPT_HTTPHEADER     => [
        'Authorization: Bearer ' . $apiKey,
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => json_encode([
        'block_temporary_email' => 1,
        'domain_list'           => ['example-spam.com'],
    ]),
]);

$body = json_decode(curl_exec($ch), true);
curl_close($ch);
// To ADD one domain send the existing list too, or the earlier ones are deleted.
$lists   = Api::Settings()->GetProhibited()['data'];
$domains = $lists['domain_list'];

$domains[] = 'example-spam.com';

Api::Settings()->UpdateProhibited(['domain_list' => $domains]);

Forcing a Password Reset

post/api/v1/admin/settings/security/force-reset-password
Settings/ForceResetPassword admin affects everyone

Forces every user to renew their password on their next sign-in.

Body —
——No body is needed, send an empty one. The reach cannot be narrowed: every account is covered.
Response fields data — 1
appliedboolWhether it was applied. It does not say how many users were affected.
Errors 2
force_reset_failed422It could not be applied.
insufficient_scope403The key lacks the required scope.
Request 
curl -X POST 'https://panel.example.com/api/v1/admin/settings/security/force-reset-password' \
  -H "Authorization: Bearer $API_KEY"
const res = await fetch('https://panel.example.com/api/v1/admin/settings/security/force-reset-password', {
  method: 'POST',
  headers: { Authorization: `Bearer ${apiKey}` },
});

const body = await res.json();
$ch = curl_init('https://panel.example.com/api/v1/admin/settings/security/force-reset-password');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POST           => true,
    CURLOPT_HTTPHEADER     => ['Authorization: Bearer ' . $apiKey],
]);

$body = json_decode(curl_exec($ch), true);
curl_close($ch);
// This request touches EVERY user and CANNOT be undone: there is no body and no confirmation step.
// Run it only with a real reason behind it, such as after a breach.
Api::Settings()->ForceResetPassword();

Pitfalls

The folder name is the panel's address

Changing the admin folder renames the directory: the panel is no longer at its old address. Do not send this request without writing the new name down somewhere. The name cannot be empty, cannot be predictable and cannot clash with an existing file. Those raise errors. A wrong yet valid name raises none and leaves the panel unfindable.

The address restriction covers you too

Restricting panel access by address makes no exceptions. Leave your own address off the list and the next attempt shuts you out as well. On a connection whose address changes, not using this setting is the safer choice.

The forced reset touches everyone

This endpoint takes no body, no filter and has no confirmation step. The moment you call it every user must renew their password at their next sign-in, and it cannot be undone. The response does not even say how many were affected. Do not run it without a real reason.

The banned lists are written whole

The list you send replaces the old one. Adding a single domain means reading the current list and appending to it, or every ban you built up disappears in one request, with no error to say so.

The folder name is a secret

The admin folder name is the secret part of the address and behaves like a credential. Do not write the value you read from here into your own records or show it in error messages. The system masks it even in its own error log.

Was this helpful?

Thanks for your feedback!

Still Need Help?

Our support team is here around the clock for anything you can't find above.

Contact Us Open a Ticket

We use cookies to keep you signed in, remember your language and currency, and improve the site. Cookie Policy