Staffs

Staffs is the operator-side access-control surface for human dashboard accounts.

Dashboard path

Operator Dashboard → Integrations → Staffs

Required scope: staffs:read

Mutation scope: staffs:write

Staff APIs require a human staff session. Operator API keys cannot create, edit, disable, or reset staff accounts.

What operators can do

• create staff accounts by email
• assign dashboard scopes
• edit display names
• enable or disable staff membership
• reset another staff member's password
• see last login and must-change-password state

Scope assignment rules

• * is not assignable to newly created dashboard staff through this UI.
• Write scopes automatically include the matching read scope when one exists.
• A staff member can assign only scopes they already hold, unless they have *.
• A staff member cannot update or disable their own access.
• Access and password changes revoke the target staff member's active sessions.

Onboarding password behavior

Create and reset flows attempt to email a temporary password.

If email delivery succeeds, the API does not return the temporary password.

If email delivery fails, the dashboard can show the temporary password once as a fallback so the operator can complete onboarding manually.

Source API

The page uses staff-session bearer auth against:

GET /api/operator/staff
POST /api/operator/staff
PATCH /api/operator/staff/{membership_id}
POST /api/operator/staff/{membership_id}/reset-password

See /docs/operator-api/staffs for request and response details.