21-Apr-2026 — Root operator tasks

The root operator is the only account that can provision other operators. Everything else (creating tenants, generating tokens, loading data, calling the API) is identical to a normal operator account — root simply has the additional ability to add and list operators.

If you're not the root operator, you can skip this page.

← Back to the overview

The root-only Operators panel — create a new operator with username, password (or hit Generate for a strong random one), and label. The table below lists all existing operators with their roles and last-login times.

Operators panel

Sign in as root and a panel labelled Operators appears at the top of the dashboard, marked with a root only chip. It is collapsed by default — hit Show to expand.

Inside:

• A form with Username, Password, and Label fields
• A Generate button next to the password field that fills it with a strong random string (12+ characters, mixed case, digits, symbols)
• After successful creation, a reveal panel shows the password back with a Copy button (the only time it's shown in plaintext — see warning below)
• A table of all existing operators: username, label, role (root or operator), created timestamp, last login

Create an operator

1. Type a Username (3 to 40 characters, lowercase). Convention: dot-separated like charlie.bigley or firstname.surname.
2. Type a Password (12 to 100 characters), or hit Generate for a strong random one.
3. Optional Label — human-readable, shown in the operators table to remind you who it's for (e.g. Charlie Bigley / MailMan).
4. Hit Create operator. The reveal panel shows the password with a Copy button.
5. Send the username and password to the new operator privately — by email, encrypted chat, or whatever secure channel you'd normally use. Not through the mock server itself.

The reveal panel is the only point at which the password is visible in plaintext to anyone — including you. The server stores only a bcrypt hash, so if the new operator loses the password before they sign in, the only recovery path is to provision a new operator (or, in extremis, redeploy with a new ADMIN_PASSWORD to rotate the root password).

List existing operators

The table below the form shows everyone, in reverse-chronological order of creation. The root operator appears with role root; everyone else is operator. Last-login timestamps make it easy to spot accounts that were provisioned but never used.

There is no UI for revoking, suspending, or deleting an operator at the moment — if that's needed, raise an issue or do it directly against MongoDB.

API endpoints

The same operations are available over the admin API for scripting. Both require an authenticated root session (cookie from /admin/api/login).

# 1. Sign in as root, save the session cookie
curl -sS -c /tmp/rsm.jar \
  -H 'Content-Type: application/json' \
  -d '{"username":"admin","password":"YOUR-ROOT-PASSWORD"}' \
  https://salesforce-mock.ngx-ramblers.org.uk/admin/api/login

# 2. Create an operator
curl -sS -b /tmp/rsm.jar \
  -H 'Content-Type: application/json' \
  -d '{
    "username": "charlie.bigley",
    "password": "a-strong-one-12-chars-or-more",
    "label": "Charlie Bigley / MailMan"
  }' \
  https://salesforce-mock.ngx-ramblers.org.uk/admin/api/operators

# 3. List operators
curl -sS -b /tmp/rsm.jar \
  https://salesforce-mock.ngx-ramblers.org.uk/admin/api/operators

rm /tmp/rsm.jar

Bootstrapping a fresh deployment

When the mock is deployed to a brand-new MongoDB, no operators exist. The deploy reads two environment variables to seed:

If you set ADMIN_PASSWORD and later change it on the running deploy, the next process restart re-hashes and updates the stored hash. That's how root password rotation works — there's no in-app rotation flow.

Once the bootstrap is done and at least one real operator exists, unset BOOTSTRAP_TOKEN from the deployment so the bootstrap tab can no longer be used.

Back to the overview

Overview →