{"id":"69ecef9b60bb8b34fce600b1","title":"Root Operator Tasks","path":"how-to/technical-articles/2026-04-21-using-ramblers-salesforce-mock/root-operator-tasks","contentMarkdown":"# 21-Apr-2026 — Root operator tasks\n\n_____\n\nThe root operator is the only account that can provision other operators. Everything else (creating tenants, generating tokens, loading data, calling the API) is identical to a normal operator account — root simply has the additional ability to add and list operators.\n\nIf you're not the root operator, you can skip this page.\n\n[← Back to the overview](https://ngx-ramblers.org.uk/how-to/technical-articles/2026-04-21-using-ramblers-salesforce-mock)\n\n![](https://ngx-ramblers.org.uk/api/aws/s3/site-content/126ac490-303e-4f72-bd2c-e1dbeb5d9faa.png)\n\n*The root-only Operators panel — create a new operator with username, password (or hit Generate for a strong random one), and label. The table below lists all existing operators with their roles and last-login times.*\n\n## Operators panel\n\nSign in as root and a panel labelled **Operators** appears at the top of the dashboard, marked with a `root only` chip. It is collapsed by default — hit **Show** to expand.\n\nInside:\n\n- A form with **Username**, **Password**, and **Label** fields\n- A **Generate** button next to the password field that fills it with a strong random string (12+ characters, mixed case, digits, symbols)\n- After successful creation, a reveal panel shows the password back with a **Copy** button (the only time it's shown in plaintext — see warning below)\n- A table of all existing operators: username, label, role (`root` or `operator`), created timestamp, last login\n\n### Create an operator\n\n1. Type a **Username** (3 to 40 characters, lowercase). Convention: dot-separated like `charlie.bigley` or `firstname.surname`.\n2. Type a **Password** (12 to 100 characters), or hit **Generate** for a strong random one.\n3. Optional **Label** — human-readable, shown in the operators table to remind you who it's for (e.g. `Charlie Bigley / MailMan`).\n4. Hit **Create operator**. The reveal panel shows the password with a Copy button.\n5. Send the username and password to the new operator privately — by email, encrypted chat, or whatever secure channel you'd normally use. **Not** through the mock server itself.\n\nThe reveal panel is the only point at which the password is visible in plaintext to anyone — including you. The server stores only a bcrypt hash, so if the new operator loses the password before they sign in, the only recovery path is to provision a new operator (or, in extremis, redeploy with a new `ADMIN_PASSWORD` to rotate the root password).\n\n### List existing operators\n\nThe table below the form shows everyone, in reverse-chronological order of creation. The root operator appears with role `root`; everyone else is `operator`. Last-login timestamps make it easy to spot accounts that were provisioned but never used.\n\nThere is no UI for revoking, suspending, or deleting an operator at the moment — if that's needed, raise an issue or do it directly against MongoDB.\n\n## API endpoints\n\nThe same operations are available over the admin API for scripting. Both require an authenticated root session (cookie from `/admin/api/login`).\n\n```sh\n# 1. Sign in as root, save the session cookie\ncurl -sS -c /tmp/rsm.jar \\\n -H 'Content-Type: application/json' \\\n -d '{\"username\":\"admin\",\"password\":\"YOUR-ROOT-PASSWORD\"}' \\\n https://salesforce-mock.ngx-ramblers.org.uk/admin/api/login\n\n# 2. Create an operator\ncurl -sS -b /tmp/rsm.jar \\\n -H 'Content-Type: application/json' \\\n -d '{\n \"username\": \"charlie.bigley\",\n \"password\": \"a-strong-one-12-chars-or-more\",\n \"label\": \"Charlie Bigley / MailMan\"\n }' \\\n https://salesforce-mock.ngx-ramblers.org.uk/admin/api/operators\n\n# 3. List operators\ncurl -sS -b /tmp/rsm.jar \\\n https://salesforce-mock.ngx-ramblers.org.uk/admin/api/operators\n\nrm /tmp/rsm.jar\n```\n\n## Bootstrapping a fresh deployment\n\nWhen the mock is deployed to a brand-new MongoDB, no operators exist. The deploy reads two environment variables to seed:\n\n| Variable | Used for |\n|---|---|\n| `ADMIN_USERNAME` | The root operator's username (default `admin`) |\n| `ADMIN_PASSWORD` | The root operator's initial password |\n| `BOOTSTRAP_TOKEN` | A long random string. If set, enables the **Bootstrap token** sign-in tab, which signs you in as the root operator without needing the password. |\n\nIf you set `ADMIN_PASSWORD` and later change it on the running deploy, the next process restart re-hashes and updates the stored hash. That's how root password rotation works — there's no in-app rotation flow.\n\nOnce the bootstrap is done and at least one real operator exists, unset `BOOTSTRAP_TOKEN` from the deployment so the bootstrap tab can no longer be used.\n\n## Back to the overview\n\n[**Overview →**](https://ngx-ramblers.org.uk/how-to/technical-articles/2026-04-21-using-ramblers-salesforce-mock)","contentHtml":"

21-Apr-2026 — Root operator tasks

\n
\n

The root operator is the only account that can provision other operators. Everything else (creating tenants, generating tokens, loading data, calling the API) is identical to a normal operator account — root simply has the additional ability to add and list operators.

\n

If you're not the root operator, you can skip this page.

\n

← Back to the overview

\n

\"\"

\n

The root-only Operators panel — create a new operator with username, password (or hit Generate for a strong random one), and label. The table below lists all existing operators with their roles and last-login times.

\n

Operators panel

\n

Sign in as root and a panel labelled Operators appears at the top of the dashboard, marked with a root only chip. It is collapsed by default — hit Show to expand.

\n

Inside:

\n\n

Create an operator

\n
    \n
  1. Type a Username (3 to 40 characters, lowercase). Convention: dot-separated like charlie.bigley or firstname.surname.
    2. \n
  2. Type a Password (12 to 100 characters), or hit Generate for a strong random one.
    3. \n
  3. Optional Label — human-readable, shown in the operators table to remind you who it's for (e.g. Charlie Bigley / MailMan).
    4. \n
  4. Hit Create operator. The reveal panel shows the password with a Copy button.
    5. \n
  5. Send the username and password to the new operator privately — by email, encrypted chat, or whatever secure channel you'd normally use. Not through the mock server itself.
    6. \n
\n

The reveal panel is the only point at which the password is visible in plaintext to anyone — including you. The server stores only a bcrypt hash, so if the new operator loses the password before they sign in, the only recovery path is to provision a new operator (or, in extremis, redeploy with a new ADMIN_PASSWORD to rotate the root password).

\n

List existing operators

\n

The table below the form shows everyone, in reverse-chronological order of creation. The root operator appears with role root; everyone else is operator. Last-login timestamps make it easy to spot accounts that were provisioned but never used.

\n

There is no UI for revoking, suspending, or deleting an operator at the moment — if that's needed, raise an issue or do it directly against MongoDB.

\n

API endpoints

\n

The same operations are available over the admin API for scripting. Both require an authenticated root session (cookie from /admin/api/login).

\n
# 1. Sign in as root, save the session cookie\ncurl -sS -c /tmp/rsm.jar \\\n  -H 'Content-Type: application/json' \\\n  -d '{"username":"admin","password":"YOUR-ROOT-PASSWORD"}' \\\n  https://salesforce-mock.ngx-ramblers.org.uk/admin/api/login\n\n# 2. Create an operator\ncurl -sS -b /tmp/rsm.jar \\\n  -H 'Content-Type: application/json' \\\n  -d '{\n    "username": "charlie.bigley",\n    "password": "a-strong-one-12-chars-or-more",\n    "label": "Charlie Bigley / MailMan"\n  }' \\\n  https://salesforce-mock.ngx-ramblers.org.uk/admin/api/operators\n\n# 3. List operators\ncurl -sS -b /tmp/rsm.jar \\\n  https://salesforce-mock.ngx-ramblers.org.uk/admin/api/operators\n\nrm /tmp/rsm.jar\n
\n

Bootstrapping a fresh deployment

\n

When the mock is deployed to a brand-new MongoDB, no operators exist. The deploy reads two environment variables to seed:

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
VariableUsed for
ADMIN_USERNAMEThe root operator's username (default admin)
ADMIN_PASSWORDThe root operator's initial password
BOOTSTRAP_TOKENA long random string. If set, enables the Bootstrap token sign-in tab, which signs you in as the root operator without needing the password.
\n

If you set ADMIN_PASSWORD and later change it on the running deploy, the next process restart re-hashes and updates the stored hash. That's how root password rotation works — there's no in-app rotation flow.

\n

Once the bootstrap is done and at least one real operator exists, unset BOOTSTRAP_TOKEN from the deployment so the bootstrap tab can no longer be used.

\n

Back to the overview

\n

Overview →

\n"}