# Share a server with other users

> Give another Coritan account access to your server and choose exactly what it can do, permission by permission.

Source: https://www.coritan.com/docs/managed-containers/users/

In the dashboard:

- /dashboard/servers/…/users: https://www.coritan.com/dashboard/servers

The **Users** tab gives another Coritan account access to your server. The other person signs in to their own account, finds the server on their **Container Apps** page and can do only what you allow. You never share your password, and billing stays with you: other users cannot see your invoices, change the plan or cancel the server.

## Before you begin

- The other person needs a Coritan account. You add them by its user ID, a number. No dashboard page shows it yet, so ask them to read `id` in the answer to `GET /api/v1/auth/me`, as [Profile](/docs/account/profile/#with-the-api) shows.
- You must own the server, or hold the Manage users permission on it.
- We do not email the other person or ask them to accept. Tell them yourself once you have added them.

## Add a user

1. In the [dashboard](https://www.coritan.com/dashboard/servers), go to **Container Apps** and open the server, then the **Users** tab.
2. Select **Add user…**.
3. In **User ID**, enter the other account's user ID, for example `10482`.
4. Under **Permissions**, tick what they may do. [Choose permissions](#choose-permissions) explains each one.
5. Select **Add user**.

The user joins the list, and the server appears on their **Container Apps** page.

## Choose permissions

Each permission in the list covers one area of the server:

| Permission | What it allows |
|---|---|
| Power | Start, stop, restart and kill the server, and wake a sleeping free server. |
| Command | Run commands in the console. |
| Console | Open the console. It grants the same as Command, so once you save either one, the list shows both. |
| Files | Browse, edit, upload, download and delete files, compress and extract archives, connect over [SFTP](/docs/managed-containers/sftp/) and [import files from another host](/docs/managed-containers/import/). |
| Snapshots | Take snapshots of this server, list them and restore a snapshot onto this server. |
| Backups | List, restore, download, lock and delete the server's [backups](/docs/managed-containers/backups/). |
| Databases | Create databases, see their passwords, set new passwords and delete databases. |
| Schedules | Create, change, run and delete [schedules](/docs/managed-containers/schedules/). Each task also needs the permission for its action. |
| Manage users | Add, change and remove other users on this server. |
| Manage rules | Create, change and delete [rules](/docs/managed-containers/rules/). |
| Install software | Search the catalogue, install and update plugins, mods and packs, turn them on and off, and set the resource pack. |

> [!WARNING]
> A user with Manage users can give anyone any permission, including permissions they do not hold themselves. Give it only to someone you would trust with the whole server.

Some things need a permission that the list does not offer, and you can grant these only [through the API](#with-the-api):

- The **Ports** tab needs the `allocation` permissions.
- The Java settings need `startup.read` and `startup.update`.
- Removing a plugin, mod, pack or the resource pack needs `software.delete`.
- Changing the server's software needs `settings.reinstall` as well as Install software.
- Starting in safe mode needs Power as well as Install software.

Downloading, locking and deleting a snapshot work only from the account that holds it, so another user cannot do them even with the Snapshots permission.

## Change what a user can do

1. On the **Users** tab, open the menu at the end of the user's row and select **Edit permissions…**.
2. Tick or clear permissions.
3. Select **Save permissions**.

The change applies straight away. If the user has the console open, it closes, and the new permissions apply when they open it again.

Saving keeps any permission you granted through the API that the list does not show, such as `allocation.read`. A wildcard is the exception: saving replaces `*`, or a whole-area grant such as `file.*`, with the permissions of the boxes that are ticked.

## Remove a user

1. On the **Users** tab, open the menu at the end of the user's row and select **Remove user…**.
2. Select **Remove user** to confirm.

They lose access to the server at once, and any console they have open closes. Their account and their own servers are not affected.

## What the other user sees

- The server is on their **Container Apps** page, with every tab. An action they have no permission for fails with `Insufficient permissions`.
- On the **Users** tab they see the other users by name, without email addresses. They see their own email address, but not yours.
- They connect over SFTP with their own email address and password.

## Result

The dashboard confirms each change with `User added.`, `Permissions updated.` or `User removed.`. The **Access** column lists each user's permissions, and the line under their name shows how many permission keys they hold and when you added them.

## Troubleshooting

`That user already owns this server`
: You entered your own user ID. Enter the other person's.

`User 10482 is already a subuser on this server`
: That account already has access. Use **Edit permissions…** on its row instead. The same message appears when no account has that user ID, so check the number with the other person.

`Insufficient permissions`
: The user tried something their permissions do not cover. The owner adds the permission with **Edit permissions…**.

**No permissions this panel knows of**
: The user holds only permissions that the list does not show, granted through the API. They keep them when you save.

The server is missing from the other person's **Container Apps** page
: Check that they signed in to the account whose user ID you entered, then ask them to reload the page.

## Related

- [Use the console and power controls](/docs/managed-containers/console/)
- [Connect to a server with SFTP](/docs/managed-containers/sftp/)
- [Schedule server tasks](/docs/managed-containers/schedules/)
- [Manage server ports](/docs/managed-containers/ports/)

## With the API

`GET /api/v1/client/servers/{uuid}/users` lists the users on a server. Each entry has `id` (the entry's own number), `user_id` (the account's user ID), `permissions`, `created_at`, `email` and `name`. When a user who is not the owner asks, `email` is `null` on every entry but their own.

Add a user with `POST /api/v1/client/servers/{uuid}/users`. The body takes `user_id` and `permissions`, a list of permission keys:

```bash
curl -X POST https://api.coritan.com/api/v1/client/servers/$SERVER/users \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"user_id": 10482, "permissions": ["control.console", "control.start", "control.stop", "control.restart", "file.read", "file.read-content"]}'
```

The response (`201`) is the new entry:

```json
{
  "id": 318,
  "server_id": 2207,
  "user_id": 10482,
  "permissions": ["control.console", "control.start", "control.stop", "control.restart", "file.read", "file.read-content"],
  "created_at": "2026-09-25T14:30:00",
  "email": "sam@example.com",
  "name": "Sam Taylor"
}
```

The other routes take the entry's `id`, not the user ID:

| Route | What it does |
|---|---|
| `PUT /api/v1/client/servers/{uuid}/users/{subuser_id}` | Replaces the user's permissions with the `permissions` list in the body. |
| `DELETE /api/v1/client/servers/{uuid}/users/{subuser_id}` | Removes the user and answers `{"message": "Subuser removed"}`. |

These are the permission keys, by area. `*` grants every key, and an area followed by `.*`, such as `file.*`, grants every key in that area. The list must hold at least one key.

| Area | Keys | What the dashboard's list grants |
|---|---|---|
| `control` | `console`, `start`, `stop`, `restart`, `kill` | Command and Console grant `console`; Power grants the other four. |
| `file` | `read`, `read-content`, `create`, `update`, `update-content`, `delete`, `archive`, `sftp` | Files grants all eight. |
| `snapshot` | `create`, `read`, `delete`, `restore`, `download` | Snapshots grants all five. |
| `backup` | `create`, `read`, `delete`, `restore`, `download` | Backups grants all five. |
| `database` | `create`, `read`, `update`, `delete`, `view_password` | Databases grants all five. |
| `schedule` | `create`, `read`, `update`, `delete` | Schedules grants all four. |
| `user` | `create`, `read`, `update`, `delete` | Manage users grants all four. |
| `settings` | `automation`, `reinstall`, `rename` | Manage rules grants `automation`. |
| `software` | `search`, `read`, `install`, `update`, `delete` | Install software grants `search`, `read` and `install`. |
| `allocation` | `read`, `create`, `update`, `delete` | None. |
| `startup` | `read`, `update`, `docker-image` | None. |

A key is the area and the name joined by a full stop, for example `file.read-content`. We accept `settings.rename`, `software.update` and `startup.docker-image`, but nothing checks them yet. Each guide in this section names the keys its routes need.

Adding a user needs `user.create`, changing one needs `user.update` and removing one needs `user.delete`. Any user on the server can list the users. Errors answer `400` with the reasons in [Troubleshooting](#troubleshooting), `Unknown permission: file.rename` for a key that does not exist and `Select at least one permission` for an empty list. A `subuser_id` that is not on the server answers `404` with `Subuser not found`.

## API

- `GET /api/v1/client/servers/{uuid}/users`: List subusers for a server (https://www.coritan.com/docs/api/reference/client/container-apps/servers-users/#op-get-api-v1-client-servers-uuid-users)
- `POST /api/v1/client/servers/{uuid}/users`: Add a subuser to a server (https://www.coritan.com/docs/api/reference/client/container-apps/servers-users/#op-post-api-v1-client-servers-uuid-users)
- `PUT /api/v1/client/servers/{uuid}/users/{subuser_id}`: Update subuser permissions (https://www.coritan.com/docs/api/reference/client/container-apps/servers-users/#op-put-api-v1-client-servers-uuid-users-subuser-id)
- `DELETE /api/v1/client/servers/{uuid}/users/{subuser_id}`: Remove a subuser from a server (https://www.coritan.com/docs/api/reference/client/container-apps/servers-users/#op-delete-api-v1-client-servers-uuid-users-subuser-id)