> ## Documentation Index
> Fetch the complete documentation index at: https://docs.czautoz.co.uk/llms.txt
> Use this file to discover all available pages before exploring further.
# Admin Panel & Permissions
> The in-game Admin Panel — who can open it, the role system, every permission key, and how to build staff roles.
## The Admin Panel
The Admin Panel is the mod's in-game management surface: a live helicopter list with teleport / repair / refuel / delete, full editors for the global and per-helicopter configs (changes apply **live** — no restart), fleet tools, spawn presets, statistics, the log viewer, and the admin & role manager itself.
* **Open it with F10** (rebindable — DayZ Options → Controls → *CZ Autoz Helicopter* group)
* It only opens for players listed as admins; everyone else's key does nothing
* Everything an admin does in the panel is written to the [activity log](/server-config/global-settings#logging) with their name and Steam GUID
## Becoming the First Owner
Admins live in their own file, next to `mod_config.json` in your server profile:
```
$profile:\CZAutoz_Heli\permissions_admins_config.json
```
The file is generated on first boot with a placeholder entry. Replace the placeholder with your **SteamID64** and restart:
```json theme={null}
{
"whitelistRetryMinutes": 15,
"entries": [
{ "steamID64": "76561198012345678", "role": "owner" }
],
"roles": [
{ "name": "owner", "permissions": ["all"] },
{ "name": "admin", "permissions": ["mod.config.view", "heli.config.view", "heli.list.view", "heli.list.teleport", "heli.list.repair", "heli.list.refuel", "heli.list.delete", "tools.spawn", "stats.view", "presets.view", "presets.spawn", "presets.save", "presets.delete", "log.view"] }
]
}
```
| Field | What it is |
| ----------------------- | ------------------------------------------------------------------------------------------------------------------------------- |
| `entries` | Your admins — each is a `steamID64` plus the `role` they hold. Nothing else; an admin's abilities come entirely from their role |
| `roles` | The role definitions — each is a `name` plus its list of permission keys |
| `whitelistRetryMinutes` | How often (minutes) the server re-checks the whitelist after a failed check. Unrelated to admins — it simply lives in this file |
The placeholder ID (`7656119XXXXXXXXXX`) is **ignored** — it never grants access. Find your SteamID64 on [steamid.io](https://steamid.io) or your Steam profile URL.
Once one owner exists, everything else — adding staff, building roles — is done **in-game** from the panel's Admins tab. The file is simply what that produces, and editing it directly (then restarting) always works too.
## How Access Works
Three layers, checked on the **server** for every single action:
1. **Are you listed?** Your SteamID64 must be in `entries` — otherwise the panel won't open at all
2. **What role do you hold?** Your entry names exactly one role
3. **What does that role grant?** The role's permission keys decide what you can see and do
The built-in **owner** role holds the special key `all` and passes every check. Every other role has exactly the keys you give it:
* **Tabs hide** when you lack their view key — an admin without `stats.view` simply has no Statistics tab
* **Action buttons stay visible** — clicking one you lack shows a **"Permission Declined"** dialog naming the exact key you're missing, so your staff know precisely what to ask you for (since v0.3.1 — earlier builds denied silently)
* The **Admins tab is visible to every admin** as a read-only roster; the add/edit/remove controls only appear with `admins.manage`
* The **Settings tab** (theme, UI scale, your own role readout) is always available
## Built-in Roles
| Role | Permissions | Notes |
| ------- | --------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- |
| `owner` | `all` — everything, always | Cannot be deleted or redefined. Only an owner can make another owner. Never appears in the roles list — it's above the system |
| `admin` | Every **view** tab, all four helicopter actions, spawning (free spawn + presets), preset management, logs | The default staff role and the fallback — cannot be deleted, but its permission list **is** yours to redefine |
The default `admin` role deliberately leaves out six keys: `mod.config.edit`, `heli.config.edit` (changing configs), `tools.reload`, `tools.repair_all`, `tools.delete_empty` (server-wide sweeps), and `admins.manage` (managing staff). A default admin can run the fleet but can't retune the server or touch the staff list.
## Every Permission Key
| Key | Unlocks | In default `admin`? |
| -------------------- | -------------------------------------------------------------------------------------------------------------- | :-----------------: |
| `all` | Everything below, plus anything added in future updates | — |
| `heli.list.view` | The **Helicopters** tab — live fleet list with positions, crew and state | ✅ |
| `heli.list.teleport` | Teleport to the selected helicopter | ✅ |
| `heli.list.repair` | Repair the selected helicopter | ✅ |
| `heli.list.refuel` | Refuel the selected helicopter | ✅ |
| `heli.list.delete` | Delete the selected helicopter | ✅ |
| `mod.config.view` | The **Mod Config** tab — see every global setting | ✅ |
| `mod.config.edit` | Save changes to the global settings (applies live) | — |
| `heli.config.view` | The **Heli Config** tab — see every per-helicopter setting | ✅ |
| `heli.config.edit` | Save or reset per-helicopter settings (applies live) | — |
| `tools.spawn` | Spawn a helicopter by classname | ✅ |
| `tools.reload` | Reload all configs from disk | — |
| `tools.repair_all` | Repair every helicopter on the server | — |
| `tools.delete_empty` | Delete every empty helicopter on the server | — |
| `stats.view` | The **Statistics** tab — fleet counts, fuel, health, server FPS | ✅ |
| `presets.view` | The **Presets** tab — see saved spawn presets | ✅ |
| `presets.spawn` | Spawn a saved preset | ✅ |
| `presets.save` | Save new spawn presets | ✅ |
| `presets.delete` | Delete spawn presets | ✅ |
| `log.view` | The **Logs** tab — all six views: Activity, Debug, Physics, Whitelist (whole fleet), Script Log and Server RPT | ✅ |
| `admins.manage` | Add/remove admins, change their roles, create and delete roles | — |
The **Tools** tab appears if you hold *any* of the four `tools.*` keys — each button inside still checks its own key.
## Creating a Staff Role
From the **Admins** tab (needs `admins.manage`), in the **Roles** box:
1. Enter a role **name** — lowercase, e.g. `moderator`
2. Enter the **permissions** as comma-separated keys from the table above
3. Click **Add** — the role exists immediately and appears in the role dropdowns
A sensible moderator role, for example:
```
heli.list.view, heli.list.teleport, heli.list.repair, heli.list.refuel, stats.view, log.view
```
They can watch the fleet, get to any helicopter, patch players up and read the logs — but can't delete aircraft, spawn anything, change a single config value, or touch the staff list.
* **Editing a role** = add it again under the same name with the new key list — the definition is replaced, and every member's panel updates **live** (since v0.3.1)
* **Typos can't hide** — unknown keys are dropped on save and named in the server's script log (`dropped unknown permission key(s): heli.list.veiw`), so a misspelled key can never sit in a role looking like it grants something (since v0.3.1)
* **Deleting a role** moves everyone who held it to the built-in `admin` role
## Managing Admins
In the **Admins** tab (needs `admins.manage`):
* **Add** — enter a SteamID64 (digits only) and pick a role, or select a **currently online player** from the dropdown and add them directly
* **Edit** — the ✎ button on a row opens the role picker for that admin
* **Remove** — the button on their row
Every change applies **live**: a newly added admin can press F10 seconds later without rejoining, a removed admin's open panel closes itself, and a role change re-syncs their tabs on the spot.
## The Safety Rails
The server enforces all of this authoritatively — a modified client changes nothing:
* **Only an owner can create another owner**, change an existing owner, or remove one
* **The last owner is untouchable** — the panel refuses to remove or demote the final owner, so you can never lock yourself out. Going to zero owners is only possible by editing the file
* **Nobody can edit their own role** through the panel — it takes a second admin (or the file). This closes the classic self-escalation loop
* **`admins.manage` is not `all`** — a non-owner staff manager cannot create a role carrying `all` or `admins.manage`, so they can never mint a role stronger than themselves and hand it out
* **`owner` and `admin` cannot be deleted** — the fallback role always exists
* **Everything is audited** — every add, edit, removal, denied attempt and live grant/revoke lands in the [activity log](/server-config/global-settings#logging) under the `ADMIN_*` tags
Locked yourself out anyway? Edit `permissions_admins_config.json` directly — add yourself back with `"role": "owner"` and restart. The file always wins.