Careful actions
The short list of actions that lose something, the fields that are required, and the two habits that prevent most mistakes.
This page exists because a manual that only describes screens is a manual that lets you delete something. It is short on purpose: the list of things that cannot be undone in this panel is small, and knowing it is enough.
The actions that lose something
Clearing rows in System → Advanced
The wipe prints how many rows it would clear, per table, before it does anything. Read those numbers rather than the sentence above them, and take a snapshot first. This is the only action here that can empty an installation.
Restoring a snapshot in System → Backups & exports
A restore replaces the settings as they are now with the snapshot's. Everything changed since that snapshot was taken is gone, including changes you made five minutes ago and forgot about.
Removing a snapshot
It is the only copy of what it held, unless you downloaded it. Snapshots are cheap; downloading one to another machine is the habit worth forming.
Deleting a user in People → Users
The person is removed rather than suspended. Typed confirmation, and no undo. If the intent is to stop
somebody using the product while keeping their data, there is no suspension in this version: change their
plan, set a ceiling of zero, or block their address in Platform → Rate limits & abuse.
Revoking every API key, or rotating a webhook secret
Both stop things working immediately, including things you have forgotten about. A webhook secret is copied to the clipboard when it rotates, and the old one dies at the same moment.
The fields that are required, and what happens when they are empty
| Where | Required | What an empty one does |
|---|---|---|
Platform → Webhooks | The endpoint address | The endpoint cannot be added |
Platform → Rate limits | A reason for blocking an address | The block cannot be saved |
Content → Notices | A start time | A notice with no start has no way to appear |
Content → Legal pages | The identity fields | Blanks show as brackets in the published document |
Platform → API & keys | A name and at least one scope | The key cannot be created |
Money → Plans & pricing | A name and a price | The plan cannot be created |
Save behaviour, which differs by screen
| Screen kind | When a change takes effect |
|---|---|
| A single toggle or a field with a confirmation | Immediately |
| An ordered list you are rearranging | On Save |
| Notices, including removals | On Save |
| Destructive screens | On the confirmation, which is the button |
If something you changed has not appeared, check the screen for a Save button before looking for a bug. Then
reload, because settings are cached for a moment by design. Then check System → Status & health, which is where
a missing key reports itself.
Caps, and how to tell when you are near one
Places with a limit show how many are used and how many are left, and disable the control that would exceed it. The ones you are likely to meet:
- Notices written, and notices shown at once.
- API keys per installation.
- Webhook endpoints.
- Refused words in image prompts.
A cap is a choice, not a bug
Every one of these exists to keep a screen usable or a runaway loop from writing thousands of rows. Raising one is a code change rather than a settings change, and the shipped number is the one that was tested.
The two habits
Snapshot before a batch of changes
A snapshot takes a moment and covers the whole settings document. The batch of changes is where people get into trouble, not the single careful one.
Read the audit log when something surprises you
It answers who, when and which fields moved, which is faster than reconstructing a sequence from memory. It is also the record to hand somebody who has asked what happened.
What the panel does not do, said plainly
- It cannot sign in as a user, and it cannot impersonate anybody.
- It cannot suspend an account, and there is no second factor for administrators in this version.
- It cannot edit the code in this folder. Self-update installs a release that was prepared elsewhere.
- It cannot read back a stored secret, only replace or remove one.
- It cannot undo a deletion after the confirmation. There is no recycle bin for people.
Where a capability is absent, the screen that would hold it says so, rather than leaving the gap for you to find.