Noviqa SDK

Appearance

staff.staff ​

11 methods on staff.staff. Each returns the answer's data and throws NoviqaError on a failed answer.

list ​

GET/admin/v1/staff

List staff users

One page of staff users (accounts in a staff group, a group beneath a managers or administrators folder), ordered by login. Limited to staff groups in the caller's group scope; group narrows further by mask. page is 1-based (default 1); limit defaults to 100 and is capped at 1000. total counts every match. Passwords are never returned.

More details

Rights: the staff member needs every one of: config.staff.

Parameters
groupstring · query
staff group mask, e.g. managers\*
logininteger · query
exact login; 0 = any
namestring · query
part of the name, any case
pageinteger · query
1-based, default 1
limitinteger · query
default 100, at most 1000
Returns
Promise<staffPage>
The answer's data.
Errors
400invalid_input: invalid input
401auth.session_expired: session expired, sign in again
403auth.invalid_terminal: this terminal cannot be used here
403auth.otp_enrol_required: your group requires one-time codes: set them up to continue
403auth.password_change_required: you must change your password first
403forbidden: you do not have access to this action
500internal: something went wrong
ts
import { staff } from "@/lib/noviqa"

const data = await staff.staff.list({
  group: "string",
  login: 1001,
  name: "string"
})
bash
curl -X GET "$NOVIQA_API_URL/admin/v1/staff?group=string&login=1001&name=string" \
  -H "Authorization: Bearer $NOVIQA_TOKEN"
json
{
  "success": true,
  "code": "ok",
  "message": "done",
  "data": {
    "items": [
      {
        "active": true,
        "created_at": "2026-09-25T10:15:00Z",
        "email": "ann@example.com",
        "group": "real\\standard",
        "group_scope": [
          "string"
        ],
        "ip_allow": [
          "string"
        ],
        "last_access": "2026-09-25T10:15:00Z",
        "last_ip": "string",
        "login": 1001,
        "logs_months": 1,
        "mailbox_name": "string",
        "name": "Ann Smith"
      }
    ],
    "page": 1,
    "total": 1
  },
  "request_id": "5b7f2c1e"
}
ts
staff.staff.list(query?: { group?, login?, name?, page?, limit? }, options?: RequestOptions): Promise<http.staffPage>

create ​

POST/admin/v1/staff

Attach manager permissions to an existing account

Requires a positive existing trading-account login; this endpoint never creates a trading account. The account's stored group must contain a complete managers or administrators folder segment (case-insensitive, slash or backslash separators), at any depth, and be within the caller's scope. Ordinary groups and substring lookalikes such as fundmanager or managers-demo are refused with invalid_input and an explanatory message. Missing accounts return not_found; missing/nonpositive logins return invalid_input. The account identity and passwords are preserved. Duplicate profiles and concurrently changed accounts return conflict. Account version increments on attachment. logs_months and reports_months are each 0-120 (0 = all). At most 64 ip_allow prefixes and 64 group_scope masks; scope needs a positive mask. Nobody may grant rights, groups or history they do not hold. Writes a config journal line and refreshes sessions. Unknown fields (including group/name/email/password creation fields) are refused.

More details

Rights: the staff member needs every one of: config.staff.

Request body
group_scopestring[]
ip_allowstring[]
logininteger
Required positive existing trading-account login. Login is the numeric identity of every account, trader or staff.
logs_monthsinteger
mailbox_namestring
reports_monthsinteger
rightsstring[]
Staff rights by name.
Returns
Promise<Member>
The answer's data.
Errors
400invalid_input: invalid input
401auth.session_expired: session expired, sign in again
403auth.csrf_invalid: request refused: reload the page and try again
403auth.invalid_terminal: this terminal cannot be used here
403auth.otp_enrol_required: your group requires one-time codes: set them up to continue
403auth.password_change_required: you must change your password first
403forbidden: you do not have access to this action
404not_found: not found
409conflict: already exists
500internal: something went wrong
ts
import { staff } from "@/lib/noviqa"

const data = await staff.staff.create({
  group_scope: [
    "real\\*"
  ],
  ip_allow: [
    "203.0.113.0/24"
  ],
  login: 1015,
  logs_months: 12,
  rights: [
    "terminal.manager",
    "accounts.view"
  ]
})
bash
curl -X POST "$NOVIQA_API_URL/admin/v1/staff" \
  -H "Authorization: Bearer $NOVIQA_TOKEN" \
  -H "Content-Type: application/json" \
  --data-raw '{
  "group_scope": [
    "real\\*"
  ],
  "ip_allow": [
    "203.0.113.0/24"
  ],
  "login": 1015,
  "logs_months": 12,
  "rights": [
    "terminal.manager",
    "accounts.view"
  ]
}'
json
{
  "success": true,
  "code": "ok",
  "message": "done",
  "data": {
    "active": true,
    "created_at": "2026-09-25T10:15:00Z",
    "email": "ann@example.com",
    "group": "real\\standard",
    "group_scope": [
      "string"
    ],
    "ip_allow": [
      "string"
    ],
    "last_access": "2026-09-25T10:15:00Z",
    "last_ip": "string",
    "login": 1001,
    "logs_months": 1,
    "mailbox_name": "string",
    "name": "Ann Smith"
  },
  "request_id": "5b7f2c1e"
}
ts
staff.staff.create(body: staff.NewMember, options?: RequestOptions): Promise<staff.Member>

retrieve ​

GET/admin/v1/staff/{login}

Get a staff user

One staff user; its group must be in the caller's group scope.

More details

Rights: the staff member needs every one of: config.staff.

Parameters
logininteger · pathrequired
Staff login.
Returns
Promise<Member>
The answer's data.
Errors
400invalid_input: invalid input
401auth.session_expired: session expired, sign in again
403auth.invalid_terminal: this terminal cannot be used here
403auth.otp_enrol_required: your group requires one-time codes: set them up to continue
403auth.password_change_required: you must change your password first
403forbidden: you do not have access to this action
404not_found: not found
500internal: something went wrong
ts
import { staff } from "@/lib/noviqa"

const data = await staff.staff.retrieve(1001)
bash
curl -X GET "$NOVIQA_API_URL/admin/v1/staff/1001" \
  -H "Authorization: Bearer $NOVIQA_TOKEN"
json
{
  "success": true,
  "code": "ok",
  "message": "done",
  "data": {
    "active": true,
    "created_at": "2026-09-25T10:15:00Z",
    "email": "ann@example.com",
    "group": "real\\standard",
    "group_scope": [
      "string"
    ],
    "ip_allow": [
      "string"
    ],
    "last_access": "2026-09-25T10:15:00Z",
    "last_ip": "string",
    "login": 1001,
    "logs_months": 1,
    "mailbox_name": "string",
    "name": "Ann Smith"
  },
  "request_id": "5b7f2c1e"
}
ts
staff.staff.retrieve(login: number, options?: RequestOptions): Promise<staff.Member>

update ​

PATCH/admin/v1/staff/{login}

Change a staff user

Changes the fields sent. Editable: group, name, mailbox_name (shown to traders writing to this staff member instead of name; "" falls back to name), email, active, rights, group_scope, ip_allow, logs_months, reports_months; version (the one last read) is required, a stale one answers conflict. The target must be in the caller's scope and hold no right the caller lacks; a new group must be a staff group in scope. Same limits as create. Nobody may disable themselves. A new group or active false signs the user out everywhere; new rights, scope, addresses or journal depth reach their live sessions at once. Nothing changed = the user comes back as it was, with no journal line; otherwise one config journal line lists the changed fields.

More details

Rights: the staff member needs every one of: config.staff.

Parameters
logininteger · pathrequired
Staff login.
Request body
activeboolean
false = may not sign in
created_atstring
UTC time, RFC 3339.
emailstring
groupstring
group_scopestring[]
ip_allowstring[]
empty = any address
last_accessstring
UTC time, RFC 3339.
last_ipstring
logininteger
Login is the numeric identity of every account, trader or staff.
logs_monthsinteger
mailbox_namestring
shown to traders instead of Name; "" = Name
namestring
reports_monthsinteger
how far back reports reach (0 = all)
rightsstring[]
Staff rights by name.
updated_atstring
UTC time, RFC 3339.
versioninteger
Returns
Promise<Member>
The answer's data.
Errors
400invalid_input: invalid input
401auth.session_expired: session expired, sign in again
403auth.csrf_invalid: request refused: reload the page and try again
403auth.invalid_terminal: this terminal cannot be used here
403auth.otp_enrol_required: your group requires one-time codes: set them up to continue
403auth.password_change_required: you must change your password first
403forbidden: you do not have access to this action
404not_found: not found
409conflict: already exists
500internal: something went wrong
ts
import { staff } from "@/lib/noviqa"

const data = await staff.staff.update(1001, {
  logs_months: 6,
  rights: [
    "accounts.view",
    "accounts.edit"
  ],
  version: 3
})
bash
curl -X PATCH "$NOVIQA_API_URL/admin/v1/staff/1001" \
  -H "Authorization: Bearer $NOVIQA_TOKEN" \
  -H "Content-Type: application/json" \
  --data-raw '{
  "logs_months": 6,
  "rights": [
    "accounts.view",
    "accounts.edit"
  ],
  "version": 3
}'
json
{
  "success": true,
  "code": "ok",
  "message": "done",
  "data": {
    "active": true,
    "created_at": "2026-09-25T10:15:00Z",
    "email": "ann@example.com",
    "group": "real\\standard",
    "group_scope": [
      "string"
    ],
    "ip_allow": [
      "string"
    ],
    "last_access": "2026-09-25T10:15:00Z",
    "last_ip": "string",
    "login": 1001,
    "logs_months": 1,
    "mailbox_name": "string",
    "name": "Ann Smith"
  },
  "request_id": "5b7f2c1e"
}
ts
staff.staff.update(login: number, body: staff.Member, options?: RequestOptions): Promise<staff.Member>

delete ​

DELETE/admin/v1/staff/{login}

Delete a staff user

Removes the staff user for good and closes their sessions; nobody may delete themselves. The target must be in the caller's scope and hold no right the caller lacks. A user who made trades, dealing log lines or journal lines cannot be removed (conflict) — disable it instead. No body. Writes a config journal line.

More details

Rights: the staff member needs every one of: config.staff.

Parameters
logininteger · pathrequired
Staff login.
Returns
Promise<null>
The answer's data.
Errors
400invalid_input: invalid input
401auth.session_expired: session expired, sign in again
403auth.csrf_invalid: request refused: reload the page and try again
403auth.invalid_terminal: this terminal cannot be used here
403auth.otp_enrol_required: your group requires one-time codes: set them up to continue
403auth.password_change_required: you must change your password first
403forbidden: you do not have access to this action
404not_found: not found
409conflict: already exists
500internal: something went wrong
ts
import { staff } from "@/lib/noviqa"

const data = await staff.staff.delete(1001)
bash
curl -X DELETE "$NOVIQA_API_URL/admin/v1/staff/1001" \
  -H "Authorization: Bearer $NOVIQA_TOKEN"
json
{
  "success": true,
  "code": "ok",
  "message": "done",
  "data": null,
  "request_id": "5b7f2c1e"
}
ts
staff.staff.delete(login: number, options?: RequestOptions): Promise<null>

disable ​

POST/admin/v1/staff/{login}/disable

Disable a staff user

Stops the user from signing in and closes their sessions; answers the user. Already disabled = answered unchanged. Nobody may disable themselves; the target must be in the caller's scope and hold no right the caller lacks. No body. Writes a config journal line.

More details

Rights: the staff member needs every one of: config.staff.

Parameters
logininteger · pathrequired
Staff login.
Returns
Promise<Member>
The answer's data.
Errors
400invalid_input: invalid input
401auth.session_expired: session expired, sign in again
403auth.csrf_invalid: request refused: reload the page and try again
403auth.invalid_terminal: this terminal cannot be used here
403auth.otp_enrol_required: your group requires one-time codes: set them up to continue
403auth.password_change_required: you must change your password first
403forbidden: you do not have access to this action
404not_found: not found
409conflict: already exists
500internal: something went wrong
ts
import { staff } from "@/lib/noviqa"

const data = await staff.staff.disable(1001)
bash
curl -X POST "$NOVIQA_API_URL/admin/v1/staff/1001/disable" \
  -H "Authorization: Bearer $NOVIQA_TOKEN"
json
{
  "success": true,
  "code": "ok",
  "message": "done",
  "data": {
    "active": true,
    "created_at": "2026-09-25T10:15:00Z",
    "email": "ann@example.com",
    "group": "real\\standard",
    "group_scope": [
      "string"
    ],
    "ip_allow": [
      "string"
    ],
    "last_access": "2026-09-25T10:15:00Z",
    "last_ip": "string",
    "login": 1001,
    "logs_months": 1,
    "mailbox_name": "string",
    "name": "Ann Smith"
  },
  "request_id": "5b7f2c1e"
}
ts
staff.staff.disable(login: number, options?: RequestOptions): Promise<staff.Member>

password ​

POST/admin/v1/staff/{login}/password

Set a staff user's password

Sets a new password and signs the user out of every session. The target must be in the caller's scope and hold no right the caller lacks. password is required. The password must be 8-16 characters (and at least the group's minimum length) with a lower case letter, an upper case letter, a digit and a symbol. Writes a config journal line (without the password).

More details

Rights: the staff member needs every one of: config.staff.

Parameters
logininteger · pathrequired
Staff login.
Request body
passwordstring
the new password
Returns
Promise<null>
The answer's data.
Errors
400auth.password_weak: password must be 8-16 characters with a lower, upper, digit and symbol
400invalid_input: invalid input
401auth.session_expired: session expired, sign in again
403auth.csrf_invalid: request refused: reload the page and try again
403auth.invalid_terminal: this terminal cannot be used here
403auth.otp_enrol_required: your group requires one-time codes: set them up to continue
403auth.password_change_required: you must change your password first
403forbidden: you do not have access to this action
404not_found: not found
500internal: something went wrong
ts
import { staff } from "@/lib/noviqa"

const data = await staff.staff.password(1001, {
  password: "N3w#Passw0rd"
})
bash
curl -X POST "$NOVIQA_API_URL/admin/v1/staff/1001/password" \
  -H "Authorization: Bearer $NOVIQA_TOKEN" \
  -H "Content-Type: application/json" \
  --data-raw '{
  "password": "N3w#Passw0rd"
}'
json
{
  "success": true,
  "code": "ok",
  "message": "done",
  "data": null,
  "request_id": "5b7f2c1e"
}
ts
staff.staff.password(login: number, body: http.docStaffPassword, options?: RequestOptions): Promise<null>

listReports ​

GET/admin/v1/staff/{login}/reports

List a manager's report lines

The server report lines of a staff member: each opens the report configurations whose name matches path (a name or mask), whether the manager may see them at all (view), whether they may export them, and how many days back (0 = no limit). Ordered by path. A staff member outside the caller's group scope reads as not found.

More details

Rights: the staff member needs every one of: config.staff.

Parameters
logininteger · pathrequired
Staff login.
Returns
Promise<ManagerReport[]>
The answer's data.
Errors
400invalid_input: invalid input
401auth.session_expired: session expired, sign in again
403auth.invalid_terminal: this terminal cannot be used here
403auth.otp_enrol_required: your group requires one-time codes: set them up to continue
403auth.password_change_required: you must change your password first
403forbidden: you do not have access to this action
404not_found: not found
500internal: something went wrong
ts
import { staff } from "@/lib/noviqa"

const data = await staff.staff.listReports(1001)
bash
curl -X GET "$NOVIQA_API_URL/admin/v1/staff/1001/reports" \
  -H "Authorization: Bearer $NOVIQA_TOKEN"
json
{
  "success": true,
  "code": "ok",
  "message": "done",
  "data": [
    {
      "can_export": true,
      "depth_days": 1,
      "id": 1,
      "login": 1001,
      "path": "real\\standard",
      "updated_at": "2026-09-25T10:15:00Z",
      "view": true
    }
  ],
  "request_id": "5b7f2c1e"
}
ts
staff.staff.listReports(login: number, options?: RequestOptions): Promise<models.ManagerReport[]>

createReports ​

POST/admin/v1/staff/{login}/reports

Add a manager report line

Opens reports to the staff member. path is required (1-255 characters, a report name or mask); depth_days is 0-36500 (0 = no limit); view defaults to true and can_export defaults to false. view false hides the report from the manager without dropping the line's can_export/depth_days settings. id and login in the body are ignored (the login comes from the URL). One line per path: a second one is a conflict. Writes a journal line. A staff member outside the caller's scope reads as not found.

More details

Rights: the staff member needs every one of: config.staff.

Parameters
logininteger · pathrequired
Staff login.
Request body
can_exportboolean
depth_daysinteger
0 = no limit on how far back
idinteger
logininteger
Login is the numeric identity of every account, trader or staff.
pathstring
name or mask
updated_atstring
UTC time, RFC 3339.
viewboolean
may see and run it at all; false hides it without dropping the line
Returns
Promise<ManagerReport>
The answer's data.
Errors
400invalid_input: invalid input
401auth.session_expired: session expired, sign in again
403auth.csrf_invalid: request refused: reload the page and try again
403auth.invalid_terminal: this terminal cannot be used here
403auth.otp_enrol_required: your group requires one-time codes: set them up to continue
403auth.password_change_required: you must change your password first
403forbidden: you do not have access to this action
404not_found: not found
409conflict: already exists
500internal: something went wrong
ts
import { staff } from "@/lib/noviqa"

const data = await staff.staff.createReports(1001, {
  can_export: true,
  depth_days: 90,
  path: "Daily\\*",
  view: true
})
bash
curl -X POST "$NOVIQA_API_URL/admin/v1/staff/1001/reports" \
  -H "Authorization: Bearer $NOVIQA_TOKEN" \
  -H "Content-Type: application/json" \
  --data-raw '{
  "can_export": true,
  "depth_days": 90,
  "path": "Daily\\*",
  "view": true
}'
json
{
  "success": true,
  "code": "ok",
  "message": "done",
  "data": {
    "can_export": true,
    "depth_days": 1,
    "id": 1,
    "login": 1001,
    "path": "real\\standard",
    "updated_at": "2026-09-25T10:15:00Z",
    "view": true
  },
  "request_id": "5b7f2c1e"
}
ts
staff.staff.createReports(login: number, body: models.ManagerReport, options?: RequestOptions): Promise<models.ManagerReport>

updateReports ​

PATCH/admin/v1/staff/{login}/reports/{id}

Change a manager report line

Changes only the fields sent (path, view, can_export, depth_days); the others keep their stored values. Same rules as adding. id and login in the body are ignored. A path another line of the member already has is a conflict. Writes a journal line.

More details

Rights: the staff member needs every one of: config.staff.

Parameters
logininteger · pathrequired
Staff login.
idinteger · pathrequired
Report line id.
Request body
can_exportboolean
depth_daysinteger
0 = no limit on how far back
idinteger
logininteger
Login is the numeric identity of every account, trader or staff.
pathstring
name or mask
updated_atstring
UTC time, RFC 3339.
viewboolean
may see and run it at all; false hides it without dropping the line
Returns
Promise<ManagerReport>
The answer's data.
Errors
400invalid_input: invalid input
401auth.session_expired: session expired, sign in again
403auth.csrf_invalid: request refused: reload the page and try again
403auth.invalid_terminal: this terminal cannot be used here
403auth.otp_enrol_required: your group requires one-time codes: set them up to continue
403auth.password_change_required: you must change your password first
403forbidden: you do not have access to this action
404not_found: not found
409conflict: already exists
500internal: something went wrong
ts
import { staff } from "@/lib/noviqa"

const data = await staff.staff.updateReports(1001, 1, {
  can_export: false,
  depth_days: 30,
  path: "Daily\\Trades",
  view: false
})
bash
curl -X PATCH "$NOVIQA_API_URL/admin/v1/staff/1001/reports/1" \
  -H "Authorization: Bearer $NOVIQA_TOKEN" \
  -H "Content-Type: application/json" \
  --data-raw '{
  "can_export": false,
  "depth_days": 30,
  "path": "Daily\\Trades",
  "view": false
}'
json
{
  "success": true,
  "code": "ok",
  "message": "done",
  "data": {
    "can_export": true,
    "depth_days": 1,
    "id": 1,
    "login": 1001,
    "path": "real\\standard",
    "updated_at": "2026-09-25T10:15:00Z",
    "view": true
  },
  "request_id": "5b7f2c1e"
}
ts
staff.staff.updateReports(login: number, id: number, body: models.ManagerReport, options?: RequestOptions): Promise<models.ManagerReport>

deleteReports ​

DELETE/admin/v1/staff/{login}/reports/{id}

Remove a manager report line

Removes one line of the staff member. Writes a journal line.

More details

Rights: the staff member needs every one of: config.staff.

Parameters
logininteger · pathrequired
Staff login.
idinteger · pathrequired
Report line id.
Returns
Promise<null>
The answer's data.
Errors
400invalid_input: invalid input
401auth.session_expired: session expired, sign in again
403auth.csrf_invalid: request refused: reload the page and try again
403auth.invalid_terminal: this terminal cannot be used here
403auth.otp_enrol_required: your group requires one-time codes: set them up to continue
403auth.password_change_required: you must change your password first
403forbidden: you do not have access to this action
404not_found: not found
500internal: something went wrong
ts
import { staff } from "@/lib/noviqa"

const data = await staff.staff.deleteReports(1001, 1)
bash
curl -X DELETE "$NOVIQA_API_URL/admin/v1/staff/1001/reports/1" \
  -H "Authorization: Bearer $NOVIQA_TOKEN"
json
{
  "success": true,
  "code": "ok",
  "message": "done",
  "data": null,
  "request_id": "5b7f2c1e"
}
ts
staff.staff.deleteReports(login: number, id: number, options?: RequestOptions): Promise<null>