The admin

The admin lives at /_/ on your server. It manages collections, records, users, hooks, settings and everything else; this page covers how it’s laid out and the API preview.

The sidebar

The sidebar always shows Dashboard, Collections, Logs, Hooks (with custom routes, cron jobs and queue workers), MCP, Superusers and Settings. Pages you may never need stay out of it until you do:

Page	Appears when
Feature flags	a flag exists
Webhooks	a webhook exists
API tokens	a token exists
Monitoring, API preview, SQL, Audit log	you open, favorite or pin them

Any of them also shows while it’s open, if it’s a favorite, or if it’s pinned. Hidden pages are one click away under More at the bottom of the sidebar, and ⌘ K finds every page. Nothing is turned off: the API, the SDK and MCP work the same whether a page is in the sidebar or not.

Settings → Sidebar pins pages so they always show, for every admin on the instance.

Favorites

Hover a row and click its star to add the page to Favorites at the top of the sidebar; click it again to remove it. Favorites are yours alone and are kept on the server, so they follow you to other browsers.

Records

Open a collection and click a record to edit it in a drawer; a singleton’s one record is a form on its page. New record opens the same fields in a modal.

A file field shows its files with a remove button on each, and an Upload button (Replace for a single-file field with a file, Add files for a multi-file one) that follows the field’s allowed types. Uploading stores the file right away and the field names it once you Save; a file left unsaved is deleted by the hourly file sweep. Files belong to an existing record, so a new record gets its files after it’s created.

API preview

API preview is a small HTTP client for your instance. Use it to try an endpoint, check what a rule lets a user do, or get the code for a request.

Endpoints

The list on the left comes from your instance’s OpenAPI spec, so it matches your collections: list, create, get, update and delete for each collection, sign-in routes for auth collections, GET and PATCH for singletons, and reads for views. Click one to open it in a new tab. A path with {id} is filled with a real record so it works as is. The reload button picks up collections you’ve added since.

Building a request

• Params: query parameters as a table, kept in step with the URL; switch a row off to leave it out. Path values such as {id} have their own fields.
• Headers: extra headers, each with an on/off box.
• Body: JSON, with sample values from the collection’s schema, or form data, which can attach files for upload.

Several requests can be open at once, each in its own tab. ⌘ ↵ (Ctrl ↵) sends the one in front.

Sending as someone else

The Auth tab decides who the request is from:

Mode	Sent as
Admin	your admin session. Admins pass every rule.
A user	a user of an auth collection, signed in with their email and password
Token	any token you paste
No auth	a signed-out visitor

Because admins pass every rule, use A user or No auth to see what your rules really allow. A user’s token stays in the page’s memory and is gone when you reload; a pasted token is never saved. A user with MFA on can’t sign in here; sign in elsewhere and paste the token under Token.

The response

The response shows the status, how long it took, its size and headers, and the body pretty-printed or raw. Code gives the request as a Vaultbase SDK call, fetch() or curl, with <token> where your token goes.

History and saved requests

History keeps your last 50 requests in this browser. Save, next to Send, names a request and keeps it under Saved, on the server and for you only. Neither keeps pasted tokens or attached files.

Export

Export downloads your API for other tools:

Format	For
OpenAPI spec	code generators and API docs
Postman collection	Postman (collection v2.1)
Insomnia	Insomnia (export format 4)
.http file	the VS Code REST Client and JetBrains HTTP Client

The Postman, Insomnia and .http exports have every endpoint, grouped by collection, with sample bodies and two variables to set: baseUrl (filled with this instance’s address) and token.