Actions
Bug #26
closedAPI Allows Admin Creation Without Mandatory Fields (Name & Role) Bypassing UI Validation
Status:
Closed
Priority:
Normal
Assignee:
-
Start date:
03/19/2026
Due date:
% Done:
100%
Estimated time:
Description
Environment:
URL: https://dev.akinderwellness.com/pages/adminManagement
Module: Admin Management
API: /api/admin/add-admin
Description:
The UI enforces mandatory fields such as First Name, Last Name, and Role while creating a new admin user. However, the backend API allows admin creation without these required fields.
This results in inconsistent validation between frontend and backend and allows creation of incomplete or misconfigured admin accounts.
Steps to Reproduce:
- Open Postman
- Send POST request to:
/api/admin/add-admin - Provide only:
email
password
Do NOT include:
- first name
- last name
- role
- Send request
Actual Result:
- Admin user is successfully created
- Response returns 200 OK
- User is created with null role and missing name fields
Expected Result:
- API should reject the request
- Proper validation error should be returned:
"First Name is required"
"Last Name is required"
"Role is required"
Files
Actions