## On this page

Certain operations require Medplum [Users](/content/docs/api/fhir/medplum/user/index.html), [`Bots`](/content/docs/api/fhir/medplum/bot/index.html), or [`ClientApplications`](/content/docs/api/fhir/medplum/clientapplication/index.html) to have administrative privileges. Users can be granted admin rights on a per-project basis: a given user can be an admin for one project, but not another.

Medplum distinguishes between two different types of admin user: **project admin** and **super admin**.

## Project Admin [​](/content/docs/access/admin#project-admin "Direct link to Project Admin"/index.html)

A project (or tenant) level user. This is the most common type of admin user at an organization.

See our [User Management Guide](/content/docs/user-management#promote-existing-user-to-admin/index.html) for more information on how to grant project admin privileges.

Project Admins have the following privileges:

- **Invite / remove users** \- See our [User Management Guide](/content/docs/user-management/index.html) for mor information  
- **Create Bots** \- See our guide on [Bots](/content/docs/bots/bot-basics/index.html) to learn how to create and write Bots  
- **Write the `meta.account` element** \- Every resource has a `meta.account` property that can be used for advanced access control scenarios. See our guide on [access policies](/content/docs/access/access-policies/index.html) for more information.
- **View Administrative Resources** \- The following Medplum resource types are only accessible to project admin [Users](/content/docs/api/fhir/medplum/user/index.html), [`Bots`](/content/docs/api/fhir/medplum/bot/index.html), or [`ClientApplications`](/content/docs/api/fhir/medplum/clientapplication/index.html):  
  - [`Project`](/content/docs/api/fhir/medplum/project/index.html) \- used to adjust [Project settings](/content/docs/access/projects#settings/index.html)  
  - [`ProjectMembership`](/content/docs/api/fhir/medplum/projectmembership/index.html) \- used to manage user registration and privileges (see: [User Management Guide](/content/docs/user-management/index.html))  
  - [`UserSecurityRequest`](/content/docs/api/fhir/medplum/usersecurityrequest/index.html) \- used to [send custom emails](/content/docs/user-management/custom-emails#password-change-request-bot/index.html)  
  - [`User`](/content/docs/api/fhir/medplum/user/index.html) \- only for [project scoped users](/content/docs/user-management/project-vs-server-scoped-users#project-scoped-users/index.html)  
- **Impersonate users** \- Project Admins are allowed to make API calls [on behalf of other users](/content/docs/auth/on-behalf-of/index.html)

Applying Access Policies to Admins

If you want to limit these privileges, you can apply Access Policies to your Admin users. See the [Access Policies docs](/content/docs/access/access-policies/index.html) for more details.

## Super Admin [​](/content/docs/access/admin#super-admin "Direct link to Super Admin"/index.html)

A super admin user has an increased level privileges for performing server-level operations. **This level of privilege can cause irreparable data changes, and should be limited to system administrators.**

To grant a user super admin privilege, invite them to the Super Admin project (see [this guide](/content/docs/access/projects#superadmin/index.html) for more details).

Project Admins have the following privileges:

- **Overwrite all resource fields** \- Super admin users bypass all data validation checks, and can edit protected fields like `id` and `meta` properties.
- **Rebuild shared data structures** \- Certain shared resources, such as `StructureDefinitions` and `ValueSets`, sometimes need to be built after some server updates. See the [Super Admin Guide](/content/docs/self-hosting/super-admin-guide/index.html) for more details.
- **Create projects via API** \- Because [`Projects`](/content/docs/api/fhir/medplum/project/index.html) are system-level resources, creating them via API requires the creation of a Super Admin [`ClientApplication`](/content/docs/api/fhir/medplum/clientapplication/index.html)  
- [Project Admin](/content/docs/access/admin#project-admin/index.html)  
- [Super Admin](/content/docs/access/admin#super-admin/index.html)