FiveM Docs
Addons

esx_adminmenu

Complete guide to esx_adminmenu for ESX Legacy. Permissions, all config sections, commands, bans, admin action logs, Discord webhook and server exports.

esx_adminmenu is the official staff tool for ESX Legacy servers. It ships two interfaces: a full NUI dashboard (default F10) for players, bans, vehicles, logs and server settings, and a compact keyboard menu (default F9) for quick actions in-game. Every action is checked on the server against a configurable, per-feature permission system and written to an admin action log.

Overview

Resourceesx_adminmenu
SideClient + server (Svelte 5 NUI in web/dist)
Dependenciesesx_lib, es_extended, oxmysql
Optionalesx_ambulancejob (revive), esx_garage (impounds), pma-voice (radio), esx_skin (clothing menu), esx_status (hunger/thirst)
DatabaseCreates bans and admin_logs, extends users (automatic)

Main features:

  • Players: online list, search (including offline characters), recent players, detail panel, goto, bring, spectate, kick, ban, revive, freeze, health/armor, money, job, name, hunger/thirst, radio, routing bucket, ped model, clothing menu, give weapons, clean inventory, delete character, ACE group management.
  • Troll actions: burn, explode, sky, random teleport, nausea (each can be disabled).
  • Vehicles: spawner with customization (performance levels, turbo, xenon, neon, colors, tint, wheels, bulletproof tires), repair, clean, flip, delete; owned vehicle list with impound, unimpound and delete; /admincar to register a vehicle to yourself.
  • Server: weather, time, blackout, PvP, population density, freeze/bring/revive/kill/kick all, delete world vehicles, peds and objects, broadcasts, give money to all.
  • Bans: connection-time ban check across multiple identifier types, paginated ban list, expiry editing and unban.
  • Logs: database-backed admin action log with retention, log viewer and optional Discord webhook.

Installation

Add the resource

Place esx_adminmenu in your resources (for example inside [esx_addons]). The UI is prebuilt in web/dist; you do not need Node.js on the server.

Ensure it after its dependencies

server.cfg
ensure oxmysql
ensure es_extended
ensure esx_lib
ensure esx_adminmenu

Give yourself an admin group

Access depends on the ESX group (xPlayer.getGroup()), not on ACE. Set your group to admin with the ESX setgroup command from the server console, see admin permissions.

Restart and check the console

On start the resource prints Database tables/indexes checked/created!. No SQL import is needed.

Database changes on start

  • bans (id, identifier, identifiers, reason, banned_by, expires_at, banned_at). Old bans with a bare license get the license: prefix added.
  • admin_logs (id, created_at, actor_identifier, actor_name, namespace, action, target_identifier, target_name, success, error, payload).
  • users: adds created_at, last_seen and phone_number if missing, plus a (firstname, lastname) search index.
  • Search indexes on owned_vehicles and admin_logs.

Permissions

Access is checked in three layers, all in shared/config.lua:

LayerConfig keyPurpose
Menu accessConfig.AllowedGroupsESX groups that may open the menu and use its commands. Default { admin = true }.
Feature groupsConfig.FeaturePermissionsPer feature key, the ESX groups allowed to use it. Every key defaults to { admin = true }.
Action mappingConfig.AdminMenu.ActionPermissions, Config.PlayerActions.ActionPermissions, Config.ServerManagement.ActionPermissionsMaps each concrete action to one feature key.

Actions or feature keys without an entry are denied, so a new action never inherits broad access by accident.

Feature keys

KeyGrants
selfToolsOwn noclip, godmode, invisible, revive, heal, armor, waypoint teleport
playerVisibilityPlayer names and blips
infiniteAmmoInfinite ammo toggle
helperCommands/vec2, /vec3, /vec4, /heading, /copycoords, /rot, /model, /vehplate, copy coords
sensitiveInfoIdentifiers, IP addresses and owner fields in player and vehicle data
playerDataRadio, job, name, thirst and hunger
playerTeleportGoto and bring
spectateSpectate a player
playerNotifyNotify a single player
playerModerationSet health/armor, kill, revive, freeze
destructiveClean inventory, delete character
trollTroll actions
banManagementView, edit and revoke bans, /refreshbans
moneyGive and take money
weaponsGive all weapons from Config.AdminWeapons
routingBucketChange routing bucket
setModelChange ped model
openClothingOpen the clothing menu on a player
acePermissionsAdd and remove ACE groups listed in Config.AllowedAceGroups
vehicleSpawnerSpawn vehicles
vehicleToolsRepair, clean, flip
vehiclePerformanceTuning and visual customization
vehicleManagementImpound and unimpound owned vehicles
vehicleDestructiveDelete vehicles
vehicleOwnershipOwnership data and /admincar
serverManagementServer management tab
serverEnvironmentWeather, time, blackout, PvP, density
serverPlayerModerationFreeze/unfreeze all, bring all, revive all
serverPlayerDestructiveKick all, kill all
serverCleanupDelete world vehicles, peds, objects
serverBroadcastNotify all players
serverEconomyGive money to all players
radioLookupLook up a player's pma-voice radio channel
logViewerRead the admin action log

Example: a mod group that can open the menu, teleport, spectate and kick, but cannot see identifiers or touch money:

shared/config.lua
Config.AllowedGroups = {
	admin = true,
	mod = true,
}

Config.FeaturePermissions.playerTeleport = { admin = true, mod = true }
Config.FeaturePermissions.spectate = { admin = true, mod = true }
Config.FeaturePermissions.playerModeration = { admin = true, mod = true }

Commands use the group list too

The chat commands are registered with ESX.RegisterCommand using the groups from Config.AllowedGroups. Groups added there can run every command; the feature checks inside each command then decide what actually happens.

Configuration

General

KeyDefaultDescription
Config.DebugfalseExtra debug prints.
Config.Locale"en"Locale. Note: hardcoded, not read from the esx:locale convar.
Config.AllowedAceGroups{ admin = true }ACE groups the menu may add or remove (without the group. prefix).
Config.Keybinds.AdminMenu"F9"Default key for /adminmenu.
Config.Keybinds.AdminDashboard"F10"Default key for /admindashboard.

Config.AdminMenu

KeyDefaultDescription
NoClipSpeed1.5Base noclip speed.
NamesDistance75.0Range for player name tags.
ModelLoadTimeout5000Milliseconds to wait for a model to load.
ServerDataInterval60000Refresh interval of dashboard server data (ms).
Blip{ sprite = 1, scale = 0.85, colour = 5 }Player blip style.
Spectate{ height = 15.0, escCooldown = 5000, streamWait = 500 }Spectate camera settings.
Troll{ skyHeight = 120.0, randomRange = 500, randomHeight = 40.0, nauseaDuration = 5000 }Troll action tuning.
WaypointScan{ max = 1000, step = 25 }Ground search for waypoint teleport.
ActionPermissionssee configSelf, visibility and vehicle actions mapped to feature keys.

Config.VehicleSpawner

KeyDefaultDescription
DefaultModel"sultan"Model preselected in the spawner.
DeleteCurrentVehicleOnSpawntrueDelete the vehicle you sit in before spawning.
WarpIntoVehicletruePut the admin into the spawned vehicle.
DefaultColor"black"Default color preset id.
ColorPresets, NeonPresets, WindowTints, WheelCategories, WheelDesignslistsOptions shown in the customization UI.

Config.ServerManagement

KeyDefaultDescription
DefaultKickReason"Kicked by admin"Reason used when none is given.
DefaultWeather"CLEAR"Initial weather.
DefaultHour / DefaultMinute12 / 0Initial time.
DefaultBlackoutfalseInitial blackout state.
DefaultPvptrueInitial PvP state.
DefaultDensityfalsePopulation density used when no saved override exists. false keeps es_extended's multipliers; or { pedDensity = 0.5, vehicleDensity = 0.5, randomVehicleDensity = 0.5 }.
WeatherTypesCLEAR, EXTRASUNNY, CLOUDS, OVERCAST, RAIN, THUNDER, FOGGY, XMASWeather types allowed in the UI.
ActionPermissionssee configServer actions mapped to feature keys.

Density changes made in the dashboard are stored in the resource KVP key populationDensity:v1 and published through GlobalState["esx:populationDensity"], so they survive restarts. This needs the matching density support in es_extended's world adjustments.

Config.AdminLimits

KeyDefault
MaxReasonLength180
MaxNotificationLength240
MaxNotificationDuration30000
MaxBanDurationMinutes2628000 (5 years)
MaxMoneyAmount10000000
MaxRoutingBucket2147483647
MaxRadioChannel10000
MaxVehiclePropsBytes16384
OfflineSearchResults25
OfflineSearchCooldownMs1000
MinOfflineSearchLength3
VehiclePageSize100
BanPageSize100
RecentPlayersCap100
PlateGenAttempts50
AllowedMoneyAccounts{ money = true, bank = true, black_money = true }
AllowedNotificationTypes{ info = true, success = true, error = true }

Other sections

KeyDefaultDescription
Config.Ban.Identifierslicense, license2, discord, steam, xbl, live, fivem = true; ip = falseIdentifier types stored with a ban and matched on connect. A player is blocked if any identifier matches. IP is off to avoid false positives on shared IPs.
Config.Plate{ Letters = 3, Numbers = 3, UseSpace = true }Format of generated plates for /admincar.
Config.Clothing.Events{ "esx_skin:openSaveableMenu" }Client events fired on the target to open a clothing menu.
Config.Revive.Events{ "esx_ambulancejob:revive" }Client events sent to the target from the server on revive.
Config.Revive.UseNativeFallbacktrueAlso run a native resurrect after the events.
Config.Revive.NativeFallbackDelay250Delay (ms) before the native fallback when an event was sent.
Config.AdminWeapons9 weapons (pistol to nightstick)Weapons and ammo for "give all weapons".
Config.TrollActionsburn, explode, sky, randomTeleport, nausea = trueEnable or disable each troll action.

Config.Logs

KeyDefaultDescription
EnabledtrueRecord admin actions to admin_logs.
RetentionDays30Rows older than this are purged hourly. 0 keeps everything.
PurgeBatchSize250Rows deleted per purge statement.
PurgeBatchDelay250Wait (ms) between purge batches.
PurgeTimeBudget5000Max time (ms) per purge run.
PurgeBacklogDelay60000Delay (ms) before the next run when a backlog remains.
FlushInterval5000Queue flush interval (ms).
MaxQueue500In-memory queue cap; oldest entries are dropped when the database is down.
BatchSize100Rows per INSERT.
MaxPayloadBytes2048Larger payloads are replaced by a truncation marker.
MaxPerMinutePerActor120Per-source log rate limit, protects against spam of denied attempts.
Ignorenoclip, godmode, invisible, names, blips, copyCoordsActions that are never logged.
Webhook.Url""Discord webhook URL. Empty disables it.
Webhook.Actionsban, unban, kick, deleteCharacter, cleanInventory, giveMoney, takeMoney, giveMoneyAll, kickAll, killAll, aceAdd, aceRemoveActions forwarded to the webhook.

Keep the webhook secret

Anyone with the webhook URL can post to your channel. Do not commit a real URL to a public repository.

Commands

Opening the menus:

CommandDescription
/adminmenuOpens the compact admin menu (client command, key F9).
/adminOpens the compact admin menu (server-checked).
/admindashboardOpens the full dashboard (key F10).
/information <playerId>Opens the dashboard on a player's detail panel.

Moderation:

CommandDescription
/noclip, /names, /blipsToggle noclip, name tags, player blips.
/goto <playerId>Teleport to a player.
/bring <playerId>Bring a player to you.
/spectate <playerId> / /stopspectateStart or stop spectating.
/kick <playerId> <reason>Kick a player.
/ban <playerId> <duration> <reason>Ban a player. Duration in minutes, 0 = permanent.
/notify <playerId> <message> <type> <duration> <title>Send a notification (info, success, error).
/setmodel <playerId> <model>Change a player's ped model.
/refreshbans (/refreshbancache)Reload the ban cache after editing bans by hand.

Helpers (copy to clipboard, need helperCommands):

CommandCopies
/vec2, /vec3, /vec4Position as vec2(...), vec3(...), vec4(x, y, z, heading)
/headingHeading
/copycoordsx = ..., y = ..., z = ..., heading = ...
/rot (/rotation)Entity rotation as vec3(...)
/model (/entitymodel)Model hash of your vehicle, or your ped
/vehplate (/copyplate)Current vehicle plate

/admincar [model] spawns the given model, or takes the vehicle you are driving, and inserts it into owned_vehicles with your identifier and a generated plate. It requires vehicleOwnership.

Server exports

logAdminAction

exports.esx_adminmenu:logAdminAction(entry)

Queues an entry in the admin action log (respects Config.Logs.Enabled, Ignore, rate limit and webhook rules).

FieldTypeDescription
actionstringRequired. Action name, max 64 chars.
namespacestring?Group of the action, max 32 chars. Defaults to "unknown".
actornumber | stringPlayer source or a raw identifier.
targetnumber | string?Target source or identifier.
actorName / targetNamestring?Fallback names when no source is given.
successboolean?false marks a failed action. Default success.
errstring?Error text.
payloadtable?Extra data, JSON encoded and truncated at MaxPayloadBytes.
server/main.lua
exports.esx_adminmenu:logAdminAction({
    namespace = 'myjail',
    action = 'jail',
    actor = adminSource,
    target = targetSource,
    payload = { minutes = 30, reason = 'RDM' },
})

getAdminLogs

local result = exports.esx_adminmenu:getAdminLogs(filters)

Reads the log, newest first. All filters are optional: search (2-100 chars, prefix match on names, identifiers and action), actor, target, action, namespace, days, limit (1-200, default 50) and beforeId (cursor). Returns { logs, hasMore, nextCursor, limit }.

Events and security

  • All dashboard and menu actions go through server callbacks (esx-adminmenu:server:*). Each one re-checks the caller's group and feature permission on the server, so a modified client cannot run admin actions.
  • esx-adminmenu:server:impoundDeletedVehicle (server net event, plate) is client-triggerable but requires vehicleDestructive.
  • esx-adminmenu:client:* events (setWeather, setTime, kill, revive, troll, and so on) are sent by the server only. Do not trigger them from other resources to bypass the permission checks and logs.
  • Denied attempts are logged too, which helps spot players probing the callbacks.

Integration tips

  • Revive with another ambulance script: replace Config.Revive.Events with your script's client revive event. The native fallback still runs unless you disable it.
  • Other clothing resources: put your resource's open-menu client event into Config.Clothing.Events.
  • Impounds: with esx_garage running, the vehicle tools use its getImpounds and impoundVehicle exports.
  • Hunger and thirst: set via esx_status:set, so esx_basicneeds and esx_status must run.

Common issues

  • Menu does not open. Your ESX group is not in Config.AllowedGroups. Check with xPlayer.getGroup(); the default user group has no access.
  • Button greyed out or "Insufficient Permissions". The group is allowed to open the menu but missing in the feature key for that action.
  • Banned player still joins. The ban was added directly in SQL. Run /refreshbans, and make sure the identifier has a type prefix such as license:.
  • Ban check fails open. If the ban cache errors during playerConnecting, the player is let in and the error is printed to the console.
  • admin_logs grows large. Lower RetentionDays or reduce what is logged with Ignore.

Frequently asked questions

Independent documentation

esx-fivem.com is a community project and is not affiliated with the ESX Framework team. Facts on this page were checked against the upstream source. Official resources: docs.esx-framework.org and github.com/esx-framework.
Edit on GitHub

Last updated on

On this page