# Named access control list administration (IRPCNamedACLsAdmin)

Location: [gRPC API](https://developer.m-files.com/APIs/gRPC-API/index.md) > [Administration API](https://developer.m-files.com/APIs/gRPC-API/admin/index.md)

HTML version: https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCNamedACLsAdmin/

Adds, reads, modifies and removes the named access control lists (permission templates) of a
vault.

Use this interface to add, modify and delete named ACLs in a vault.

- **gRPC service:** `MFiles.IRPCNamedACLsAdmin`
- **Book and level:** [Administration API](https://developer.m-files.com/APIs/gRPC-API/admin/index.md), specialized
- **Methods:** 5
- **Proto file:** [`mfiles/IRPCNamedACLsAdmin.proto`](https://developer.m-files.com/APIs/gRPC-API/downloads/proto/mfiles/IRPCNamedACLsAdmin.proto)

<a id="overview"></a>

## Overview

A named ACL is a reusable set of permissions with a name, such as "Visible to company management
only". Users pick one when they set the permissions of an object; value list items and classes
can apply one automatically. See
[Permissions](https://developer.m-files.com/APIs/gRPC-API/concepts/permissions/index.md). M-Files Admin
uses this service for the Named access control lists node of a vault.

- **Session and rights.** Requires a vault session. Reading needs the vault right
  `read_all_metadata_structure` ([VaultAccess](https://developer.m-files.com/APIs/gRPC-API/Reference/Messages/MFiles.VaultAccess/index.md)); adding, modifying and
  removing need `change_metadata_structure` and `license_allows_modifications`.
- **Two ACLs per named ACL** ([NamedACLAdmin](https://developer.m-files.com/APIs/gRPC-API/Reference/Messages/MFiles.NamedACLAdmin/index.md)):
  `named_acl.acl_for_objects` is the permission set that objects get; `acl` controls who can see
  and select the named ACL.
- **Types.** `NACLTYPE_NORMAL` named ACLs are offered to users. `NACLTYPE_INTERNAL` named ACLs
  hold automatic permissions defined on value list items and classes, and are not offered to
  users.
- **Built-in named ACLs** have negative IDs, for example -1 "Full control for all internal
  users" and -20 "Only for me".
- Objects that use a named ACL stay linked to it: modifying the named ACL can update their
  permissions in the background, see
  [ModifyNamedACL](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCNamedACLsAdmin/ModifyNamedACL/index.md).

Users who are not administrators read the named ACLs they can select with
[GetNamedACLs](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCNamedACLs/GetNamedACLs/index.md).

<a id="methods"></a>

## Methods

| Method | Summary | Facts |
|---|---|---|
| [AddNamedACL](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCNamedACLsAdmin/AddNamedACL/index.md) | Adds a named ACL to the vault. | `admin` `session` |
| [GetNamedACLsForAdmin](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCNamedACLsAdmin/GetNamedACLsForAdmin/index.md) | Gets the named ACLs of the given types, including the ACLs that control who sees them. | `admin` `session` `idempotent` |
| [IsNamedACLUsedInAutomaticPermissions](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCNamedACLsAdmin/IsNamedACLUsedInAutomaticPermissions/index.md) | Tells whether a named ACL is used in the automatic permissions of any value list item or class. | `admin` `session` `idempotent` |
| [ModifyNamedACL](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCNamedACLsAdmin/ModifyNamedACL/index.md) | Changes a named ACL, and optionally the permissions of the objects that use it. | `admin` `session` `idempotent` |
| [RemoveNamedACL](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCNamedACLsAdmin/RemoveNamedACL/index.md) | Removes a named ACL from the vault. | `admin` `session` |