# IRPCUsersAdmin.AddOrUndeleteUser

Location: [gRPC API](https://developer.m-files.com/APIs/gRPC-API/index.md) > [Administration API](https://developer.m-files.com/APIs/gRPC-API/admin/index.md) > [Users](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCUsersAdmin/index.md)

HTML version: https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCUsersAdmin/AddOrUndeleteUser/

Badges: `Administration API / specialized` `admin` `session`

Adds a user account, or brings back a removed one with the same login name.

- **Service:** [Users](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCUsersAdmin/index.md) `MFiles.IRPCUsersAdmin`
- **gRPC method:** `/MFiles.IRPCUsersAdmin/AddOrUndeleteUser`
- **HTTP (mf-http-grpc):** `POST /grpc/v1/add-or-undelete-user`
- **Request:** [`AddOrUndeleteUserRequest`](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCUsersAdmin/AddOrUndeleteUser/index.md#request)
- **Response:** [`AddOrUndeleteUserResponse`](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCUsersAdmin/AddOrUndeleteUser/index.md#response)
- **Book and level:** Administration API, specialized
- **Kind:** admin
- **Session:** Required: the session ID from LogIn in the mfiles-session-id-bin metadata.
- **Idempotent:** no
- **Returns metadata structure version:** no
- **Streaming:** none (unary)

<a id="remarks"></a>

## Remarks

- Same as [AddUser](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCUsersAdmin/AddUser/index.md) with `addition_mode`
  `USER_ACCOUNT_ADDITION_MODE_UNDELETE_OR_ADD`, but without `tasks_before_login` in the
  response. Prefer [AddUser](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCUsersAdmin/AddUser/index.md).

<a id="request"></a>

## Request: AddOrUndeleteUserRequest

> Nested message fields are expanded to depth 3; follow a type link for deeper levels and for the type's own page. Fields marked (recursive) refer to a type already on their path.

| Field | Type | Description |
|---|---|---|
| `user_account` | [`UserAccount`](https://developer.m-files.com/APIs/gRPC-API/Reference/Messages/MFiles.UserAccount/index.md) | The new account. `login_name` is required; `id` is ignored. A removed user with the same login name is brought back with its old ID. |
| `user_account.id` | `int32` | The ID of the user account. |
| `user_account.login_name` | `string` | The login name that is associated with this user account (e.g. 'DOMAIN\user'). |
| `user_account.vault_roles` | [`VAULTROLES`](https://developer.m-files.com/APIs/gRPC-API/Reference/Messages/MFiles.VAULTROLES/index.md) | Bitmask of the vault roles of the user. |
| `user_account.vault_roles.all` | `bool` | Specifies all flags set; Including any future flags. |
| `user_account.vault_roles.full_control` | `bool` | Can perform any activity in the vault. |
| `user_account.vault_roles.can_log_in` | `bool` | Can log in to the vault. |
| `user_account.vault_roles.can_create_objects` | `bool` | Can create new documents. |
| `user_account.vault_roles.can_see_all_objects` | `bool` | Sees all documents in listings, regardless of security settings and deletion state. |
| `user_account.vault_roles.can_undelete_objects` | `bool` | Can undelete previously deleted documents. |
| `user_account.vault_roles.can_destroy_objects` | `bool` | Has permission to permanently destroy documents. |
| `user_account.vault_roles.can_force_undo_checkout` | `bool` | Has permission to undo a check-out performed by another user. |
| `user_account.vault_roles.can_change_all_object_permissions` | `bool` | Can change the security settings of all documents and modify all documents. |
| `user_account.vault_roles.can_change_metadata_structure` | `bool` | Can modify the meta data structure of the vault (propertydefs, profiles, value lists etc.). |
| `user_account.vault_roles.can_manage_users` | `bool` | Can create, edit and delete user accounts. Cannot add or remove the Vault Manager role. |
| `user_account.vault_roles.is_internal_user` | `bool` | An internal user of the vault. This role separates internal enad external users in the vault. |
| `user_account.vault_roles.can_manage_traditional_folders` | `bool` | Can create, modify and delete traditional folders. OBSOLETE: const VAULTROLES VAULTROLE_DEFINE_TEMPLATES = 1 << 12;  //!< Can define templates. |
| `user_account.vault_roles.can_manage_common_views` | `bool` | Can create, modify and delete common views. |
| `user_account.vault_roles.can_manage_workflows` | `bool` | Can create, modify and delete workflows. Modifying event handlers within the workflow still requires SERVERACCESS_RUN_CODE. |
| `user_account.vault_roles.cannot_manage_private_views` | `bool` | Cannot create or modify private views. |
| `user_account.vault_roles.anonymous` | `bool` | Anonymous role. |
| `user_account.vault_roles.run_code_on_server` | `bool` | Can run code on the server hosting this vault. Not included in VAULTROLE_FULL_CONTROL, and cannot be ordinarily granted by it. |
| `user_account.acl` | [`AccessControlList`](https://developer.m-files.com/APIs/gRPC-API/Reference/Messages/MFiles.AccessControlList/index.md) | Permissions. |
| `user_account.acl.checked_out_to_user` | `int32` | Specifies the ID of the user who has extended rights because of the checkout operation performed by her. 0 if such user does not exist. |
| `user_account.acl.is_fully_authoritative` | `bool` | Specifies whether this access control list is set to ignore the secondary permissions that come from the latest checked in version. |
| `user_account.acl.custom_component` | [`AccessControlListComponent`](https://developer.m-files.com/APIs/gRPC-API/Reference/Messages/MFiles.AccessControlListComponent/index.md) | Accesses the custom component of this ACL. |
| `user_account.acl.restrictive_components[]` | repeated [`AccessControlListComponentMapEntry`](https://developer.m-files.com/APIs/gRPC-API/Reference/Messages/MFiles.AccessControlListComponentMapEntry/index.md) | Accesses the restrictive automatic components of this ACL. |
| `user_account.acl.secondary_access_control_list` | [`AccessControlList`](https://developer.m-files.com/APIs/gRPC-API/Reference/Messages/MFiles.AccessControlList/index.md) (recursive) | Secondary ACL used for latest version ACL. Not used for access check if null. |
| `user_account.acl.additive_components[]` | repeated [`AccessControlListComponentMapEntry`](https://developer.m-files.com/APIs/gRPC-API/Reference/Messages/MFiles.AccessControlListComponentMapEntry/index.md) | Accesses the additive automatic components of this ACL. |
| `user_account.user_language` | `int32` | The vault language of the user. |
| `user_account.external_id` | `string` | The user identity in external system, such as Microsoft Entra (where the identity is a GUID). Read-only. |

<a id="response"></a>

## Response: AddOrUndeleteUserResponse

> Nested message fields are expanded to depth 3; follow a type link for deeper levels and for the type's own page.

| Field | Type | Description |
|---|---|---|
| `id` | `int32` | The ID of the new or restored user account. |

<a id="related"></a>

## Related methods

- [AddUser](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCUsersAdmin/AddUser/index.md): Adds a user account to the vault, or brings back a removed one.
- [AddOrUndeleteUserViaADSync](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCUsersAdmin/AddOrUndeleteUserViaADSync/index.md): Adds a user account during a directory import; brings back a removed account only when the vault allows that.