IRPCUsersAdmin.AddUser

Administration API / specialized admin session

Adds a user account to the vault, or brings back a removed one.

Service	Users `MFiles.IRPCUsersAdmin`
gRPC method	`/MFiles.IRPCUsersAdmin/AddUser`
HTTP (mf-http-grpc)	`POST /grpc/v1/add-user`
Request	`AddUserRequest`
Response	`AddUserResponse`
Book and level	Administration API, specialized
Kind	admin
Session	Required: the session ID from LogIn in the mfiles-session-id-bin metadata.
Idempotent	no
Returns metadata structure version	no
Streaming	none (unary)

Remarks

Requires the vault rights manage_users and license_allows_modifications. A new account with the full_control role also requires change_full_control_role.
login_name must not be empty ("The parameter is incorrect.") and must not belong to another user account (compared case-insensitively; "already exists").
The role run_code_on_server cannot be granted here; the server removes it.
external_id may be left empty; the server copies it from the login. A value that differs from the login's fails with "Access denied.".
addition_mode decides what happens when a removed user with the same login name exists: USER_ACCOUNT_ADDITION_MODE_UNDELETE_OR_ADD brings it back with its old user ID, so old references point to it again; USER_ACCOUNT_ADDITION_MODE_ALWAYS_ADD adds a new user ID.
The response lists background tasks that prepare the new user's permissions. Until they complete, the user's login to the vault can be refused.

Request: AddUserRequest

A structure that specifies an add user request.

Nested message fields are expanded to depth 3; follow a type link for deeper levels and for the type's own page. Fields marked (recursive) refer to a type already on their path.

Field	Type	Description
`user_account`	`UserAccount`	The new account: `login_name`, `vault_roles`, and optionally `acl` and `user_language`. `id` is ignored.
`user_account.id`	`int32`	The ID of the user account.
`user_account.login_name`	`string`	The login name that is associated with this user account (e.g. 'DOMAIN\user').
`user_account.vault_roles`	`VAULTROLES`	Bitmask of the vault roles of the user.
`user_account.vault_roles.all`	`bool`	Specifies all flags set; Including any future flags.
`user_account.vault_roles.full_control`	`bool`	Can perform any activity in the vault.
`user_account.vault_roles.can_log_in`	`bool`	Can log in to the vault.
`user_account.vault_roles.can_create_objects`	`bool`	Can create new documents.
`user_account.vault_roles.can_see_all_objects`	`bool`	Sees all documents in listings, regardless of security settings and deletion state.
`user_account.vault_roles.can_undelete_objects`	`bool`	Can undelete previously deleted documents.
`user_account.vault_roles.can_destroy_objects`	`bool`	Has permission to permanently destroy documents.
`user_account.vault_roles.can_force_undo_checkout`	`bool`	Has permission to undo a check-out performed by another user.
`user_account.vault_roles.can_change_all_object_permissions`	`bool`	Can change the security settings of all documents and modify all documents.
`user_account.vault_roles.can_change_metadata_structure`	`bool`	Can modify the meta data structure of the vault (propertydefs, profiles, value lists etc.).
`user_account.vault_roles.can_manage_users`	`bool`	Can create, edit and delete user accounts. Cannot add or remove the Vault Manager role.
`user_account.vault_roles.is_internal_user`	`bool`	An internal user of the vault. This role separates internal enad external users in the vault.
`user_account.vault_roles.can_manage_traditional_folders`	`bool`	Can create, modify and delete traditional folders. OBSOLETE: const VAULTROLES VAULTROLE_DEFINE_TEMPLATES = 1 << 12; //!< Can define templates.
`user_account.vault_roles.can_manage_common_views`	`bool`	Can create, modify and delete common views.
`user_account.vault_roles.can_manage_workflows`	`bool`	Can create, modify and delete workflows. Modifying event handlers within the workflow still requires SERVERACCESS_RUN_CODE.
`user_account.vault_roles.cannot_manage_private_views`	`bool`	Cannot create or modify private views.
`user_account.vault_roles.anonymous`	`bool`	Anonymous role.
`user_account.vault_roles.run_code_on_server`	`bool`	Can run code on the server hosting this vault. Not included in VAULTROLE_FULL_CONTROL, and cannot be ordinarily granted by it.
`user_account.acl`	`AccessControlList`	Permissions.
`user_account.acl.checked_out_to_user`	`int32`	Specifies the ID of the user who has extended rights because of the checkout operation performed by her. 0 if such user does not exist.
`user_account.acl.is_fully_authoritative`	`bool`	Specifies whether this access control list is set to ignore the secondary permissions that come from the latest checked in version.
`user_account.acl.custom_component`	`AccessControlListComponent`	Accesses the custom component of this ACL.
`user_account.acl.restrictive_components[]`	repeated `AccessControlListComponentMapEntry`	Accesses the restrictive automatic components of this ACL.
`user_account.acl.secondary_access_control_list`	`AccessControlList` (recursive)	Secondary ACL used for latest version ACL. Not used for access check if null.
`user_account.acl.additive_components[]`	repeated `AccessControlListComponentMapEntry`	Accesses the additive automatic components of this ACL.
`user_account.user_language`	`int32`	The vault language of the user.
`user_account.external_id`	`string`	The user identity in external system, such as Microsoft Entra (where the identity is a GUID). Read-only.
`addition_mode`	`UserAccountAdditionMode`	Whether a removed account with the same login name is brought back. See UserAccountAdditionMode.Values: `USER_ACCOUNT_ADDITION_MODE_ALWAYS_ADD` (0), `USER_ACCOUNT_ADDITION_MODE_UNDELETE_OR_ADD` (1), `USER_ACCOUNT_ADDITION_MODE_ONLY_UNDELETE` (2).

Response: AddUserResponse

A structure that specifies an add user response.

Nested message fields are expanded to depth 3; follow a type link for deeper levels and for the type's own page.

Field	Type	Description
`id`	`int32`	The ID of the new or restored user account.
`tasks_before_login[]`	repeated `AsyncTaskID`	Background tasks that must complete before the user can log in to the vault.
`tasks_before_login[].id`	`int64`	Task ID.
`tasks_before_login[].type`	`string`	Task type name.
`tasks_before_login[].definition`	`string`	The display string of the task definition.