# IRPCUsersAdmin.AddUser

Location: [gRPC API](https://developer.m-files.com/APIs/gRPC-API/index.md) > [Administration API](https://developer.m-files.com/APIs/gRPC-API/admin/index.md) > [Users](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCUsersAdmin/index.md)

HTML version: https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCUsersAdmin/AddUser/

Badges: `Administration API / specialized` `admin` `session`

Adds a user account to the vault, or brings back a removed one.

- **Service:** [Users](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCUsersAdmin/index.md) `MFiles.IRPCUsersAdmin`
- **gRPC method:** `/MFiles.IRPCUsersAdmin/AddUser`
- **HTTP (mf-http-grpc):** `POST /grpc/v1/add-user`
- **Request:** [`AddUserRequest`](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCUsersAdmin/AddUser/index.md#request)
- **Response:** [`AddUserResponse`](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCUsersAdmin/AddUser/index.md#response)
- **Book and level:** Administration API, specialized
- **Kind:** admin
- **Session:** Required: the session ID from LogIn in the mfiles-session-id-bin metadata.
- **Idempotent:** no
- **Returns metadata structure version:** no
- **Streaming:** none (unary)

<a id="remarks"></a>

## Remarks

- Requires the vault rights `manage_users` and `license_allows_modifications`. A new account
  with the `full_control` role also requires `change_full_control_role`.
- `login_name` must not be empty ("The parameter is incorrect.") and must not belong to another
  user account (compared case-insensitively; "already exists").
- The role `run_code_on_server` cannot be granted here; the server removes it.
- `external_id` may be left empty; the server copies it from the login. A value that differs
  from the login's fails with "Access denied.".
- `addition_mode` decides what happens when a removed user with the same login name exists:
  `USER_ACCOUNT_ADDITION_MODE_UNDELETE_OR_ADD` brings it back with its old user ID, so old
  references point to it again; `USER_ACCOUNT_ADDITION_MODE_ALWAYS_ADD` adds a new user ID.
- The response lists background tasks that prepare the new user's permissions. Until they
  complete, the user's login to the vault can be refused.

<a id="request"></a>

## Request: AddUserRequest

A structure that specifies an add user request.

> Nested message fields are expanded to depth 3; follow a type link for deeper levels and for the type's own page. Fields marked (recursive) refer to a type already on their path.

| Field | Type | Description |
|---|---|---|
| `user_account` | [`UserAccount`](https://developer.m-files.com/APIs/gRPC-API/Reference/Messages/MFiles.UserAccount/index.md) | The new account: `login_name`, `vault_roles`, and optionally `acl` and `user_language`. `id` is ignored. |
| `user_account.id` | `int32` | The ID of the user account. |
| `user_account.login_name` | `string` | The login name that is associated with this user account (e.g. 'DOMAIN\user'). |
| `user_account.vault_roles` | [`VAULTROLES`](https://developer.m-files.com/APIs/gRPC-API/Reference/Messages/MFiles.VAULTROLES/index.md) | Bitmask of the vault roles of the user. |
| `user_account.vault_roles.all` | `bool` | Specifies all flags set; Including any future flags. |
| `user_account.vault_roles.full_control` | `bool` | Can perform any activity in the vault. |
| `user_account.vault_roles.can_log_in` | `bool` | Can log in to the vault. |
| `user_account.vault_roles.can_create_objects` | `bool` | Can create new documents. |
| `user_account.vault_roles.can_see_all_objects` | `bool` | Sees all documents in listings, regardless of security settings and deletion state. |
| `user_account.vault_roles.can_undelete_objects` | `bool` | Can undelete previously deleted documents. |
| `user_account.vault_roles.can_destroy_objects` | `bool` | Has permission to permanently destroy documents. |
| `user_account.vault_roles.can_force_undo_checkout` | `bool` | Has permission to undo a check-out performed by another user. |
| `user_account.vault_roles.can_change_all_object_permissions` | `bool` | Can change the security settings of all documents and modify all documents. |
| `user_account.vault_roles.can_change_metadata_structure` | `bool` | Can modify the meta data structure of the vault (propertydefs, profiles, value lists etc.). |
| `user_account.vault_roles.can_manage_users` | `bool` | Can create, edit and delete user accounts. Cannot add or remove the Vault Manager role. |
| `user_account.vault_roles.is_internal_user` | `bool` | An internal user of the vault. This role separates internal enad external users in the vault. |
| `user_account.vault_roles.can_manage_traditional_folders` | `bool` | Can create, modify and delete traditional folders. OBSOLETE: const VAULTROLES VAULTROLE_DEFINE_TEMPLATES = 1 << 12;  //!< Can define templates. |
| `user_account.vault_roles.can_manage_common_views` | `bool` | Can create, modify and delete common views. |
| `user_account.vault_roles.can_manage_workflows` | `bool` | Can create, modify and delete workflows. Modifying event handlers within the workflow still requires SERVERACCESS_RUN_CODE. |
| `user_account.vault_roles.cannot_manage_private_views` | `bool` | Cannot create or modify private views. |
| `user_account.vault_roles.anonymous` | `bool` | Anonymous role. |
| `user_account.vault_roles.run_code_on_server` | `bool` | Can run code on the server hosting this vault. Not included in VAULTROLE_FULL_CONTROL, and cannot be ordinarily granted by it. |
| `user_account.acl` | [`AccessControlList`](https://developer.m-files.com/APIs/gRPC-API/Reference/Messages/MFiles.AccessControlList/index.md) | Permissions. |
| `user_account.acl.checked_out_to_user` | `int32` | Specifies the ID of the user who has extended rights because of the checkout operation performed by her. 0 if such user does not exist. |
| `user_account.acl.is_fully_authoritative` | `bool` | Specifies whether this access control list is set to ignore the secondary permissions that come from the latest checked in version. |
| `user_account.acl.custom_component` | [`AccessControlListComponent`](https://developer.m-files.com/APIs/gRPC-API/Reference/Messages/MFiles.AccessControlListComponent/index.md) | Accesses the custom component of this ACL. |
| `user_account.acl.restrictive_components[]` | repeated [`AccessControlListComponentMapEntry`](https://developer.m-files.com/APIs/gRPC-API/Reference/Messages/MFiles.AccessControlListComponentMapEntry/index.md) | Accesses the restrictive automatic components of this ACL. |
| `user_account.acl.secondary_access_control_list` | [`AccessControlList`](https://developer.m-files.com/APIs/gRPC-API/Reference/Messages/MFiles.AccessControlList/index.md) (recursive) | Secondary ACL used for latest version ACL. Not used for access check if null. |
| `user_account.acl.additive_components[]` | repeated [`AccessControlListComponentMapEntry`](https://developer.m-files.com/APIs/gRPC-API/Reference/Messages/MFiles.AccessControlListComponentMapEntry/index.md) | Accesses the additive automatic components of this ACL. |
| `user_account.user_language` | `int32` | The vault language of the user. |
| `user_account.external_id` | `string` | The user identity in external system, such as Microsoft Entra (where the identity is a GUID). Read-only. |
| `addition_mode` | [`UserAccountAdditionMode`](https://developer.m-files.com/APIs/gRPC-API/Reference/Enums/MFiles.UserAccountAdditionMode/index.md) | Whether a removed account with the same login name is brought back. See [UserAccountAdditionMode](https://developer.m-files.com/APIs/gRPC-API/Reference/Enums/MFiles.UserAccountAdditionMode/index.md). Values: `USER_ACCOUNT_ADDITION_MODE_ALWAYS_ADD` (0), `USER_ACCOUNT_ADDITION_MODE_UNDELETE_OR_ADD` (1), `USER_ACCOUNT_ADDITION_MODE_ONLY_UNDELETE` (2). |

<a id="response"></a>

## Response: AddUserResponse

A structure that specifies an add user response.

> Nested message fields are expanded to depth 3; follow a type link for deeper levels and for the type's own page.

| Field | Type | Description |
|---|---|---|
| `id` | `int32` | The ID of the new or restored user account. |
| `tasks_before_login[]` | repeated [`AsyncTaskID`](https://developer.m-files.com/APIs/gRPC-API/Reference/Messages/MFiles.AsyncTaskID/index.md) | Background tasks that must complete before the user can log in to the vault. |
| `tasks_before_login[].id` | `int64` | Task ID. |
| `tasks_before_login[].type` | `string` | Task type name. |
| `tasks_before_login[].definition` | `string` | The display string of the task definition. |