# IRPCUsersAdmin.ModifyUser

Location: [gRPC API](https://developer.m-files.com/APIs/gRPC-API/index.md) > [Administration API](https://developer.m-files.com/APIs/gRPC-API/admin/index.md) > [Users](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCUsersAdmin/index.md)

HTML version: https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCUsersAdmin/ModifyUser/

Badges: `Administration API / specialized` `admin` `session` `idempotent`

Replaces the data of an existing user account.

- **Service:** [Users](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCUsersAdmin/index.md) `MFiles.IRPCUsersAdmin`
- **gRPC method:** `/MFiles.IRPCUsersAdmin/ModifyUser`
- **HTTP (mf-http-grpc):** `POST /grpc/v1/modify-user`
- **Request:** [`ModifyUserRequest`](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCUsersAdmin/ModifyUser/index.md#request)
- **Response:** [`ModifyUserResponse`](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCUsersAdmin/ModifyUser/index.md#response)
- **Book and level:** Administration API, specialized
- **Kind:** admin
- **Session:** Required: the session ID from LogIn in the mfiles-session-id-bin metadata.
- **Idempotent:** yes
- **Returns metadata structure version:** no
- **Streaming:** none (unary)

<a id="remarks"></a>

## Remarks

- Requires the vault rights `manage_users` and `license_allows_modifications`. Adding or
  removing the `full_control` role also requires `change_full_control_role`.
- Send the complete account: read it with [GetUser](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCUsersAdmin/GetUser/index.md),
  change what you need and send it back.
- Changing `login_name` points the user account to another login and keeps the user ID. The new
  name must not belong to another user account (compared case-insensitively). Vaults that are
  21 CFR Part 11 compliant can be configured to refuse login name changes.
- `external_id` cannot be changed here ("Access denied."); leave it as read.
- The role `run_code_on_server` cannot be set through this service: the server removes it from
  the roles you send.
- Removing `can_log_in` logs the user's sessions out of the vault.

<a id="request"></a>

## Request: ModifyUserRequest

> Nested message fields are expanded to depth 3; follow a type link for deeper levels and for the type's own page. Fields marked (recursive) refer to a type already on their path.

| Field | Type | Description |
|---|---|---|
| `user_account` | [`UserAccount`](https://developer.m-files.com/APIs/gRPC-API/Reference/Messages/MFiles.UserAccount/index.md) | The complete new data of the account; `id` identifies the account to modify. |
| `user_account.id` | `int32` | The ID of the user account. |
| `user_account.login_name` | `string` | The login name that is associated with this user account (e.g. 'DOMAIN\user'). |
| `user_account.vault_roles` | [`VAULTROLES`](https://developer.m-files.com/APIs/gRPC-API/Reference/Messages/MFiles.VAULTROLES/index.md) | Bitmask of the vault roles of the user. |
| `user_account.vault_roles.all` | `bool` | Specifies all flags set; Including any future flags. |
| `user_account.vault_roles.full_control` | `bool` | Can perform any activity in the vault. |
| `user_account.vault_roles.can_log_in` | `bool` | Can log in to the vault. |
| `user_account.vault_roles.can_create_objects` | `bool` | Can create new documents. |
| `user_account.vault_roles.can_see_all_objects` | `bool` | Sees all documents in listings, regardless of security settings and deletion state. |
| `user_account.vault_roles.can_undelete_objects` | `bool` | Can undelete previously deleted documents. |
| `user_account.vault_roles.can_destroy_objects` | `bool` | Has permission to permanently destroy documents. |
| `user_account.vault_roles.can_force_undo_checkout` | `bool` | Has permission to undo a check-out performed by another user. |
| `user_account.vault_roles.can_change_all_object_permissions` | `bool` | Can change the security settings of all documents and modify all documents. |
| `user_account.vault_roles.can_change_metadata_structure` | `bool` | Can modify the meta data structure of the vault (propertydefs, profiles, value lists etc.). |
| `user_account.vault_roles.can_manage_users` | `bool` | Can create, edit and delete user accounts. Cannot add or remove the Vault Manager role. |
| `user_account.vault_roles.is_internal_user` | `bool` | An internal user of the vault. This role separates internal enad external users in the vault. |
| `user_account.vault_roles.can_manage_traditional_folders` | `bool` | Can create, modify and delete traditional folders. OBSOLETE: const VAULTROLES VAULTROLE_DEFINE_TEMPLATES = 1 << 12;  //!< Can define templates. |
| `user_account.vault_roles.can_manage_common_views` | `bool` | Can create, modify and delete common views. |
| `user_account.vault_roles.can_manage_workflows` | `bool` | Can create, modify and delete workflows. Modifying event handlers within the workflow still requires SERVERACCESS_RUN_CODE. |
| `user_account.vault_roles.cannot_manage_private_views` | `bool` | Cannot create or modify private views. |
| `user_account.vault_roles.anonymous` | `bool` | Anonymous role. |
| `user_account.vault_roles.run_code_on_server` | `bool` | Can run code on the server hosting this vault. Not included in VAULTROLE_FULL_CONTROL, and cannot be ordinarily granted by it. |
| `user_account.acl` | [`AccessControlList`](https://developer.m-files.com/APIs/gRPC-API/Reference/Messages/MFiles.AccessControlList/index.md) | Permissions. |
| `user_account.acl.checked_out_to_user` | `int32` | Specifies the ID of the user who has extended rights because of the checkout operation performed by her. 0 if such user does not exist. |
| `user_account.acl.is_fully_authoritative` | `bool` | Specifies whether this access control list is set to ignore the secondary permissions that come from the latest checked in version. |
| `user_account.acl.custom_component` | [`AccessControlListComponent`](https://developer.m-files.com/APIs/gRPC-API/Reference/Messages/MFiles.AccessControlListComponent/index.md) | Accesses the custom component of this ACL. |
| `user_account.acl.restrictive_components[]` | repeated [`AccessControlListComponentMapEntry`](https://developer.m-files.com/APIs/gRPC-API/Reference/Messages/MFiles.AccessControlListComponentMapEntry/index.md) | Accesses the restrictive automatic components of this ACL. |
| `user_account.acl.secondary_access_control_list` | [`AccessControlList`](https://developer.m-files.com/APIs/gRPC-API/Reference/Messages/MFiles.AccessControlList/index.md) (recursive) | Secondary ACL used for latest version ACL. Not used for access check if null. |
| `user_account.acl.additive_components[]` | repeated [`AccessControlListComponentMapEntry`](https://developer.m-files.com/APIs/gRPC-API/Reference/Messages/MFiles.AccessControlListComponentMapEntry/index.md) | Accesses the additive automatic components of this ACL. |
| `user_account.user_language` | `int32` | The vault language of the user. |
| `user_account.external_id` | `string` | The user identity in external system, such as Microsoft Entra (where the identity is a GUID). Read-only. |

<a id="response"></a>

## Response: ModifyUserResponse

No fields.

<a id="related"></a>

## Related methods

- [GetUser](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCUsersAdmin/GetUser/index.md): Gets one user account by ID.