# Vault login accounts (IRPCVaultLoginsAdmin)

Location: [gRPC API](https://developer.m-files.com/APIs/gRPC-API/index.md) > [Administration API](https://developer.m-files.com/APIs/gRPC-API/admin/index.md)

HTML version: https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCVaultLoginsAdmin/

Manages vault login accounts: login accounts stored in one vault, used on servers that have
vault login accounts enabled, such as M-Files Cloud.

Use this interface to add, modify and delete vault logins.

- **gRPC service:** `MFiles.IRPCVaultLoginsAdmin`
- **Book and level:** [Administration API](https://developer.m-files.com/APIs/gRPC-API/admin/index.md), specialized
- **Methods:** 17
- **Proto file:** [`mfiles/IRPCVaultLoginsAdmin.proto`](https://developer.m-files.com/APIs/gRPC-API/downloads/proto/mfiles/IRPCVaultLoginsAdmin.proto)

<a id="overview"></a>

## Overview

A login account is what a person or application authenticates with: account type (M-Files or
Windows), user name, password, license type, full name and email
([Login](https://developer.m-files.com/APIs/gRPC-API/Reference/Messages/MFiles.Login/index.md)). Normally login accounts belong to the server and are managed by
system administrators with [IRPCLoginsAdmin](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLoginsAdmin/index.md). On a server with
**vault login accounts** enabled, each vault keeps its own login accounts in the vault, and
vault administrators manage them with this service. Either way, a login needs a user account in
the vault ([IRPCUsersAdmin](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCUsersAdmin/index.md)) to use the vault; see the table in
the [IRPCUsersAdmin](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCUsersAdmin/index.md) overview.

- **Availability.** Vault login accounts are a server-wide setting. Check it anonymously with
  [GetServerCapabilities](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLogin/GetServerCapabilities/index.md):
  `server_capabilities.vault_login_accounts`. An M-Files Cloud server returned true; a default
  on-premises server returns false. When it is false, **every method of this service** fails
  with "This operation is currently not available. The registry key for enabling vault-specific
  login accounts needs to be set first." (error code 0x8004093A), before the session is checked.
- **Session and rights.** Requires a vault session; the methods work on the logins of that
  vault. Most methods need the vault right `manage_users`
  ([VaultAccess](https://developer.m-files.com/APIs/gRPC-API/Reference/Messages/MFiles.VaultAccess/index.md)); the server role system administrator is not
  needed. A server can be configured to make vault login accounts read-only for vault
  administrators: then
  [AddVaultLogin](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCVaultLoginsAdmin/AddVaultLogin/index.md),
  [ModifyVaultLogin](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCVaultLoginsAdmin/ModifyVaultLogin/index.md),
  [ModifyVaultLoginEx](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCVaultLoginsAdmin/ModifyVaultLoginEx/index.md) and
  [RemoveVaultLogin](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCVaultLoginsAdmin/RemoveVaultLogin/index.md) also need the system
  administrator server role (server right `manage_logins`).
- **Server and vault logins together.** When a vault login and a server login have the same
  account name, the vault login is used for that vault. A vault login can never have the system
  administrator role. While vault login accounts are enabled, server-level
  [AddLogin](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLoginsAdmin/AddLogin/index.md) accepts only system administrators.
- **Logins with an External ID** (`Login.external_id`) are maintained by identity
  synchronization (M-Files Manage); removing or renaming them here fails.

Methods by task (the server-level equivalents are in
[IRPCLoginsAdmin](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLoginsAdmin/index.md)):

- **Read:** [GetVaultLogins](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCVaultLoginsAdmin/GetVaultLogins/index.md),
  [GetVaultLogin](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCVaultLoginsAdmin/GetVaultLogin/index.md),
  [GetVaultLoginsWithSessions](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCVaultLoginsAdmin/GetVaultLoginsWithSessions/index.md).
- **Add, change, remove:** [AddVaultLogin](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCVaultLoginsAdmin/AddVaultLogin/index.md),
  [ModifyVaultLogin](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCVaultLoginsAdmin/ModifyVaultLogin/index.md),
  [ModifyVaultLoginEx](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCVaultLoginsAdmin/ModifyVaultLoginEx/index.md),
  [RemoveVaultLogin](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCVaultLoginsAdmin/RemoveVaultLogin/index.md),
  [ForceLogoutVaultLoginSessions](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCVaultLoginsAdmin/ForceLogoutVaultLoginSessions/index.md).
- **Passwords:**
  [CreateVaultLoginPasswordResetRequest](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCVaultLoginsAdmin/CreateVaultLoginPasswordResetRequest/index.md),
  [ResetVaultLoginPassword](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCVaultLoginsAdmin/ResetVaultLoginPassword/index.md),
  [GetVaultLoginPasswordHash](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCVaultLoginsAdmin/GetVaultLoginPasswordHash/index.md),
  [SetVaultLoginPasswordHash](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCVaultLoginsAdmin/SetVaultLoginPasswordHash/index.md).
- **Directory lookups for importing Windows accounts:**
  [GetAllDomainsInVault](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCVaultLoginsAdmin/GetAllDomainsInVault/index.md),
  [GetOrganizationalUnitsForDomainInVault](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCVaultLoginsAdmin/GetOrganizationalUnitsForDomainInVault/index.md),
  [GetWindowsGroupsInVault](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCVaultLoginsAdmin/GetWindowsGroupsInVault/index.md),
  [GetWindowsGroupMembersInVault](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCVaultLoginsAdmin/GetWindowsGroupMembersInVault/index.md),
  [GetFullNameAndEmailInVault](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCVaultLoginsAdmin/GetFullNameAndEmailInVault/index.md).
  They read the domain directory, or the vault's default user synchronization plugin when one is
  configured for the domain. A server can be configured to use only that plugin for callers
  without the server right `manage_logins`.

Typical provisioning on such a server:
[AddVaultLogin](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCVaultLoginsAdmin/AddVaultLogin/index.md), then
[AddUser](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCUsersAdmin/AddUser/index.md) with `login_name` set to the new login's account
name.

<a id="methods"></a>

## Methods

| Method | Summary | Facts |
|---|---|---|
| [AddVaultLogin](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCVaultLoginsAdmin/AddVaultLogin/index.md) | Adds a login account to the vault. | `admin` `session` |
| [CreateVaultLoginPasswordResetRequest](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCVaultLoginsAdmin/CreateVaultLoginPasswordResetRequest/index.md) | Creates a password reset link for an M-Files login of the vault, and optionally emails it to the login's email address. | `admin` `session` |
| [ForceLogoutVaultLoginSessions](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCVaultLoginsAdmin/ForceLogoutVaultLoginSessions/index.md) | Logs out all sessions of the given login accounts in this vault. | `admin` `session` |
| [GetAllDomainsInVault](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCVaultLoginsAdmin/GetAllDomainsInVault/index.md) | Lists the domains whose accounts can be imported: the server's own domain and the domains it can reach. | `admin` `session` `idempotent` |
| [GetFullNameAndEmailInVault](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCVaultLoginsAdmin/GetFullNameAndEmailInVault/index.md) | Looks up the full name and email address of a Windows account in the directory. | `admin` `session` `idempotent` |
| [GetOrganizationalUnitsForDomainInVault](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCVaultLoginsAdmin/GetOrganizationalUnitsForDomainInVault/index.md) | Lists the organizational units of a domain. | `admin` `session` `idempotent` |
| [GetVaultLogin](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCVaultLoginsAdmin/GetVaultLogin/index.md) | Gets one vault login by account name. | `admin` `session` |
| [GetVaultLoginPasswordHash](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCVaultLoginsAdmin/GetVaultLoginPasswordHash/index.md) | Reads the password hash of a vault login, encrypted with a public key that the caller supplies. | `admin` `session` `idempotent` |
| [GetVaultLogins](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCVaultLoginsAdmin/GetVaultLogins/index.md) | Gets all login accounts stored in the vault. | `admin` `session` `idempotent` |
| [GetVaultLoginsWithSessions](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCVaultLoginsAdmin/GetVaultLoginsWithSessions/index.md) | Gets the login accounts that currently have sessions to this vault. | `admin` `session` `idempotent` |
| [GetWindowsGroupMembersInVault](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCVaultLoginsAdmin/GetWindowsGroupMembersInVault/index.md) | Lists the users and groups that are members of a Windows group. | `admin` `session` `idempotent` |
| [GetWindowsGroupsInVault](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCVaultLoginsAdmin/GetWindowsGroupsInVault/index.md) | Lists Windows groups of the server's domains, for importing users by group. | `admin` `session` `idempotent` |
| [ModifyVaultLogin](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCVaultLoginsAdmin/ModifyVaultLogin/index.md) | Changes the server roles, password, full name, email address or license type of a vault login. | `admin` `session` `idempotent` |
| [ModifyVaultLoginEx](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCVaultLoginsAdmin/ModifyVaultLoginEx/index.md) | Replaces the data of a vault login, optionally including its account name. | `admin` `session` |
| [RemoveVaultLogin](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCVaultLoginsAdmin/RemoveVaultLogin/index.md) | Removes a login account from the vault. | `admin` `session` |
| [ResetVaultLoginPassword](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCVaultLoginsAdmin/ResetVaultLoginPassword/index.md) | Sets a new password for a vault login, authorized by a password reset link. | `admin` `session` |
| [SetVaultLoginPasswordHash](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCVaultLoginsAdmin/SetVaultLoginPasswordHash/index.md) | Sets the password of a vault login from a password hash. | `admin` `session` `idempotent` |