# IRPCVaultsAdminBasic.GetAddInSettings

Location: [gRPC API](https://developer.m-files.com/APIs/gRPC-API/index.md) > [Administration API](https://developer.m-files.com/APIs/gRPC-API/admin/index.md) > [Vault management (basic)](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCVaultsAdminBasic/index.md)

HTML version: https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCVaultsAdminBasic/GetAddInSettings/

Badges: `Administration API / specialized` `internal: not for applications` `admin` `no session`

Gets the cross-origin (CORS) and cross-frame settings that a vault's add-in configuration
allows.

- **Service:** [Vault management (basic)](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCVaultsAdminBasic/index.md) `MFiles.IRPCVaultsAdminBasic`
- **gRPC method:** `/MFiles.IRPCVaultsAdminBasic/GetAddInSettings`
- **HTTP (mf-http-grpc):** `POST /grpc/v1/get-add-in-settings`
- **Request:** [`GetAddInSettingsRequest`](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCVaultsAdminBasic/GetAddInSettings/index.md#request)
- **Response:** [`GetAddInSettingsResponse`](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCVaultsAdminBasic/GetAddInSettings/index.md#response)
- **Book and level:** Administration API, specialized
- **Kind:** admin
- **Session:** Not needed: the call can be made before logging in.
- **Idempotent:** no
- **Returns metadata structure version:** no
- **Streaming:** none (unary)

<a id="remarks"></a>

## Remarks

**For M-Files components only.** M-Files' web components read it to decide which external sites
may call or frame the vaults' web endpoints. Applications should not call it.

<a id="request"></a>

## Request: GetAddInSettingsRequest

> Nested message fields are expanded to depth 3; follow a type link for deeper levels and for the type's own page.

| Field | Type | Description |
|---|---|---|
| `vault_guid` | `string` | The vault GUID, with braces. |

<a id="response"></a>

## Response: GetAddInSettingsResponse

> Nested message fields are expanded to depth 3; follow a type link for deeper levels and for the type's own page.

| Field | Type | Description |
|---|---|---|
| `add_in_settings_of_vaults[]` | repeated [`AddInSettingsOfVault`](https://developer.m-files.com/APIs/gRPC-API/Reference/Messages/MFiles.AddInSettingsOfVault/index.md) | The add-in settings. See [AddInSettingsOfVault](https://developer.m-files.com/APIs/gRPC-API/Reference/Messages/MFiles.AddInSettingsOfVault/index.md). |
| `add_in_settings_of_vaults[].vault` | `string` | The GUID of Vault. |
| `add_in_settings_of_vaults[].vault_domain_names[]` | repeated `string` | The domain names. |
| `add_in_settings_of_vaults[].settings` | [`AddInSettings`](https://developer.m-files.com/APIs/gRPC-API/Reference/Messages/MFiles.AddInSettings/index.md) | The settings. |
| `add_in_settings_of_vaults[].settings.allowed_methods[]` | repeated `string` | The list of allowed HTTP Methods. |
| `add_in_settings_of_vaults[].settings.allowed_cross_frame_sites[]` | repeated `string` | The list of allowed Cross Frame Sites. |
| `add_in_settings_of_vaults[].settings.allowed_headers[]` | repeated `string` | The list of allowed HTTP Response Headers. |
| `add_in_settings_of_vaults[].settings.cross_origin_access[]` | repeated `string` | The list of Cross Origin Access Domains. |
| `add_in_settings_of_vaults[].settings.allow_credentials` | `bool` | True to allow the credentials, false to skip credentials. |
| `add_in_settings_of_vaults[].settings.prevent_xfs` | `bool` | True to Prevent XFS, false to allow XFS. |