// M-Files Server gRPC API 26.11. Generated from the M-Files Server IDL; do not edit.
// Documentation: https://developer.m-files.com/APIs/gRPC-API/
syntax = "proto3";

package MFiles;

import "mfiles/api/annotations.proto";
import "mfiles/enums.proto";
import "mfiles/structs.proto";

option csharp_namespace = "MFiles.Grpc";
option go_package = "github.com/M-Files/mfiles-grpc-api/go/mfiles;mfiles";
option java_multiple_files = true;
option java_package = "com.mfiles.grpc";
option objc_class_prefix = "MF_";

// An interface for handling client login & logout operations.
//
// Use this interface to log in to MFServer and to maintain the login session.
//
// Opens, maintains and closes sessions. Almost every other call needs the session ID that
// [LogIn](mfiles:MFiles.IRPCLogin.LogIn) returns, sent as the binary metadata header
// `mfiles-session-id-bin` (the 48 bytes of `session_data.session_id`, unchanged).
//
// Which methods matter:
//
// | Job | Methods |
// |---|---|
// | Find out how to authenticate | `GetServerCapabilities`, `GetAuthenticationConfiguration` |
// | Open a session | `LogIn` (vault or server level), `LogInWithSession` (another vault, same user) |
// | Keep it open | `KeepAlive`, at least every `session_data.keep_alive_interval_in_seconds` |
// | Close it | `LogOut` |
// | Inspect it | `GetVaultSessionInfo` |
//
// Typical order:
//
// 1. [QueryVersion](mfiles:MFiles.IRPCQueryVersion.QueryVersion) and
//    [GetServerCapabilities](mfiles:MFiles.IRPCLogin.GetServerCapabilities) (no session needed).
// 2. [GetAuthenticationConfiguration](mfiles:MFiles.IRPCLogin.GetAuthenticationConfiguration) when
//    the vault may use single sign-on; `AUTH_METHOD_PLUGIN` means log in with
//    `AUTH_DATA_TYPE_PLUGIN`, otherwise use user name and password (`AUTH_DATA_TYPE_CREDENTIALS`).
// 3. [LogIn](mfiles:MFiles.IRPCLogin.LogIn) with the vault GUID. Keep `session_data`.
// 4. Call [KeepAlive](mfiles:MFiles.IRPCLogin.KeepAlive) on a timer while the session is in use.
// 5. On `UNAUTHENTICATED`, log in again with `LogIn` and continue with the new session ID.
// 6. [LogOut](mfiles:MFiles.IRPCLogin.LogOut) when done. A session that is not logged out holds
//    its license until it times out.
//
// A session is bound to one vault, or to no vault (a server-level session, opened with the vault
// GUID `{00000000-0000-0000-0000-000000000000}`). Methods that need a vault fail with
// `E_MFILES_LOGIN_REQUIRED` when called with a server-level session.
//
// Errors: an invalid, expired or missing session is reported as gRPC status `UNAUTHENTICATED` with
// no error trailers. All other failures, including a wrong password, use status `UNKNOWN` with the
// M-Files error stack in the `mfiles-error-serialized-bin` trailer.
//
// Other methods of this service serve M-Files' own clients (licensing warnings, password
// encryption, client settings, replication) and are marked as such.
//
// Guides: [Authentication and sessions](https://developer.m-files.com/APIs/gRPC-API/runtime/authentication/)
// covers every login type and the session lifecycle, and
// [Call metadata](https://developer.m-files.com/APIs/gRPC-API/runtime/call-metadata/) the headers
// that every call sends.
service IRPCLogin {
	option (mfiles.api.service) = { book: "vault" level: LEVEL_CORE title: "Login and sessions" };

	// Tells the server that the session is still in use, so that it does not expire.
	//
	// Call it at least every `session_data.keep_alive_interval_in_seconds` seconds (half the server's
	// session timeout; 450 seconds with the default 15-minute timeout). Only this call resets the idle
	// timer; other calls do not. When the timeout elapses, the session expires.
	//
	// `KeepAlive` fails with `UNAUTHENTICATED` when the session has expired or was logged out. Then log
	// in again with [LogIn](mfiles:MFiles.IRPCLogin.LogIn).
	rpc KeepAlive( KeepAliveRequest ) returns ( KeepAliveResponse ) {
		option idempotency_level = IDEMPOTENT;
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_SESSION highlighted: true };
	}

	// Ends the session and releases its license.
	//
	// Send the session to end in `mfiles-session-id-bin`. After this, the session ID is rejected with
	// `UNAUTHENTICATED`.
	//
	// The vault's "before logout" event handlers may fail without stopping the logout. Sessions that
	// vault applications receive from the server cannot be logged out (`E_MFILES_ACCESS_DENIED`).
	rpc LogOut( LogOutRequest ) returns ( LogOutResponse ) {
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_SESSION highlighted: true };
	}

	// Logs in for automatic updates.
	//
	// No longer supported: the server always fails this call. Software updates are not delivered by
	// M-Files Server.
	rpc LoginForAutomaticUpdates( LoginForAutomaticUpdatesRequest ) returns ( LoginForAutomaticUpdatesResponse ) {
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_NONE };
	}

	// Tells whether the server runs on an evaluation license, and how many evaluation days are left.
	//
	// Used by M-Files clients to show license warnings; applications rarely need it.
	rpc IsServerRunningInEvaluationMode( IsServerRunningInEvaluationModeRequest ) returns ( IsServerRunningInEvaluationModeResponse ) {
		option idempotency_level = IDEMPOTENT;
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_SESSION };
	}

	// Fails if the server's license subscription has expired; succeeds otherwise.
	//
	// Needs no session. Used by M-Files clients; applications rarely need it.
	rpc VerifyLicenseSubscriptionTime( VerifyLicenseSubscriptionTimeRequest ) returns ( VerifyLicenseSubscriptionTimeResponse ) {
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_NONE };
	}

	// Gets the number of days until the server's license and its subscription expire.
	//
	// Used by M-Files clients to show license warnings; applications rarely need it.
	rpc GetLicenseExpirationInfo( GetLicenseExpirationInfoRequest ) returns ( GetLicenseExpirationInfoResponse ) {
		option idempotency_level = IDEMPOTENT;
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_SESSION };
	}

	// Sets whether administrators are warned about this session when they take the vault offline or do
	// other maintenance.
	//
	// Sessions are included in the check by default. A background service that can safely be
	// disconnected may turn it off. Has no effect on what the session can do.
	rpc SetOpenSessionCheck( SetOpenSessionCheckRequest ) returns ( SetOpenSessionCheckResponse ) {
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_SESSION };
	}

	// Lists the authentication plug-ins installed on the server, without their configurations.
	//
	// Needs no session. `is_default` is always false and no configurations are returned; use
	// [GetAuthenticationConfiguration](mfiles:MFiles.IRPCLogin.GetAuthenticationConfiguration) to get
	// the configuration a login needs. Leave `remote_can_be_null` unset.
	rpc GetAuthenticationPlugins( GetAuthenticationPluginsRequest ) returns ( GetAuthenticationPluginsResponse ) {
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_NONE };
	}

	// Gets RPC over COM interface for accessing M-Files Server.
	//
	// Internal to M-Files on Windows (returns a marshalled COM interface). It is disabled by default and
	// then fails with `E_MFILES_ACCESS_DENIED`. Not usable by gRPC applications.
	rpc GetRPCOverCOMInterface( GetRPCOverCOMInterfaceRequest ) returns ( GetRPCOverCOMInterfaceResponse ) {
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_NONE };
	}

	// Gets the full connection information of the current vault session, in the form the M-Files COM
	// API uses.
	//
	// Used by M-Files components; applications should use
	// [GetVaultSessionInfo](mfiles:MFiles.IRPCLogin.GetVaultSessionInfo) and the `session_data`
	// returned at login instead. Requires a vault session. The RPC binding fields are left empty.
	rpc GetVaultConnectionInfo( GetVaultConnectionInfoRequest ) returns ( GetVaultConnectionInfoResponse ) {
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_SESSION };
	}

	// Removes a device registration (device token) of the logged-in user in the session's vault.
	//
	// Used by M-Files clients that register a device token through `EnvironmentData.device_token` at
	// login; applications rarely need it. Requires a vault session.
	rpc DisconnectDevice( DisconnectDeviceRequest ) returns ( DisconnectDeviceResponse ) {
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_SESSION };
	}

	// Gets the features the server supports, without logging in.
	//
	// Needs no session; the result is the same for all callers and can be cached. Check a capability
	// before using the methods or fields it guards.
	//
	// These are server-level capabilities. After logging in to a vault, prefer
	// `session_data.server_vault_capabilities`, which also includes vault-specific capabilities (for
	// example `facet_search`) as they apply to the user.
	rpc GetServerCapabilities( GetServerCapabilitiesRequest ) returns ( GetServerCapabilitiesResponse ) {
		option idempotency_level = IDEMPOTENT;
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_NONE highlighted: true };
	}

	// Opens a session that acts as another user of the vault.
	//
	// Used by M-Files server-side components; applications rarely need it. Allowed only for a vault
	// session of a local Windows administrator logged in on the server computer; all other sessions
	// get `E_MFILES_ACCESS_DENIED`, including vault administrators. The new session uses a read-only
	// license.
	rpc CreateUserSession( CreateUserSessionRequest ) returns ( CreateUserSessionResponse ) {
		option idempotency_level = IDEMPOTENT;
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_SESSION };
	}

	// Opens a new session to a vault (or the server) for the user of an existing session, without
	// authenticating again.
	//
	// Send the existing session in `mfiles-session-id-bin`; it can be a server-level or a vault session.
	// The response carries a new session with its own session ID; the original session stays valid and
	// must be logged out separately.
	//
	// The typical use is: `LogIn` once at server level, list vaults with
	// [GetVaults](mfiles:MFiles.IRPCVaults.GetVaults), then open one session per vault with this method.
	// The user must have access to the target vault. If `client_data.language` is empty the language of
	// the existing session is used. `login_data.vault_guid` follows the rules of
	// [LogIn](mfiles:MFiles.IRPCLogin.LogIn): the all-zero GUID opens a server-level session.
	//
	// An offline vault is refused with `E_MFILES_VAULT_OFFLINE`, except for an administrative login that
	// the server allows during maintenance.
	rpc LogInWithSession( LogInWithSessionRequest ) returns ( LogInWithSessionResponse ) {
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_SESSION highlighted: true };
	}

	// Logs in (with authentication) to a remote server.
	//
	// Used by M-Files cached replica vaults to log in to the main server. Disabled by default; then the
	// call fails with `E_MFILES_CONFIGURING_REPLICA_VAULTS_NOT_ALLOWED`. Not for applications.
	rpc LogInRemote( LogInRemoteRequest ) returns ( LogInRemoteResponse ) {
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_NONE };
	}

	// Logs in again by using the current session ID. Used by M-Files' own clients.
	//
	// Applications do not need this method: when a call answers `UNAUTHENTICATED`, log in again with
	// [LogIn](mfiles:MFiles.IRPCLogin.LogIn). Works only for vault sessions; a logged-out session is
	// refused.
	rpc Relogin( ReloginRequest ) returns ( ReloginResponse ) {
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_SESSION };
	}

	// Changes the M-Files password of the logged-in account.
	//
	// Failed attempts count towards the server's login attack protection, like failed logins.
	//
	// Always set `password_format` to `PASSWORD_FORMAT_SEE_OTHER_PARAMS` and `passwords_unhashed` to
	// true: the proto3 default of `password_format` selects a deprecated format.
	//
	// After the change the server logs the account out of all vaults on the server, so expect to log in
	// again with the new password.
	rpc ChangePassword( ChangePasswordRequest ) returns ( ChangePasswordResponse ) {
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_SESSION };
	}

	// Gets the server's RSA public key, for encrypting secrets that a client sends to the server.
	//
	// Used by M-Files clients that encrypt passwords or authentication data above the transport layer.
	// Over TLS, applications do not need it. The key is a Windows CryptoAPI public key blob.
	rpc GetPublicKey( GetPublicKeyRequest ) returns ( GetPublicKeyResponse ) {
		option idempotency_level = IDEMPOTENT;
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_SESSION };
	}

	// Gets the server's RSA public key without a session, for encrypting authentication data before
	// login.
	//
	// Same key as [GetPublicKey](mfiles:MFiles.IRPCLogin.GetPublicKey). Over TLS, applications do not
	// need it. Leave `remote_can_be_null` unset.
	rpc GetPublicKeyAnonymous( GetPublicKeyAnonymousRequest ) returns ( GetPublicKeyAnonymousResponse ) {
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_NONE };
	}

	// Gets basic information about the current vault session: server version and ID, vault GUID and
	// name, and the state of the server push channel.
	//
	// Requires a vault session; a server-level session fails with `E_MFILES_LOGIN_REQUIRED`. A cheap
	// way to check that a session is still valid. The response also carries the vault's metadata
	// version in the `mfiles-metadata-version-bin` trailer.
	//
	// For the user's identity, groups and access rights, use the `session_data` returned at login.
	rpc GetVaultSessionInfo( GetVaultSessionInfoRequest ) returns ( GetVaultSessionInfoResponse ) {
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_SESSION returns_metadata_structure_version: true highlighted: true };
	}

	// Returns which of the named server feature flags are enabled on this server.
	//
	// Used by M-Files clients to align their behavior with the server; applications rarely need it.
	// Unknown flag names are left out of the response.
	rpc ResolveMaturityOfFeature( ResolveMaturityOfFeatureRequest ) returns ( ResolveMaturityOfFeatureResponse ) {
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_NONE };
	}

	// Tells a client, before login, whether to authenticate with an authentication plug-in (single
	// sign-on) and returns the plug-in's client-side configuration.
	//
	// Needs no session. The server looks for a configuration that matches the request; the vault can be
	// given by `vault_guid` or resolved from `host_name` (the host name the client connects to, as
	// configured for the vault). A configuration can be limited to one account type (configuration scope
	// such as `*:WINDOWS:`); it then matches only a request with that `type`. To find the single sign-on
	// configuration of a vault, set `type` to `ACCOUNT_TYPE_WINDOWS`: users who sign in through an
	// identity provider have Windows-type login accounts.
	//
	// - `auth_method` `AUTH_METHOD_PLUGIN`: log in with `AUTH_DATA_TYPE_PLUGIN` using one of
	//   `plugin_infos`. On M-Files Cloud this is the identity provider sign-in.
	// - `auth_method` `AUTH_METHOD_UNSPECIFIED` with no `plugin_infos`: no plug-in applies; log in with
	//   user name and password or Windows authentication.
	//
	// `target_plugin_name` must be empty; any other value fails with `E_INVALIDARG`.
	rpc GetAuthenticationConfiguration( GetAuthenticationConfigurationRequest ) returns ( GetAuthenticationConfigurationResponse ) {
		option idempotency_level = IDEMPOTENT;
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_NONE highlighted: true };
	}

	// Gets client settings (theme, timeouts, banners, web security settings) for an M-Files web,
	// desktop or Outlook client.
	//
	// Used by M-Files' own web and desktop clients; applications rarely need it. Only vNext, web and
	// Outlook client types are supported; other types, including `CLIENT_TYPE_SERVER_API`, fail with
	// `E_NOTIMPL`.
	rpc GetClientSettingsByType( GetClientSettingsByTypeRequest ) returns ( GetClientSettingsByTypeResponse ) {
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_NONE };
	}

	// Authenticates the caller and opens a session to a vault, or to the server when the vault GUID is
	// all zeros.
	//
	// Needs no session. The session ID comes back in `session_data.session_id` (48 bytes) and goes,
	// unchanged, into the `mfiles-session-id-bin` header of all later calls.
	//
	// **User name and password** (`AUTH_DATA_TYPE_CREDENTIALS`) complete in one call. Set
	// `authentication_data.type` and fill `authentication_data.data.credentials`; the type and the
	// populated union member must match, an unset type fails with `E_INVALIDARG`. Use this over TLS
	// only: the password is sent as is.
	//
	// **Multi-step methods** (Windows authentication, plug-in authentication, the two-leg M-Files
	// challenge) may need several calls. While the response has no `session_data`, the login is not
	// done: call `LogIn` again with the next authentication data and the
	// `authentication_attempt_identifier` from the previous response, placed in the union member's own
	// `authentication_attempt_identifier` field. The attempt is discarded when it completes or fails.
	//
	// **Vault GUID.** `login_data.vault_guid` accepts the GUID with or without braces, in any case.
	// An empty string is not "no vault": it fails with `E_MFILES_INVALID_VAULT_GUID_X_DESC`. Use
	// `{00000000-0000-0000-0000-000000000000}` for a server-level session. An unknown GUID fails with
	// `E_MFILES_UNKNOWN_VAULT`; an offline vault with `E_MFILES_VAULT_OFFLINE`.
	//
	// **Failures.** An unknown user, a wrong password and a login blocked by the server's login attack
	// protection are all reported as `E_MFILES_AUTHENTICATION_FAILED` (`Authentication failed.`)
	// without further detail. Do not retry a failed login in a loop. A missing user name fails with
	// `E_INVALIDARG`.
	//
	// **Session lifetime.** The session expires when no
	// [KeepAlive](mfiles:MFiles.IRPCLogin.KeepAlive) arrives for twice
	// `session_data.keep_alive_interval_in_seconds`; other calls do not extend it.
	//
	// `vaults_availability` is filled only for a server-level login on servers that enable it; expect it
	// to be empty and use [GetVaults](mfiles:MFiles.IRPCVaults.GetVaults) instead.
	rpc LogIn( LogInRequest ) returns ( LogInResponse ) {
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_NONE highlighted: true };
	}

	// Gets the anonymous login settings and enabled vertical applications of the vault that serves the
	// given host name, without a session.
	//
	// Used by M-Files login pages; applications rarely need it. `host_name_match` is false, and the
	// settings are empty, when no vault is configured for the host name.
	rpc GetLoginSettings( GetLoginSettingsRequest ) returns ( GetLoginSettingsResponse ) {
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_NONE };
	}
}

// The request of KeepAlive.
message KeepAliveRequest {
}

// The response of KeepAlive.
message KeepAliveResponse {
}

// The request of LogOut.
message LogOutRequest {
}

// The response of LogOut.
message LogOutResponse {
}

// The request of LoginForAutomaticUpdates.
message LoginForAutomaticUpdatesRequest {

	// The serial number of a client. This is used to determine a such suitable newer version for the client that is justified by the number. If unset, the latest software version is returned.
	string serial_number = 1;

	// Automatic updates related password. If unset it's ignored. The primary purpose of this parameter is to refuse returning software updates to certain clients (e.g. M-Files and the password has been fall into other parties that want software updates).
	string password = 2;

	// Language identifier (e.g. "eng" or "fin").
	string lang_identifier = 3;

	// The challenge to be used as an input for a digital signature algorithm.
	bytes challenge = 4;
}

// The response of LoginForAutomaticUpdates.
message LoginForAutomaticUpdatesResponse {

	// Session ID when the login process has been completed successfully.
	bytes id = 1;

	// Receives the digital signature.
	bytes signature = 2;
}

// The request of IsServerRunningInEvaluationMode.
message IsServerRunningInEvaluationModeRequest {
}

// The response of IsServerRunningInEvaluationMode.
message IsServerRunningInEvaluationModeResponse {

	// True if the server runs on an evaluation license.
	bool evaluation_mode = 1;

	// Days left in the evaluation. Meaningful only when `evaluation_mode` is true.
	uint32 evaluation_days_left = 2;
}

// The request of VerifyLicenseSubscriptionTime.
message VerifyLicenseSubscriptionTimeRequest {
}

// The response of VerifyLicenseSubscriptionTime.
message VerifyLicenseSubscriptionTimeResponse {
}

// The request of GetLicenseExpirationInfo.
message GetLicenseExpirationInfoRequest {
}

// The response of GetLicenseExpirationInfo.
message GetLicenseExpirationInfoResponse {

	// True if the license is always valid.
	bool license_is_always_valid = 1;

	// Number of days until the license expires. Valid only if the license is not always valid.
	int32 license_expiration_time = 2;

	// True if the subscription is always valid.
	bool subscription_is_always_valid = 3;

	// Number of days until the subscription expires. Valid only if the subscription is not always valid.
	int32 subscription_expiration_time = 4;
}

// The request of SetOpenSessionCheck.
message SetOpenSessionCheckRequest {

	// True if the check is made (default). If the check is disabled the administrator does not get a warning that this session is open when the vault is set to offline mode for example.
	bool make_open_session_check = 1;
}

// The response of SetOpenSessionCheck.
message SetOpenSessionCheckResponse {
}

// The request of GetAuthenticationPlugins.
message GetAuthenticationPluginsRequest {

	// If set, specifies the address of the remote server.
	ServerAddress remote_can_be_null = 1;

	// If not empty, specifies the GUID of the target vault.
	string vault_guid = 2;

	// If true, only scope-independent plugins are returned.
	bool scope_independent_only = 3;
}

// The response of GetAuthenticationPlugins.
message GetAuthenticationPluginsResponse {

	// Receives the plugin information.
	repeated PluginInfo plugins = 1;
}

// The request of GetRPCOverCOMInterface.
message GetRPCOverCOMInterfaceRequest {

	// The destination context where the specified interface is to be unmarshaled. See the documentation of CoMarshalInterface.
	uint32 destination_context = 1;
}

// The response of GetRPCOverCOMInterface.
message GetRPCOverCOMInterfaceResponse {

	// Receives the marshalled interface.
	bytes marshalled_interface = 1;
}

// The request of GetVaultConnectionInfo.
message GetVaultConnectionInfoRequest {
}

// The response of GetVaultConnectionInfo.
message GetVaultConnectionInfoResponse {

	// The vault connection information of the user's session.
	VaultConnectionInfo connection_info = 1;
}

// The request of DisconnectDevice.
message DisconnectDeviceRequest {

	// The device token of the device to be disconnected from the server.
	string device_token = 1;
}

// The response of DisconnectDevice.
message DisconnectDeviceResponse {
}

// The request of GetServerCapabilities.
message GetServerCapabilitiesRequest {
}

// The response of GetServerCapabilities.
message GetServerCapabilitiesResponse {

	// Receives the server capabilities.
	ServerVaultCapabilities server_capabilities = 1;
}

// The request of CreateUserSession.
message CreateUserSessionRequest {

	// The ID of the user account (in the session's vault) to act as.
	int32 user_id = 1;
}

// The response of CreateUserSession.
message CreateUserSessionResponse {

	// The new session. Send its `session_id` in `mfiles-session-id-bin`.
	SessionInfoServer session_info = 1;
}

// The request of LogInWithSession.
message LogInWithSessionRequest {

	// Describes the client software, as in `LogIn`.
	ClientData client_data = 1;

	// The target vault (`vault_guid`) and session options.
	LoginData login_data = 2;
}

// The response of LogInWithSession.
message LogInWithSessionResponse {

	// The new session. Use its `session_id` for calls to the target vault.
	SessionData session_data = 1;
}

// The request of LogInRemote.
message LogInRemoteRequest {

	// The address of the remote server.
	ServerAddress remote_server_addr = 1;

	// Description of the client environment.
	EnvironmentData environment_data = 2;

	// Description of the client.
	ClientData client_data = 3;

	// Description of the desired login.
	LoginData login_data = 4;

	// Authentication data for the remote server, as in `LogIn`.
	AuthDataClient authentication_data = 5;
}

// The response of LogInRemote.
message LogInRemoteResponse {

	// The remote server's part of the authentication exchange, as in `LogIn`.
	AuthDataServer authentication_data = 1;

	// Description of the created session when login is complete, or unset otherwise.
	SessionData session_data = 2;
}

// The request of Relogin.
message ReloginRequest {

	// The account name of the session (`session_data.account_name`).
	string account_name = 1;

	// Describes the client device, as in `LogIn`.
	EnvironmentData environment_data = 2;

	// Describes the client software, as in `LogIn`.
	ClientData client_data = 3;

	// Must name the vault of the session in `vault_guid`.
	LoginData login_data = 4;
}

// The response of Relogin.
message ReloginResponse {

	// The session. Use its `session_id` from now on.
	SessionData session_data = 1;
}

// The request of ChangePassword.
message ChangePasswordRequest {

	// The current password, in the form `password_format`, `password_encryption` and `passwords_unhashed` describe.
	string old_password = 1;

	// The new password, in the same form as `old_password`.
	string new_password = 2;

	// Set to `PASSWORD_FORMAT_SEE_OTHER_PARAMS`. The other values are deprecated and override `password_encryption`, `passwords_unhashed` and `password_hash_algorithm_desired`.
	PasswordFormat password_format = 3;

	// How the passwords are encrypted in transit.
	PasswordEncryption password_encryption = 4;

	// Set to true and send the passwords as entered. Pre-hashed passwords are accepted only with MD5.
	bool passwords_unhashed = 5;

	// The algorithm the server uses to store the new password.
	PasswordHashAlgorithm password_hash_algorithm_desired = 6;
}

// The response of ChangePassword.
message ChangePasswordResponse {
}

// The request of GetPublicKey.
message GetPublicKeyRequest {

	// Encryption for which the key is requested.
	PasswordEncryption password_encryption = 1;
}

// The response of GetPublicKey.
message GetPublicKeyResponse {

	// Receives the public key as a BLOB.
	bytes public_key = 1;
}

// The request of GetPublicKeyAnonymous.
message GetPublicKeyAnonymousRequest {

	// If set, specifies the address of the remote server.
	ServerAddress remote_can_be_null = 1;

	// M-Files vault GUID.
	string vault = 2;

	// Encryption for which the key is requested.
	PasswordEncryption password_encryption = 3;
}

// The response of GetPublicKeyAnonymous.
message GetPublicKeyAnonymousResponse {

	// Receives the public key as a BLOB.
	bytes public_key = 1;
}

// The request of GetVaultSessionInfo.
message GetVaultSessionInfoRequest {
}

// The response of GetVaultSessionInfo.
message GetVaultSessionInfoResponse {

	// The vault session information of the user's session.
	VaultSessionInfo vault_session_info = 1;
}

// The request of ResolveMaturityOfFeature.
message ResolveMaturityOfFeatureRequest {

	// FeatureFlags to be resolved.
	repeated string feature_flags = 1;
}

// The response of ResolveMaturityOfFeature.
message ResolveMaturityOfFeatureResponse {

	// Receives the list of matured feature flags.
	repeated string matured_feature_flags = 1;
}

// The request of GetAuthenticationConfiguration.
message GetAuthenticationConfigurationRequest {

	// Leave unset. Naming a remote server needs a server setting that is off by default.
	ServerAddress remote_can_be_null = 1;

	// Optional. The user name typed by the user, to find a configuration scoped to it.
	string user_name = 2;

	// Optional. The user's domain, to find a configuration scoped to it.
	string domain = 3;

	// Optional. The vault the user is logging in to. When empty or all zeros, the vault is resolved from `host_name`.
	string vault_guid = 4;

	// Optional. The host name the client uses to reach the server, for example the vault's cloud address. Used to find the vault and host-specific configurations.
	string host_name = 5;

	// The account type to find a configuration for. Leave unset when unknown.
	AccountType type = 6;

	// Deprecated. Must be empty; any other value fails with `E_INVALIDARG`.
	string target_plugin_name = 7;

	// The client's capabilities, as in `ClientData.capabilities`.
	ClientCapabilities capabilities = 8;
}

// The response of GetAuthenticationConfiguration.
message GetAuthenticationConfigurationResponse {

	// `AUTH_METHOD_PLUGIN` when `plugin_infos` contains a usable configuration, `AUTH_METHOD_UNSPECIFIED` otherwise.
	AuthMethod auth_method = 1;

	// The matching plug-in configurations. `system_configuration` holds the configuration scope (`Scope`) to send back in `PluginData.configuration_scope`; `plugin_configuration` holds the plug-in's client settings.
	repeated PluginInfo plugin_infos = 2;
}

// Struct for Client settings request data.
message GetClientSettingsByTypeRequest {

	// The GUID of the vault whose client settings to get.
	string vault_guid = 1;

	// The host name of the client computer.
	string host_name = 2;

	// Specifies the type of client( Desktop, Web, etc).
	ClientType client_type = 3;

	// Flags that control this operation.
	CLIENTSETTINGFLAGS client_setting_flag = 4;
}

// Struct for Client settings information.
message GetClientSettingsByTypeResponse {

	// The vault's UI theme (colors and logos) for the client.
	ThemeConfiguration theme_configuration = 1;

	// The client session timeout in seconds.
	uint32 client_session_timeout_in_seconds = 2;

	// The list of Vault DNS for Web(vNext) which marked as Default Web Client.
	repeated string dns_of_vaults_for_web = 3;

	// The Web Access Cross origin settings.
	SecurityAndCorsSettings web_security_and_cors_settings = 4;

	// Migrate classic web url settings.
	NamedValueArray classic_web_urlmigrate_settings = 5;

	// If true, migrate the web links to online web app(Account layer).
	bool enable_web_link_migration_to_online_web = 6;

	// The custom banner configuration.
	CustomBannerConfiguration custom_banner_configuration = 7;

	// The idle session timeout in seconds.
	uint32 idle_session_timeout_in_seconds = 8;
}

// A structure that specifies the request type for the LogInRequest method.
message LogInRequest {

	// Describes the client device. Optional; `client_name` is shown as the session's computer name.
	EnvironmentData environment_data = 1;

	// Describes the client software. Set `type` (for example `CLIENT_TYPE_SERVER_API`) and `language`; set `capabilities` only for features your code handles.
	ClientData client_data = 2;

	// The target vault and session options. `vault_guid` is required; see Remarks.
	LoginData login_data = 3;

	// How the caller proves its identity: `type` plus the matching member of `data`.
	AuthDataClient authentication_data = 4;
}

// A structure that specifies the response type for the LogIn method.
message LogInResponse {

	// The server's half of the authentication exchange. For multi-step methods it carries the next challenge, whether the login is done, and the attempt identifier to send back. For `AUTH_DATA_TYPE_CREDENTIALS` there is nothing to act on.
	AuthDataServer authentication_data = 1;

	// The new session, set when the login is complete and unset while a multi-step login is still in progress.
	SessionData session_data = 2;

	// Online and offline vaults the user can see, only for a server-level login and only on servers that enable this; otherwise empty.
	VaultsAvailabilityOnServer vaults_availability = 3;
}

// The request of GetLoginSettings.
message GetLoginSettingsRequest {

	// If not empty, specifies the target hostname.
	string host_name = 1;
}

// The response of GetLoginSettings.
message GetLoginSettingsResponse {

	// True if host name matches to the name provided when fetching these login settings.
	bool host_name_match = 1;

	// Receives the login settings.
	AnonymousLoginSettings anonymous_login_settings = 2;

	// The vertical applications enabled for the vault.
	VerticalApplications vertical_applications = 3;
}