// M-Files Server gRPC API 26.11. Generated from the M-Files Server IDL; do not edit.
// Documentation: https://developer.m-files.com/APIs/gRPC-API/
syntax = "proto3";

package MFiles;

import "mfiles/api/annotations.proto";
import "mfiles/enums.proto";
import "mfiles/structs.proto";

option csharp_namespace = "MFiles.Grpc";
option go_package = "github.com/M-Files/mfiles-grpc-api/go/mfiles;mfiles";
option java_multiple_files = true;
option java_package = "com.mfiles.grpc";
option objc_class_prefix = "MF_";

// Administers the vault of the session: verify and repair, search indexes, archiving and restoring
// from archives, and vault-level authentication settings.
//
// Use this interface to verify the database and perform other administrative
// tasks targeting the document vault.
//
// The vault-level maintenance commands of M-Files Admin; the M-Files API's vault management
// operations also use [VerifyVault](mfiles:MFiles.IRPCVaultAdmin.VerifyVault). Use it from
// administration tools and automation scripts. To create, back up, take offline or destroy whole
// vaults, use [IRPCVaultsAdmin](mfiles:MFiles.IRPCVaultsAdmin) instead.
//
// **Session and rights.** Every method works on the vault of the session, so it needs a vault
// session; a server-level session fails with "Login required." (error code 0x80040043). The vault
// rights (fields of `VaultAccess`) each method needs:
//
// | Vault right | Methods |
// | --- | --- |
// | `verify_vault` | `VerifyVault`, `RebuildFullTextSearchIndexes`, `ExecuteIndexManagementOperation` |
// | `verify_vault` | `CheckForIssue9855Errors`, `DismissIssue9855Errors`, `GetIssue9855ErrorDetails` |
// | `see_all_objects` | `GetIndexOptions` |
// | `archive` | `ArchiveDocuments`, `ArchiveOldVersions` |
// | `restore_from_archive` | `RestoreFromArchive` |
// | `archive` and `restore_from_archive` | `GetDefaultReplicationConfiguration` |
// | `change_metadata_structure` and `license_allows_modifications` | `EnableAnnotationsAndRedlining` |
// | Full control of the vault | The Entra ID and authentication configuration methods |
// | None | `CheckAnnotationsAndRedlining` |
//
// The vault role full control (and a system administrator's `full_control_of_vaults`) grants all of
// them. A missing right fails with gRPC status `UNKNOWN`, "Access denied. You do not have the access
// rights required by this operation." (error codes 0x800400A9 and 0x800407E4).
//
// **Tasks:**
//
// - **Check and repair the vault**: [VerifyVault](mfiles:MFiles.IRPCVaultAdmin.VerifyVault).
// - **Search indexes**: [GetIndexOptions](mfiles:MFiles.IRPCVaultAdmin.GetIndexOptions),
//   [ExecuteIndexManagementOperation](mfiles:MFiles.IRPCVaultAdmin.ExecuteIndexManagementOperation),
//   [RebuildFullTextSearchIndexes](mfiles:MFiles.IRPCVaultAdmin.RebuildFullTextSearchIndexes).
// - **Archive and restore content**:
//   [ArchiveDocuments](mfiles:MFiles.IRPCVaultAdmin.ArchiveDocuments),
//   [ArchiveOldVersions](mfiles:MFiles.IRPCVaultAdmin.ArchiveOldVersions),
//   [RestoreFromArchive](mfiles:MFiles.IRPCVaultAdmin.RestoreFromArchive),
//   [GetDefaultReplicationConfiguration](mfiles:MFiles.IRPCVaultAdmin.GetDefaultReplicationConfiguration).
//   Each can first run as a preview (`preview_only`) that changes nothing.
// - **Annotations**: [CheckAnnotationsAndRedlining](mfiles:MFiles.IRPCVaultAdmin.CheckAnnotationsAndRedlining),
//   [EnableAnnotationsAndRedlining](mfiles:MFiles.IRPCVaultAdmin.EnableAnnotationsAndRedlining).
// - **Microsoft Entra ID (Azure AD) authentication**: the `...AzureAD...` methods,
//   [SetVaultVariables](mfiles:MFiles.IRPCVaultAdmin.SetVaultVariables) and the authentication
//   configuration migration methods serve the vault properties of M-Files Admin. Several take
//   binary input that only M-Files Admin produces.
//
// **Background jobs.** `VerifyVault` (unless `synchronous`) and `ArchiveDocuments`,
// `ArchiveOldVersions` and `RestoreFromArchive` (unless `preview_only`) create a temporary
// scheduled job and return its ID in `task_id` before the work is done. Poll
// [GetScheduledJobRunInfo](mfiles:MFiles.IRPCScheduledJobsAdmin.GetScheduledJobRunInfo) with
// `scheduled_job` = `task_id` until `is_running` is false and `current_step` is not -1 (-1 means
// not started yet), then read `last_run_succeeded`, `last_run_errors` and `output`. Use the right
// session, because server-level and vault-level jobs have separate IDs:
//
// - A `VerifyVault` job is a server-level job: read it with a server-level session (log in with the
//   null vault GUID). Reading a verification job needs no server right.
// - Archive and restore jobs are jobs of the vault: read them with a session of the same vault and
//   the vault right `archive`, `restore_from_archive` or `manage_scheduled_jobs`.
//
// Cancel a running job with
// [CancelScheduledJob](mfiles:MFiles.IRPCScheduledJobsAdmin.CancelScheduledJob).
service IRPCVaultAdmin {
	option (mfiles.api.service) = { book: "admin" level: LEVEL_SPECIALIZED title: "Vault administration" };

	// Verifies the consistency of a vault's database and optionally of its file data, and optionally
	// fixes the problems it finds (M-Files Admin's "Verify and Repair").
	//
	// With `verifyvaultjob.fix_errors` false the vault is not modified; the problems found are reported
	// in `poutput.errors`. With `fix_errors` true the problems are reported and fixed. If the method
	// itself fails, the verification or repair logic failed or the vault is too badly damaged to be
	// fixed by this method.
	//
	// - **Long-running.** With `synchronous` false the call starts a server-level background job and
	//   returns at once; follow it with a server-level session (see the service overview), and read the
	//   problems from the job's `output`. With `synchronous` true the call returns when the
	//   verification is done.
	// - Requires a vault session and the vault right `verify_vault`.
	// - If the server's verification options for the vault require it, the vault is taken offline for
	//   the duration: open sessions are disconnected.
	// - `verify_file_contents` true also checks the integrity of every file on disk, which can take a
	//   long time.
	rpc VerifyVault( VerifyVaultRequest ) returns ( VerifyVaultResponse ) {
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_SESSION };
	}

	// Rebuilds the full-text search indexes of the vault: the metadata index, the file data index or
	// both.
	//
	// - Requires a vault session and the vault right `verify_vault`.
	// - Returns after asking the M-Files indexing service to rebuild; the indexes are rebuilt in the
	//   background. There is no task ID to follow.
	// - Fails if rebuilding has been disabled on the server ("Rebuilding the full-text search index has
	//   been disabled on the server due to performance reasons.").
	// - To rebuild one specific index, use
	//   [ExecuteIndexManagementOperation](mfiles:MFiles.IRPCVaultAdmin.ExecuteIndexManagementOperation)
	//   with `INDEX_MANAGEMENT_OPERATION_REBUILD`.
	rpc RebuildFullTextSearchIndexes( RebuildFullTextSearchIndexesRequest ) returns ( RebuildFullTextSearchIndexesResponse ) {
		option idempotency_level = IDEMPOTENT;
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_SESSION };
	}

	// Gets the number of objects affected by a known file data problem of earlier M-Files versions that
	// the server has detected in the vault, and that the administrator has not dismissed.
	//
	// - Requires a vault session and the vault right `verify_vault`. Read-only.
	// - Returns 0 when no problems were recorded or when they have been dismissed with
	//   [DismissIssue9855Errors](mfiles:MFiles.IRPCVaultAdmin.DismissIssue9855Errors). M-Files Admin
	//   calls it when it opens a vault; see the details with
	//   [GetIssue9855ErrorDetails](mfiles:MFiles.IRPCVaultAdmin.GetIssue9855ErrorDetails) and repair them
	//   with [VerifyVault](mfiles:MFiles.IRPCVaultAdmin.VerifyVault).
	rpc CheckForIssue9855Errors( CheckForIssue9855ErrorsRequest ) returns ( CheckForIssue9855ErrorsResponse ) {
		option idempotency_level = IDEMPOTENT;
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_SESSION };
	}

	// Marks the recorded file data problems of earlier M-Files versions as dismissed.
	//
	// - Requires a vault session and the vault right `verify_vault`.
	// - Changes the vault: afterwards
	//   [CheckForIssue9855Errors](mfiles:MFiles.IRPCVaultAdmin.CheckForIssue9855Errors) returns 0.
	//   Calling it again has no further effect.
	rpc DismissIssue9855Errors( DismissIssue9855ErrorsRequest ) returns ( DismissIssue9855ErrorsResponse ) {
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_SESSION };
	}

	// Describes the recorded file data problems of earlier M-Files versions in the vault.
	//
	// - Requires a vault session and the vault right `verify_vault`.
	// - Runs a verification limited to these problems within the call and does not fix anything. If the
	//   server's verification options for the vault require it, the vault is taken offline for the
	//   duration, as with [VerifyVault](mfiles:MFiles.IRPCVaultAdmin.VerifyVault).
	rpc GetIssue9855ErrorDetails( GetIssue9855ErrorDetailsRequest ) returns ( GetIssue9855ErrorDetailsResponse ) {
		option idempotency_level = IDEMPOTENT;
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_SESSION };
	}

	// Checks whether the vault has the metadata structure that the annotations and redlining feature
	// needs.
	//
	// - Requires a vault session; no special rights (a normal user can call it). Read-only.
	// - If it returns false, a vault administrator can enable the feature with
	//   [EnableAnnotationsAndRedlining](mfiles:MFiles.IRPCVaultAdmin.EnableAnnotationsAndRedlining).
	rpc CheckAnnotationsAndRedlining( CheckAnnotationsAndRedliningRequest ) returns ( CheckAnnotationsAndRedliningResponse ) {
		option idempotency_level = IDEMPOTENT;
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_SESSION };
	}

	// Enables annotations and redlining in the vault by creating the metadata structure elements that
	// the feature needs.
	//
	// - Requires a vault session and the vault rights `change_metadata_structure` and
	//   `license_allows_modifications`.
	// - Changes the metadata structure of the vault; creates only the elements that are missing, so
	//   calling it again does no harm.
	rpc EnableAnnotationsAndRedlining( EnableAnnotationsAndRedliningRequest ) returns ( EnableAnnotationsAndRedliningResponse ) {
		option idempotency_level = IDEMPOTENT;
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_SESSION };
	}

	// Archives old versions of documents that meet the job's conditions into an archive file on the
	// server, or previews how many would be archived.
	//
	// - **Starts a background job and returns before it completes** unless `preview_only` is true;
	//   follow it with a session of this vault (see the service overview). A preview runs within the
	//   call and changes nothing.
	// - Requires a vault session and the vault right `archive`. Running the job for real (not a preview)
	//   also needs the server right `manage_jobs`; without it the call fails with "Access denied". For
	//   callers without that right, leave `archivejob.target_file` empty also in a preview.
	// - Fails on M-Files editions that do not include archiving.
	rpc ArchiveOldVersions( ArchiveOldVersionsRequest ) returns ( ArchiveOldVersionsResponse ) {
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_SESSION };
	}

	// Checks whether the vault has an automatically created Microsoft Entra ID (Azure AD)
	// authentication configuration.
	//
	// Requires a vault session with full control of the vault (a normal user gets "Access
	// denied"). Read-only.
	rpc ContainsAutomaticAzureADConfiguration( ContainsAutomaticAzureADConfigurationRequest ) returns ( ContainsAutomaticAzureADConfigurationResponse ) {
		option idempotency_level = IDEMPOTENT;
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_SESSION };
	}

	// Deletes the automatically created Microsoft Entra ID (Azure AD) authentication configuration of
	// the vault.
	//
	// - Requires a vault session with full control of the vault.
	// - Changes the vault's authentication configuration.
	rpc DeleteAutomaticAzureADConfiguration( DeleteAutomaticAzureADConfigurationRequest ) returns ( DeleteAutomaticAzureADConfigurationResponse ) {
		option idempotency_level = IDEMPOTENT;
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_SESSION };
	}

	// Sets the Microsoft Entra ID (Azure AD) consent mode of the vault.
	//
	// - **For M-Files components only.** M-Files Admin calls it when it sets up Entra ID authentication.
	//   Applications should not call it.
	// - Requires a vault session with full control of the vault.
	// - Accepts only the vault variable `AZUREACTIVEDIRECTORYCONSENTMODE`; any other name fails with an
	//   invalid-argument error. To change other vault variables, use
	//   [UpdateVault](mfiles:MFiles.IRPCVaultsAdmin.UpdateVault).
	rpc SetVaultVariables( SetVaultVariablesRequest ) returns ( SetVaultVariablesResponse ) {
		option idempotency_level = IDEMPOTENT;
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_SESSION internal: true };
	}

	// Gets whether user provisioning (SCIM) from Microsoft Entra ID (Azure AD) is enabled in the vault,
	// and the license type of provisioned users.
	//
	// Requires a vault session with full control of the vault. Read-only.
	rpc GetAzureADProvisioningState( GetAzureADProvisioningStateRequest ) returns ( GetAzureADProvisioningStateResponse ) {
		option idempotency_level = IDEMPOTENT;
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_SESSION };
	}

	// Enables or disables user provisioning (SCIM) from Microsoft Entra ID (Azure AD) in the vault.
	//
	// - Requires a vault session with full control of the vault.
	// - The vault must already have a provisioning configuration; otherwise the call fails.
	rpc SetAzureADProvisioningState( SetAzureADProvisioningStateRequest ) returns ( SetAzureADProvisioningStateResponse ) {
		option idempotency_level = IDEMPOTENT;
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_SESSION };
	}

	// Imports the contents of an archive (or one object of it) into the vault, or previews the import.
	//
	// - **Starts a background job and returns before it completes** unless `preview_only` is true;
	//   follow it with a session of this vault (see the service overview). A preview runs within the
	//   call and changes nothing.
	// - Requires a vault session and the vault right `restore_from_archive`. Without the server right
	//   `manage_jobs`, a real (not preview) import must read from cloud storage
	//   (`cloud_storage_connection_string` and `cloud_storage_password`), and `source_file` must be
	//   empty even in a preview; otherwise it fails with "Access denied".
	// - Fails on M-Files editions that do not include archiving.
	// - The preview writes a summary report (XML). Download it with
	//   [DownloadScheduledJobOutputFile_ReadBlock](mfiles:MFiles.IRPCScheduledJobsAdmin.DownloadScheduledJobOutputFile_ReadBlock)
	//   (`download_id` = `download_idsummary`), reading blocks until a block is shorter than requested.
	rpc RestoreFromArchive( RestoreFromArchiveRequest ) returns ( RestoreFromArchiveResponse ) {
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_SESSION };
	}

	// Gets the default cloud storage connection string for the vault's archive and replication jobs.
	//
	// - Requires a vault session and the vault rights `archive` and `restore_from_archive` (a
	//   normal user gets "Access denied"). Read-only.
	// - On a server without a default configuration, `connection_string` is empty.
	rpc GetDefaultReplicationConfiguration( GetDefaultReplicationConfigurationRequest ) returns ( GetDefaultReplicationConfigurationResponse ) {
		option idempotency_level = IDEMPOTENT;
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_SESSION };
	}

	// Lists the search indexes of the vault with their state and the management operations the caller
	// may run on each.
	//
	// - Requires a vault session and the vault right `see_all_objects` (a normal user gets
	//   "Access denied"). Read-only.
	// - `allowed_operations` lists what
	//   [ExecuteIndexManagementOperation](mfiles:MFiles.IRPCVaultAdmin.ExecuteIndexManagementOperation)
	//   accepts for the index from this caller; a vault administrator without server rights sees only
	//   `INDEX_MANAGEMENT_OPERATION_REBUILD` on the active indexes.
	rpc GetIndexOptions( GetIndexOptionsRequest ) returns ( GetIndexOptionsResponse ) {
		option idempotency_level = IDEMPOTENT;
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_SESSION };
	}

	// Runs a management operation on one search index of the vault: rebuild, re-index, activate,
	// enable, disable or delete.
	//
	// - Requires a vault session and the vault right `verify_vault`. Activate, enable, disable and
	//   delete also require the system administrator server role (server right `manage_vaults`).
	// - Rebuild and re-index start background work by the M-Files indexing service; there is no task ID
	//   to follow. Re-index works only on combined indexes (`INDEXED_DATA_TYPE_COMBINED`).
	// - Get the index names and the operations allowed for the caller from
	//   [GetIndexOptions](mfiles:MFiles.IRPCVaultAdmin.GetIndexOptions).
	rpc ExecuteIndexManagementOperation( ExecuteIndexManagementOperationRequest ) returns ( ExecuteIndexManagementOperationResponse ) {
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_SESSION };
	}

	// Creates the automatic Microsoft Entra ID (Azure AD) authentication configuration of the vault
	// from a completed administrator consent sign-in.
	//
	// - **For M-Files components only.** M-Files Admin calls it after the administrator has signed in
	//   to Entra ID and given consent. Applications should not call it.
	// - Requires a vault session with full control of the vault.
	// - `input` is authentication data in M-Files' own binary format; the call fails with "No
	//   configuration available." unless it comes from the automatic configuration sign-in.
	rpc AddAutomaticAzureADConfiguration( AddAutomaticAzureADConfigurationRequest ) returns ( AddAutomaticAzureADConfigurationResponse ) {
		option idempotency_level = IDEMPOTENT;
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_SESSION internal: true };
	}

	// Exports (archives) the objects that match a filter into an archive package, or previews how many
	// would be archived.
	//
	// - **Starts a background job and returns before it completes** unless `preview_only` is true;
	//   follow it with a session of this vault (see the service overview). A preview runs within the
	//   call and changes nothing.
	// - Requires a vault session and the vault right `archive`. Without the server right `manage_jobs`,
	//   a real (not preview) archive must go to cloud storage (`cloud_storage_connection_string` and
	//   `cloud_storage_password`), and `target_path` must be empty even in a preview; otherwise it
	//   fails with "Access denied". With `manage_jobs`, set either `target_path` or the cloud storage
	//   settings.
	// - Depending on `archive_job.options`, the objects can be destroyed after they are archived.
	// - Fails on M-Files editions that do not include archiving.
	rpc ArchiveDocuments( ArchiveDocumentsRequest ) returns ( ArchiveDocumentsResponse ) {
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_SESSION };
	}

	// Lists the authentication configurations of the vault that need to be migrated to the current
	// format.
	//
	// - Requires a vault session with full control of the vault. Read-only.
	// - M-Files Admin shows these and migrates each with
	//   [MigrateAuthenticationConfiguration](mfiles:MFiles.IRPCVaultAdmin.MigrateAuthenticationConfiguration).
	rpc GetMigrantAuthenticationConfigurations( GetMigrantAuthenticationConfigurationsRequest ) returns ( GetMigrantAuthenticationConfigurationsResponse ) {
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_SESSION };
	}

	// Migrates one authentication configuration of the vault to the current format after a successful
	// test sign-in with it.
	//
	// - **For M-Files components only.** M-Files Admin calls it after the administrator has tested the
	//   migrated configuration by signing in. Applications should not call it.
	// - Requires a vault session with full control of the vault.
	// - `auth_data` is the result of the test sign-in in M-Files' own binary format. The call fails if
	//   the sign-in data does not validate against the migrated configuration.
	rpc MigrateAuthenticationConfiguration( MigrateAuthenticationConfigurationRequest ) returns ( MigrateAuthenticationConfigurationResponse ) {
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_SESSION internal: true };
	}
}

// The request of VerifyVault.
message VerifyVaultRequest {

	// What to verify: the vault (`vault_guid`), whether to fix the problems found (`fix_errors`) and whether to also check the contents of the files on disk (`verify_file_contents`).
	VerifyVaultJob verifyvaultjob = 1;

	// True to verify within the call. False to start a background job and return at once.
	bool synchronous = 2;
}

// The response of VerifyVault.
message VerifyVaultResponse {

	// The ID of the server-level verification job when `synchronous` is false.
	int32 task_id = 1;

	// The problems found, one message per item in `errors`, when `synchronous` is true. Empty if the vault has no problems.
	VerifyVaultJobOutputInfo poutput = 2;
}

// The request of RebuildFullTextSearchIndexes.
message RebuildFullTextSearchIndexesRequest {

	// True to rebuild the index of the metadata (property values).
	bool rebuild_meta_data_index = 1;

	// True to rebuild the index of the file contents.
	bool rebuild_file_data_index = 2;
}

// The response of RebuildFullTextSearchIndexes.
message RebuildFullTextSearchIndexesResponse {
}

// The request of CheckForIssue9855Errors.
message CheckForIssue9855ErrorsRequest {
}

// The response of CheckForIssue9855Errors.
message CheckForIssue9855ErrorsResponse {

	// The number of recorded, not dismissed problems; 0 if none.
	int32 potentially_affected_objects = 1;
}

// The request of DismissIssue9855Errors.
message DismissIssue9855ErrorsRequest {
}

// The response of DismissIssue9855Errors.
message DismissIssue9855ErrorsResponse {
}

// The request of GetIssue9855ErrorDetails.
message GetIssue9855ErrorDetailsRequest {
}

// The response of GetIssue9855ErrorDetails.
message GetIssue9855ErrorDetailsResponse {

	// The problems found, one message per item in `errors`.
	VerifyVaultJobOutputInfo poutput = 1;
}

// The request of CheckAnnotationsAndRedlining.
message CheckAnnotationsAndRedliningRequest {
}

// The response of CheckAnnotationsAndRedlining.
message CheckAnnotationsAndRedliningResponse {

	// True if all metadata structure elements of the feature exist in the vault.
	bool enabled = 1;
}

// The request of EnableAnnotationsAndRedlining.
message EnableAnnotationsAndRedliningRequest {
}

// The response of EnableAnnotationsAndRedlining.
message EnableAnnotationsAndRedliningResponse {
}

// The request of ArchiveOldVersions.
message ArchiveOldVersionsRequest {

	// True to only count what would be archived; the destination in the job is then ignored and nothing changes. False to start the archiving job.
	bool preview_only = 1;

	// The conditions that select the old versions, the target file on the server and the archiving options.
	ArchiveOldVersionsJob archivejob = 2;
}

// The response of ArchiveOldVersions.
message ArchiveOldVersionsResponse {

	// The ID of the vault's archiving job when `preview_only` is false.
	int32 task_id = 1;

	// The preview result when `preview_only` is true: affected documents, versions and bytes.
	ArchiveOldVersionsJobOutputInfo parchiveoldversjoboinfo = 2;
}

// The request of ContainsAutomaticAzureADConfiguration.
message ContainsAutomaticAzureADConfigurationRequest {
}

// The response of ContainsAutomaticAzureADConfiguration.
message ContainsAutomaticAzureADConfigurationResponse {

	// True if the automatically created configuration exists.
	bool contains_configuration = 1;
}

// The request of DeleteAutomaticAzureADConfiguration.
message DeleteAutomaticAzureADConfigurationRequest {
}

// The response of DeleteAutomaticAzureADConfiguration.
message DeleteAutomaticAzureADConfigurationResponse {
}

// The request of SetVaultVariables.
message SetVaultVariablesRequest {

	// The vault variables to set; only `AZUREACTIVEDIRECTORYCONSENTMODE` is accepted.
	repeated VaultVariable vaultvariables = 1;

	// True to also store the variables in the vault database.
	bool update_in_db = 2;
}

// The response of SetVaultVariables.
message SetVaultVariablesResponse {
}

// The request of GetAzureADProvisioningState.
message GetAzureADProvisioningStateRequest {
}

// The response of GetAzureADProvisioningState.
message GetAzureADProvisioningStateResponse {

	// True if user provisioning from Entra ID is enabled.
	bool provisioning_enabled = 1;

	// The license type that new provisioned users get.
	LicenseType lisence_type = 2;
}

// The request of SetAzureADProvisioningState.
message SetAzureADProvisioningStateRequest {

	// True to enable provisioning, false to disable it.
	bool provisioning_enabled = 1;

	// The license type that new provisioned users get when provisioning is enabled.
	LicenseType lisence_type = 2;
}

// The response of SetAzureADProvisioningState.
message SetAzureADProvisioningStateResponse {
}

// The request of RestoreFromArchive.
message RestoreFromArchiveRequest {

	// True to only preview the import and produce a summary report; nothing changes. False to start the import job.
	bool preview_only = 1;

	// The archive to import (a file on the server or cloud storage), what to import and the import options.
	RestoreFromArchiveJob restorefromarchivejob = 2;
}

// The response of RestoreFromArchive.
message RestoreFromArchiveResponse {

	// The ID of the vault's import job when `preview_only` is false.
	int32 task_id = 1;

	// Not used: always empty. Download the summary report instead.
	RestoreFromArchiveJobOutputInfo prestorefromarchivejoboinfo = 2;

	// The download ID of the preview's summary report when `preview_only` is true. 0 if there is no report.
	int32 download_idsummary = 3;

	// The size of the summary report in bytes.
	int64 file_size_summary = 4;
}

// The request of GetDefaultReplicationConfiguration.
message GetDefaultReplicationConfigurationRequest {
}

// The response of GetDefaultReplicationConfiguration.
message GetDefaultReplicationConfigurationResponse {

	// The default configuration; `connection_string` is the cloud storage connection string, or empty.
	DefaultReplicationConfiguration default_replication_configuration = 1;
}

// The request of GetIndexOptions.
message GetIndexOptionsRequest {
}

// The response of GetIndexOptions.
message GetIndexOptionsResponse {

	// One item per index: its name, the data it indexes, the search engine, whether it is enabled and active, and the operations the caller may run on it.
	repeated IndexOptions index_options = 1;
}

// The request of ExecuteIndexManagementOperation.
message ExecuteIndexManagementOperationRequest {

	// The index (`name`, as returned by GetIndexOptions) and the operation.
	IndexManagementOperationData operation_data = 1;
}

// The response of ExecuteIndexManagementOperation.
message ExecuteIndexManagementOperationResponse {
}

// The request of AddAutomaticAzureADConfiguration.
message AddAutomaticAzureADConfigurationRequest {

	// Input authentication data.
	bytes input = 1;

	// The set of client capabilities describing what the client software supports.
	ClientCapabilities capabilities = 2;
}

// The response of AddAutomaticAzureADConfiguration.
message AddAutomaticAzureADConfigurationResponse {
}

// The request of ArchiveDocuments.
message ArchiveDocumentsRequest {

	// True to only count what would be archived; the destination in the job is then ignored and nothing changes. False to start the archiving job.
	bool preview_only = 1;

	// The objects to archive (`object_filter`), the destination and the options.
	ArchiveDocsJob archive_job = 2;
}

// The response of ArchiveDocuments.
message ArchiveDocumentsResponse {

	// The ID of the vault's archiving job when `preview_only` is false.
	int32 task_id = 1;

	// The preview result when `preview_only` is true: the number of objects and bytes.
	ArchiveDocsJobOutputInfo archive_jobs_info = 2;
}

// The request of GetMigrantAuthenticationConfigurations.
message GetMigrantAuthenticationConfigurationsRequest {
}

// The response of GetMigrantAuthenticationConfigurations.
message GetMigrantAuthenticationConfigurationsResponse {

	// The configurations to migrate, each in its migrated form. Empty if none.
	repeated AuthenticationConfigurationMigration configurations = 1;

	// The authentication plugin information of each configuration, in the same order as `configurations`.
	repeated PluginInfo plugin_infos = 2;
}

// The request of MigrateAuthenticationConfiguration.
message MigrateAuthenticationConfigurationRequest {

	// The configuration to migrate, as returned by [GetMigrantAuthenticationConfigurations](mfiles:MFiles.IRPCVaultAdmin.GetMigrantAuthenticationConfigurations).
	AuthenticationConfigurationMigration configuration = 1;

	// Authentication data from the test sign-in with the migrated configuration.
	bytes auth_data = 2;
}

// The response of MigrateAuthenticationConfiguration.
message MigrateAuthenticationConfigurationResponse {
}