// M-Files Server gRPC API 26.11. Generated from the M-Files Server IDL; do not edit.
// Documentation: https://developer.m-files.com/APIs/gRPC-API/
syntax = "proto3";

package MFiles;

import "mfiles/api/annotations.proto";
import "mfiles/enums.proto";
import "mfiles/structs.proto";

option csharp_namespace = "MFiles.Grpc";
option go_package = "github.com/M-Files/mfiles-grpc-api/go/mfiles;mfiles";
option java_multiple_files = true;
option java_package = "com.mfiles.grpc";
option objc_class_prefix = "MF_";

// Manages vault login accounts: login accounts stored in one vault, used on servers that have
// vault login accounts enabled, such as M-Files Cloud.
//
// Use this interface to add, modify and delete vault logins.
//
// A login account is what a person or application authenticates with: account type (M-Files or
// Windows), user name, password, license type, full name and email
// ([Login](mfiles:MFiles.Login)). Normally login accounts belong to the server and are managed by
// system administrators with [IRPCLoginsAdmin](mfiles:MFiles.IRPCLoginsAdmin). On a server with
// **vault login accounts** enabled, each vault keeps its own login accounts in the vault, and
// vault administrators manage them with this service. Either way, a login needs a user account in
// the vault ([IRPCUsersAdmin](mfiles:MFiles.IRPCUsersAdmin)) to use the vault; see the table in
// the [IRPCUsersAdmin](mfiles:MFiles.IRPCUsersAdmin) overview.
//
// - **Availability.** Vault login accounts are a server-wide setting. Check it anonymously with
//   [GetServerCapabilities](mfiles:MFiles.IRPCLogin.GetServerCapabilities):
//   `server_capabilities.vault_login_accounts`. An M-Files Cloud server returned true; a default
//   on-premises server returns false. When it is false, **every method of this service** fails
//   with "This operation is currently not available. The registry key for enabling vault-specific
//   login accounts needs to be set first." (error code 0x8004093A), before the session is checked.
// - **Session and rights.** Requires a vault session; the methods work on the logins of that
//   vault. Most methods need the vault right `manage_users`
//   ([VaultAccess](mfiles:MFiles.VaultAccess)); the server role system administrator is not
//   needed. A server can be configured to make vault login accounts read-only for vault
//   administrators: then
//   [AddVaultLogin](mfiles:MFiles.IRPCVaultLoginsAdmin.AddVaultLogin),
//   [ModifyVaultLogin](mfiles:MFiles.IRPCVaultLoginsAdmin.ModifyVaultLogin),
//   [ModifyVaultLoginEx](mfiles:MFiles.IRPCVaultLoginsAdmin.ModifyVaultLoginEx) and
//   [RemoveVaultLogin](mfiles:MFiles.IRPCVaultLoginsAdmin.RemoveVaultLogin) also need the system
//   administrator server role (server right `manage_logins`).
// - **Server and vault logins together.** When a vault login and a server login have the same
//   account name, the vault login is used for that vault. A vault login can never have the system
//   administrator role. While vault login accounts are enabled, server-level
//   [AddLogin](mfiles:MFiles.IRPCLoginsAdmin.AddLogin) accepts only system administrators.
// - **Logins with an External ID** (`Login.external_id`) are maintained by identity
//   synchronization (M-Files Manage); removing or renaming them here fails.
//
// Methods by task (the server-level equivalents are in
// [IRPCLoginsAdmin](mfiles:MFiles.IRPCLoginsAdmin)):
//
// - **Read:** [GetVaultLogins](mfiles:MFiles.IRPCVaultLoginsAdmin.GetVaultLogins),
//   [GetVaultLogin](mfiles:MFiles.IRPCVaultLoginsAdmin.GetVaultLogin),
//   [GetVaultLoginsWithSessions](mfiles:MFiles.IRPCVaultLoginsAdmin.GetVaultLoginsWithSessions).
// - **Add, change, remove:** [AddVaultLogin](mfiles:MFiles.IRPCVaultLoginsAdmin.AddVaultLogin),
//   [ModifyVaultLogin](mfiles:MFiles.IRPCVaultLoginsAdmin.ModifyVaultLogin),
//   [ModifyVaultLoginEx](mfiles:MFiles.IRPCVaultLoginsAdmin.ModifyVaultLoginEx),
//   [RemoveVaultLogin](mfiles:MFiles.IRPCVaultLoginsAdmin.RemoveVaultLogin),
//   [ForceLogoutVaultLoginSessions](mfiles:MFiles.IRPCVaultLoginsAdmin.ForceLogoutVaultLoginSessions).
// - **Passwords:**
//   [CreateVaultLoginPasswordResetRequest](mfiles:MFiles.IRPCVaultLoginsAdmin.CreateVaultLoginPasswordResetRequest),
//   [ResetVaultLoginPassword](mfiles:MFiles.IRPCVaultLoginsAdmin.ResetVaultLoginPassword),
//   [GetVaultLoginPasswordHash](mfiles:MFiles.IRPCVaultLoginsAdmin.GetVaultLoginPasswordHash),
//   [SetVaultLoginPasswordHash](mfiles:MFiles.IRPCVaultLoginsAdmin.SetVaultLoginPasswordHash).
// - **Directory lookups for importing Windows accounts:**
//   [GetAllDomainsInVault](mfiles:MFiles.IRPCVaultLoginsAdmin.GetAllDomainsInVault),
//   [GetOrganizationalUnitsForDomainInVault](mfiles:MFiles.IRPCVaultLoginsAdmin.GetOrganizationalUnitsForDomainInVault),
//   [GetWindowsGroupsInVault](mfiles:MFiles.IRPCVaultLoginsAdmin.GetWindowsGroupsInVault),
//   [GetWindowsGroupMembersInVault](mfiles:MFiles.IRPCVaultLoginsAdmin.GetWindowsGroupMembersInVault),
//   [GetFullNameAndEmailInVault](mfiles:MFiles.IRPCVaultLoginsAdmin.GetFullNameAndEmailInVault).
//   They read the domain directory, or the vault's default user synchronization plugin when one is
//   configured for the domain. A server can be configured to use only that plugin for callers
//   without the server right `manage_logins`.
//
// Typical provisioning on such a server:
// [AddVaultLogin](mfiles:MFiles.IRPCVaultLoginsAdmin.AddVaultLogin), then
// [AddUser](mfiles:MFiles.IRPCUsersAdmin.AddUser) with `login_name` set to the new login's account
// name.
service IRPCVaultLoginsAdmin {
	option (mfiles.api.service) = { book: "admin" level: LEVEL_SPECIALIZED title: "Vault login accounts" };

	// Removes a login account from the vault.
	//
	// - Deletes the login; it can no longer authenticate to this vault. The user account that refers
	//   to it stays, with its `external_id` cleared; remove or disable it separately with
	//   [IRPCUsersAdmin](mfiles:MFiles.IRPCUsersAdmin).
	// - Requires the vault right `manage_users` (see the service overview for servers where vault
	//   logins are read-only for vault administrators).
	// - An unknown account name fails with "Not found.". A login with an `external_id` fails with
	//   "Access denied" ("... should be changed via Manage").
	rpc RemoveVaultLogin( RemoveVaultLoginRequest ) returns ( RemoveVaultLoginResponse ) {
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_SESSION };
	}

	// Looks up the full name and email address of a Windows account in the directory.
	//
	// - Requires the vault right `manage_users`. Reads the vault's default user synchronization plugin
	//   if it synchronizes the account's domain, otherwise the domain directory. Used to prefill a new
	//   login account.
	// - An empty account name fails with "The parameter is incorrect.".
	rpc GetFullNameAndEmailInVault( GetFullNameAndEmailInVaultRequest ) returns ( GetFullNameAndEmailInVaultResponse ) {
		option idempotency_level = IDEMPOTENT;
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_SESSION };
	}

	// Lists Windows groups of the server's domains, for importing users by group.
	//
	// - Requires the vault right `manage_users`. Without a domain, local groups of the server computer
	//   are included (not on a domain controller).
	// - The number of groups searched is limited; `group_limit_exceeded` tells whether the list was
	//   cut. Narrow the search with `domain_name` and `organizational_unit_name_dn`.
	rpc GetWindowsGroupsInVault( GetWindowsGroupsInVaultRequest ) returns ( GetWindowsGroupsInVaultResponse ) {
		option idempotency_level = IDEMPOTENT;
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_SESSION };
	}

	// Lists the users and groups that are members of a Windows group.
	//
	// - Requires the vault right `manage_users`. Reads the vault's default user synchronization plugin
	//   if it synchronizes the group's domain, otherwise the domain directory.
	rpc GetWindowsGroupMembersInVault( GetWindowsGroupMembersInVaultRequest ) returns ( GetWindowsGroupMembersInVaultResponse ) {
		option idempotency_level = IDEMPOTENT;
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_SESSION };
	}

	// Lists the domains whose accounts can be imported: the server's own domain and the domains it
	// can reach.
	//
	// - Requires the vault right `manage_users`. Includes the domains of the vault's default user
	//   synchronization plugin. Returns no directory domains when the server computer is not in a
	//   domain.
	rpc GetAllDomainsInVault( GetAllDomainsInVaultRequest ) returns ( GetAllDomainsInVaultResponse ) {
		option idempotency_level = IDEMPOTENT;
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_SESSION };
	}

	// Lists the organizational units of a domain.
	//
	// - Requires the vault right `manage_users`. Use the result to narrow
	//   [GetWindowsGroupsInVault](mfiles:MFiles.IRPCVaultLoginsAdmin.GetWindowsGroupsInVault).
	rpc GetOrganizationalUnitsForDomainInVault( GetOrganizationalUnitsForDomainInVaultRequest ) returns ( GetOrganizationalUnitsForDomainInVaultResponse ) {
		option idempotency_level = IDEMPOTENT;
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_SESSION };
	}

	// Logs out all sessions of the given login accounts in this vault.
	//
	// - Ends the sessions immediately; their clients must log in again. Only sessions to the caller's
	//   vault are affected.
	// - Requires the vault right `manage_users`. Find logged-in accounts with
	//   [GetVaultLoginsWithSessions](mfiles:MFiles.IRPCVaultLoginsAdmin.GetVaultLoginsWithSessions).
	rpc ForceLogoutVaultLoginSessions( ForceLogoutVaultLoginSessionsRequest ) returns ( ForceLogoutVaultLoginSessionsResponse ) {
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_SESSION };
	}

	// Creates a password reset link for an M-Files login of the vault, and optionally emails it to the
	// login's email address.
	//
	// - Requires a vault session; no vault rights are needed to request a reset. Only callers with the
	//   vault right `manage_users` get the link in `password_reset_url`; for others it is empty and the
	//   link reaches the user only by email.
	// - The login is found by `account_name`, or by `account_email_address` when the name is empty
	//   (the address must match exactly one login). It must be an M-Files login with an email
	//   address and without the system administrator role; otherwise the request fails.
	// - `site_url` is required. Repeated requests for the same login in a short time fail. The link
	//   expires after 7 days by default. The server can be configured to disable password resets.
	// - Complete the reset with
	//   [ResetVaultLoginPassword](mfiles:MFiles.IRPCVaultLoginsAdmin.ResetVaultLoginPassword).
	rpc CreateVaultLoginPasswordResetRequest( CreateVaultLoginPasswordResetRequestRequest ) returns ( CreateVaultLoginPasswordResetRequestResponse ) {
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_SESSION };
	}

	// Reads the password hash of a vault login, encrypted with a public key that the caller supplies.
	//
	// - Requires the vault right `manage_users`. The hash can be stored on another login with
	//   [SetVaultLoginPasswordHash](mfiles:MFiles.IRPCVaultLoginsAdmin.SetVaultLoginPasswordHash)
	//   without anyone knowing the password.
	// - Encryption is required: `PASSWORD_ENCRYPTION_UNENCRYPTED` fails with "The parameter is
	//   incorrect.".
	rpc GetVaultLoginPasswordHash( GetVaultLoginPasswordHashRequest ) returns ( GetVaultLoginPasswordHashResponse ) {
		option idempotency_level = IDEMPOTENT;
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_SESSION };
	}

	// Sets the password of a vault login from a password hash.
	//
	// - Requires the vault right `manage_users`. An unknown account fails with "Not found.". Only
	//   M-Files logins have a password; Windows logins authenticate against Windows.
	rpc SetVaultLoginPasswordHash( SetVaultLoginPasswordHashRequest ) returns ( SetVaultLoginPasswordHashResponse ) {
		option idempotency_level = IDEMPOTENT;
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_SESSION };
	}

	// Sets a new password for a vault login, authorized by a password reset link.
	//
	// - Requires a vault session but no vault rights: `expiration_time` and `reset_password_hash`
	//   from the link created by
	//   [CreateVaultLoginPasswordResetRequest](mfiles:MFiles.IRPCVaultLoginsAdmin.CreateVaultLoginPasswordResetRequest)
	//   authorize the change. An expired or invalid link fails.
	// - The new password must be sent as an encrypted hash: with a `new_password_hash`, an
	//   unencrypted `password_encryption` or an undefined `password_hash_algorithm_new` fails with
	//   "The parameter is incorrect.".
	rpc ResetVaultLoginPassword( ResetVaultLoginPasswordRequest ) returns ( ResetVaultLoginPasswordResponse ) {
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_SESSION };
	}

	// Adds a login account to the vault.
	//
	// - Requires the vault right `manage_users` (see the service overview for servers where vault
	//   logins are read-only for vault administrators).
	// - A vault login cannot be a system administrator: `login.options.system_administrator` fails
	//   the call.
	// - The license type is checked against the server's licenses.
	// - The login does not give access to the vault by itself: add a user account for it with
	//   [AddUser](mfiles:MFiles.IRPCUsersAdmin.AddUser).
	rpc AddVaultLogin( AddVaultLoginRequest ) returns ( AddVaultLoginResponse ) {
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_SESSION };
	}

	// Gets all login accounts stored in the vault.
	//
	// - Requires the vault right `manage_users`. Returns the vault's own logins only, not server
	//   logins. The order is not specified.
	rpc GetVaultLogins( GetVaultLoginsRequest ) returns ( GetVaultLoginsResponse ) {
		option idempotency_level = IDEMPOTENT;
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_SESSION };
	}

	// Gets one vault login by account name.
	//
	// - Any user may read the caller's own login (the name is compared case-insensitively); other
	//   logins require the vault right `manage_users`. An unknown account fails with "Not found.".
	rpc GetVaultLogin( GetVaultLoginRequest ) returns ( GetVaultLoginResponse ) {
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_SESSION };
	}

	// Gets the login accounts that currently have sessions to this vault.
	//
	// - Requires the vault right `manage_users`. Use with
	//   [ForceLogoutVaultLoginSessions](mfiles:MFiles.IRPCVaultLoginsAdmin.ForceLogoutVaultLoginSessions).
	rpc GetVaultLoginsWithSessions( GetVaultLoginsWithSessionsRequest ) returns ( GetVaultLoginsWithSessionsResponse ) {
		option idempotency_level = IDEMPOTENT;
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_SESSION };
	}

	// Changes the server roles, password, full name, email address or license type of a vault login.
	//
	// - Requires the vault right `manage_users` (see the service overview for servers where vault
	//   logins are read-only for vault administrators).
	// - `srvroles` is always applied; the system administrator role is refused. The password changes
	//   only with `change_password`, and the name, email and license type only with
	//   `update_other_fields`. With `update_other_fields`, a login with an `external_id` fails with
	//   "Access denied" (it is maintained by identity synchronization).
	// - An unknown account name fails with "Not found".
	// - `update_client_id` and `client_id` are ignored by this method.
	// - To rename the login, use
	//   [ModifyVaultLoginEx](mfiles:MFiles.IRPCVaultLoginsAdmin.ModifyVaultLoginEx).
	rpc ModifyVaultLogin( ModifyVaultLoginRequest ) returns ( ModifyVaultLoginResponse ) {
		option idempotency_level = IDEMPOTENT;
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_SESSION };
	}

	// Replaces the data of a vault login, optionally including its account name.
	//
	// - Requires the vault right `manage_users` (see the service overview for servers where vault
	//   logins are read-only for vault administrators). The system administrator role is refused.
	// - If `login` gives a different account name (domain or user name), `allow_changing_username`
	//   must be true; otherwise the call fails with "Access denied". The new name must not exist yet.
	//   The user account that refers to the login is updated to the new name. Logins with an
	//   `external_id` cannot be renamed.
	// - An unknown `account_name` fails with "Not found".
	rpc ModifyVaultLoginEx( ModifyVaultLoginExRequest ) returns ( ModifyVaultLoginExResponse ) {
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_SESSION };
	}
}

// The request of RemoveVaultLogin.
message RemoveVaultLoginRequest {

	// The account name of the login: the user name of an M-Files login, or `DOMAIN\user` of a Windows login.
	string account_name = 1;
}

// The response of RemoveVaultLogin.
message RemoveVaultLoginResponse {
}

// The request of GetFullNameAndEmailInVault.
message GetFullNameAndEmailInVaultRequest {

	// The Windows account name, `DOMAIN\user`.
	string account_name = 1;
}

// The response of GetFullNameAndEmailInVault.
message GetFullNameAndEmailInVaultResponse {

	// The full name from the directory.
	string full_name = 1;

	// The email address from the directory.
	string email = 2;
}

// The request of GetWindowsGroupsInVault.
message GetWindowsGroupsInVaultRequest {

	// The domain to list groups from, or unset for all groups.
	string domain_name = 1;

	// The distinguished name of an organizational unit to search in, or unset to search the whole domain.
	string organizational_unit_name_dn = 2;

	// True to search the organizational units below it too. Used only with `domain_name`.
	bool search_sub_items = 3;
}

// The response of GetWindowsGroupsInVault.
message GetWindowsGroupsInVaultResponse {

	// Group names, for example `DOMAIN\Domain Users`.
	repeated string groups = 1;

	// True if more groups exist than were returned.
	bool group_limit_exceeded = 2;
}

// The request of GetWindowsGroupMembersInVault.
message GetWindowsGroupMembersInVaultRequest {

	// The group, for example `DOMAIN\Domain Users`.
	string group_name = 1;

	// Whether to include only direct members or also members of nested groups. See [ExternalGroupImportMode](mfiles:MFiles.ExternalGroupImportMode).
	ExternalGroupImportMode egim = 2;
}

// The response of GetWindowsGroupMembersInVault.
message GetWindowsGroupMembersInVaultResponse {

	// Member user names, for example `DOMAIN\user`.
	repeated string users = 1;

	// Member group names, for example `DOMAIN\Group 1`.
	repeated string groups = 2;
}

// The request of GetAllDomainsInVault.
message GetAllDomainsInVaultRequest {
}

// The response of GetAllDomainsInVault.
message GetAllDomainsInVaultResponse {

	// Domain names.
	repeated string domains = 1;
}

// The request of GetOrganizationalUnitsForDomainInVault.
message GetOrganizationalUnitsForDomainInVaultRequest {

	// The domain name in NT format, for example `CONTOSO`.
	string domain = 1;
}

// The response of GetOrganizationalUnitsForDomainInVault.
message GetOrganizationalUnitsForDomainInVaultResponse {

	// The organizational units. See [DirectoryItem](mfiles:MFiles.DirectoryItem).
	repeated DirectoryItem ous = 1;
}

// The request of ForceLogoutVaultLoginSessions.
message ForceLogoutVaultLoginSessionsRequest {

	// The account names of the logins whose sessions to end.
	repeated string account_names = 1;
}

// The response of ForceLogoutVaultLoginSessions.
message ForceLogoutVaultLoginSessionsResponse {
}

// The request of CreateVaultLoginPasswordResetRequest.
message CreateVaultLoginPasswordResetRequestRequest {

	// The account name of the login, or empty to find it by email address.
	string account_name = 1;

	// The email address of the login; used when `account_name` is empty.
	string account_email_address = 2;

	// The web address the reset link is based on.
	string site_url = 3;

	// True to email the link to the login's email address.
	bool send_email = 4;
}

// The response of CreateVaultLoginPasswordResetRequest.
message CreateVaultLoginPasswordResetRequestResponse {

	// The reset link; empty unless the caller has the vault right `manage_users`.
	string password_reset_url = 1;
}

// The request of GetVaultLoginPasswordHash.
message GetVaultLoginPasswordHashRequest {

	// How the hash is encrypted for transit. Must not be `PASSWORD_ENCRYPTION_UNENCRYPTED`.
	PasswordEncryption password_encryption = 3;

	// The public key the server encrypts the hash with.
	bytes public_key = 1;

	// The account name of the login.
	string account_name = 2;
}

// The response of GetVaultLoginPasswordHash.
message GetVaultLoginPasswordHashResponse {

	// Legacy copy of the hash. Use `password_info`.
	string password_hash = 1;

	// The encrypted password hash with its algorithm and salt.
	PasswordInfo password_info = 2;
}

// The request of SetVaultLoginPasswordHash.
message SetVaultLoginPasswordHashRequest {

	// The account name of the login.
	string account_name = 1;

	// Legacy field. Leave empty and use `password_info`.
	string password_hash = 2;

	// The new password hash, for example as read with [GetVaultLoginPasswordHash](mfiles:MFiles.IRPCVaultLoginsAdmin.GetVaultLoginPasswordHash).
	PasswordInfo password_info = 3;
}

// The response of SetVaultLoginPasswordHash.
message SetVaultLoginPasswordHashResponse {
}

// The request of ResetVaultLoginPassword.
message ResetVaultLoginPasswordRequest {

	// The account name from the reset link.
	string account_name = 1;

	// The expiration time from the reset link.
	string expiration_time = 2;

	// The hash from the reset link.
	string reset_password_hash = 3;

	// The encrypted hash of the new password.
	string new_password_hash = 4;

	// How `new_password_hash` is encrypted. Must not be `PASSWORD_ENCRYPTION_UNENCRYPTED`.
	PasswordEncryption password_encryption = 5;

	// The algorithm the new password was hashed with.
	PasswordHashAlgorithm password_hash_algorithm_new = 6;

	// The salt used in hashing the new password.
	string new_password_salt = 7;
}

// The response of ResetVaultLoginPassword.
message ResetVaultLoginPasswordResponse {
}

// The request of AddVaultLogin.
message AddVaultLoginRequest {

	// The new login. See [Login](mfiles:MFiles.Login).
	Login login = 1;

	// Legacy field. Leave empty and use `password_info`.
	string password_hash = 2;

	// The encrypted password hash, for an M-Files login.
	PasswordInfo password_info = 3;
}

// The response of AddVaultLogin.
message AddVaultLoginResponse {
}

// The request of GetVaultLogins.
message GetVaultLoginsRequest {
}

// The response of GetVaultLogins.
message GetVaultLoginsResponse {

	// The vault logins. See [Login](mfiles:MFiles.Login).
	repeated Login values = 1;
}

// The request of GetVaultLogin.
message GetVaultLoginRequest {

	// The account name of the login.
	string account_name = 1;
}

// The response of GetVaultLogin.
message GetVaultLoginResponse {

	// The login. See [Login](mfiles:MFiles.Login).
	Login plogin = 1;
}

// The request of GetVaultLoginsWithSessions.
message GetVaultLoginsWithSessionsRequest {
}

// The response of GetVaultLoginsWithSessions.
message GetVaultLoginsWithSessionsResponse {

	// The logins with active sessions. See [Login](mfiles:MFiles.Login).
	repeated Login values = 1;
}

// The request of ModifyVaultLogin.
message ModifyVaultLoginRequest {

	// The account name of the login to modify.
	string account_name = 1;

	// The new server roles of the login. `system_administrator` is not allowed.
	SRVROLES srvroles = 2;

	// True to set the password from `password_info`.
	bool change_password = 3;

	// Legacy field. Leave empty and use `password_info`.
	string password_hash = 4;

	// The new encrypted password hash. Used only with `change_password`.
	PasswordInfo password_info = 9;

	// True to set `full_name`, `email_address` and `licensetype`.
	bool update_other_fields = 5;

	// The full name of the account.
	string full_name = 6;

	// The email address of the account.
	string email_address = 7;

	// The new license type. Used only with `update_other_fields`.
	LicenseType licensetype = 8;

	// Ignored.
	bool update_client_id = 10;

	// Ignored.
	string client_id = 11;
}

// The response of ModifyVaultLogin.
message ModifyVaultLoginResponse {
}

// The request of ModifyVaultLoginEx.
message ModifyVaultLoginExRequest {

	// The current account name of the login.
	string account_name = 1;

	// True to allow renaming the login; the user account that refers to it is updated too.
	bool allow_changing_username = 2;

	// The new data of the login. See [Login](mfiles:MFiles.Login).
	Login login = 3;

	// Ignored by current servers.
	bool update_client_id = 4;
}

// The response of ModifyVaultLoginEx.
message ModifyVaultLoginExResponse {
}