API: Add FileRun user accounts
| Target URL | /api.php/Core/!admin/users/add |
| Required scope | admin |
| HTTP Method | POST |
| Output format | JSON |
Request Parameters Reference
| Parameter | Type | Default value | Required | Description |
| data[username] | string | Yes | The username may not contain special characters, except for underscores, dashes, @, dots and spaces. | |
| data[name] | string | Yes | ||
| data[last_name] | string | No | ||
| data[password] | string | Yes | ||
| generate_password | boolean | No | Set to 1 to have FileRun assign a randomly generated password which matches the current password policy settings. | |
| notify | boolean | 0 | No | Set to 1 to have FileRun e-mail the sign-in details to the user. Nothing is sent when the account has no e-mail address. |
| data[require_2fa] | boolean | 0 | No | Set to 1 to require two-step authentication for the account. Always 1 when the password policy requires two-step authentication. (Named two_step_enabled before 2026.3.0.) |
| data[require_email_otp] | boolean | 0 | No | Since 2026.4.0. Set to 1 to have every sign-in of the account end with a second step. An account with no second factor of its own gets a code sent to its e-mail address. Refused for an account without an e-mail address. |
| data[owner] | integer | NULL | No | This can be the ID of the parent independent admin user. Taken into account only when the request is made by the superuser. |
| data[activated] | boolean | 1 | No | |
| data[expiration_date] | MySQL datetime | NULL | No | Example: 2024-01-31 00:00:00 |
| data[require_password_change] | boolean | 0 | No | |
| data[email] | string | No | ||
| data[receive_notifications] | boolean | 0 | No | |
| data[language] | string | No | Since 2026.4.0. The language the e-mail messages to the account are written in, named as its folder of translations, such as german. Empty for the default language. |
|
| data[phone] | string | No | ||
| data[company] | string | No | ||
| data[website] | string | No | ||
| data[description] | string | No | ||
| data[logo_url] | string | No | ||
| perms[role] | integer | NULL | No | ID of role. If defined, the homefolder is automatically set. A role which grants administrative permissions can be assigned only by the superuser. |
| perms[admin_type] | string | NULL | No | Possible values: simple, indep |
| perms[admin_users] | boolean | 0 | No | |
| perms[admin_roles] | boolean | 0 | No | |
| perms[admin_notifications] | boolean | 0 | No | |
| perms[admin_logs] | boolean | 0 | No | |
| perms[admin_metadata] | boolean | 0 | No | |
| perms[admin_shared_drives] | boolean | 0 | No | Since 2026.4.0. Lets a simple administrator administer the shared drives. See Managing shared drives. |
| perms[admin_over] | mixed | No | Set to "-ALL-" if the user is an admin who can manage all other users | |
| perms[admin_max_users] | integer | 0 | No | |
| perms[admin_max_guest_users] | integer | NULL | No | Leave empty for no limit. |
| perms[admin_homefolder_template] | string | No | ||
| perms[homefolder] | string | No | This is an absolute path to a folder existing in the server's file system. Always use forward slash as a path separator, including on Windows servers. | |
| perms[space_quota_max] | integer | 0 | No | |
| perms[edit_files] | boolean | 0 | No | Since 2026.4.0. Edit existing files, including managing their previous versions. |
| perms[rename_move] | boolean | 0 | No | Since 2026.4.0. Rename and move files and folders. |
| perms[delete_files] | boolean | 0 | No | Since 2026.4.0. Delete files, open the trash and restore items from it. |
| perms[delete_folders] | boolean | 0 | No | Since 2026.4.0. Delete folders. |
| perms[delete_permanently] | boolean | 0 | No | Since 2026.4.0. Delete files and folders permanently, directly or from the trash, and empty the trash. |
| perms[collections] | boolean | 0 | No | Since 2026.4.0. Create and manage collections and photo albums. |
| perms[starring] | boolean | 0 | No | Since 2026.4.0. Star files and folders. |
| perms[changes] | boolean | No | The permission of FileRun 2026.3, still accepted for older clients. It sets rename_move, delete_files, delete_folders and delete_permanently to its value, except the ones the request sends itself. It does not set edit_files, collections, starring or write_metadata. |
|
| perms[upload] | boolean | 0 | No | |
| perms[upload_max_size] | integer | 0 | No | |
| perms[upload_limit_types] | string | No | Comma delimited list of file extensions | |
| perms[download] | boolean | 0 | No | |
| perms[download_folders] | boolean | 0 | No | |
| perms[read_comments] | boolean | 0 | No | |
| perms[write_comments] | boolean | 0 | No | |
| perms[weblink] | boolean | 0 | No | |
| perms[share] | boolean | 0 | No | |
| perms[share_guests] | boolean | 0 | No | |
| perms[metadata] | boolean | 0 | No | |
| perms[write_metadata] | boolean | 0 | No | Since 2026.4.0. Change tags, ratings and other metadata. |
| perms[file_history] | boolean | 0 | No | |
| perms[users_may_see] | string | No | -ALL-, or the groups and users the account may see, as group:1|group:2|user:3. Left out, the account may see nobody. |
|
| perms[change_auth] | boolean | 0 | No | Whether the user may change their password and sign-in methods. (Named change_pass before 2026.3.0.) |
| perms[edit_profile] | boolean | 0 | No | |
| groups | array | No | A list of group names. If groups with the specified names are not found, they are automatically created. Every group must be one the administrator is allowed to manage; otherwise the request is refused before the account is created. |
The permissions left out of the request are stored as 0. Send every permission the account is meant to have.
Some permissions mean nothing without another one. Since FileRun 2026.4.0 they are stored as 0 when that one is 0, whatever the request sends:
- Without
download:download_folders,edit_files,rename_move,delete_files,collections,starring,read_comments,share,weblink,metadataandfile_history, and through them the permissions below. - Without
delete_files:delete_foldersanddelete_permanently. - Without
share:share_guests. - Without
read_comments:write_comments. - Without
metadata:write_metadata.
Example response
Example response after successful request:
1{
2 "success": true,
3 "msg": ["..."],
4 "data": {
5 "generated_password": "12345678",
6 "uid": "44"
7 }
8}
Where "44" is the ID of the newly created user account and "12345678" is the password generated by FileRun.
Example response after failed request:
1{
2 "success": false,
3 "msg": ["..."]
4}