↑↓ to navigate ↵ to open Esc to close Search by Algolia

You are reading the documentation of FileRun 2026.4.0, which is not released yet. It is subject to change, so do not use it for planning. Read this page for FileRun 2026.3.0

API: Modify FileRun user accounts
Target URL /api.php/Core/!admin/users/edit
Required scope admin
HTTP Method POST
Output format JSON

Request Parameters Reference

Besides the parameters described for adding user accounts, this API method uses also the following:

Parameter Type Required Description
UID integer Yes The user ID
generate_password boolean No Set this to generate a new password. The plain text generated password will be included in the response, as data.password.
notify boolean No Set to 1 to have FileRun e-mail the new credentials to the user, when the username or the password changed.
data[userIsActive] boolean No Set to 1 to activate the account, 0 to deactivate it. Left out, the account keeps its state (since 2026.3.0).
data[two_step_reset] boolean No Set to 1 to remove the second authentication factor of the account (since 2026.3.0).
data[language] string No The language the e-mail messages to the account are written in, empty for the default language. Left out, the account keeps its language (since 2026.4.0).
data[require_email_otp] boolean No Set to 1 to have every sign-in of the account end with a second step, as described for adding accounts. Left out, it is turned off (since 2026.4.0).

Notes

  • The endpoint rebuilds the whole permissions record from the request. A permission left out of perms is stored as 0, so send every permission the account is meant to keep. An older client which sends perms[changes] instead of the permissions of FileRun 2026.4.0 sets rename_move, delete_files, delete_folders and delete_permanently, and leaves edit_files, collections, starring and write_metadata off.
  • Some permissions are stored as 0 when a permission they depend on is 0, as listed on Add FileRun user accounts.
  • You cannot edit your own account, nor the System account. The account of a shared drive cannot be edited either ("A shared drive can only be changed from the "Shared drives" section of the control panel.").
  • Changing the password revokes the sessions, the OAuth2 tokens and the app passwords of the account.
  • Changing the role to the Guest role turns the account into a guest account, and changing it from the Guest role to another one turns it into a regular account. The licence limits and the administrator's own limits apply.
  • A request which changes nothing is refused with "No changes were made!".