API: Add FileRun user accounts
| Target URL | /api.php/Core/!admin/users/add |
| Required scope | admin |
| HTTP Method | POST |
| Output format | JSON |
Request Parameters Reference
| Parameter | Type | Default value | Required | Description |
| data[username] | string | Yes | The username may not contain special characters, except for underscores, dashes, @, dots and spaces. | |
| data[name] | string | Yes | ||
| data[last_name] | string | No | ||
| data[password] | string | Yes | ||
| generate_password | boolean | No | Set to 1 to have FileRun assign a randomly generated password which matches the current password policy settings. | |
| data[require_2fa] | boolean | 0 | No | Set to 1 to require two-step authentication for the account. Always 1 when the password policy requires two-step authentication. (Named two_step_enabled before 2026.3.0.) |
| data[owner] | integer | NULL | No | This can be the ID of the parent independent admin user. Taken into account only when the request is made by the superuser. |
| data[activated] | boolean | 1 | No | |
| data[expiration_date] | MySQL datetime | NULL | No | Example: 2024-01-31 00:00:00 |
| data[require_password_change] | boolean | 0 | No | |
| data[email] | string | No | ||
| data[receive_notifications] | boolean | 0 | No | |
| data[phone] | string | No | ||
| data[company] | string | No | ||
| data[website] | string | No | ||
| data[description] | string | No | ||
| data[logo_url] | string | No | ||
| perms[role] | integer | NULL | No | ID of role. If defined, the homefolder is automatically set. A role which grants administrative permissions can be assigned only by the superuser. |
| perms[admin_type] | string | NULL | No | Possible values: simple, indep |
| perms[admin_users] | boolean | 0 | No | |
| perms[admin_roles] | boolean | 0 | No | |
| perms[admin_notifications] | boolean | 0 | No | |
| perms[admin_logs] | boolean | 0 | No | |
| perms[admin_metadata] | boolean | 0 | No | |
| perms[admin_over] | mixed | No | Set to "-ALL-" if the user is an admin who can manage all other users | |
| perms[admin_max_users] | integer | 0 | No | |
| perms[admin_max_guest_users] | integer | NULL | No | Leave empty for no limit. |
| perms[admin_homefolder_template] | string | No | ||
| perms[homefolder] | string | No | The is an absolute path to a folder existing in the server's file system. Always use forward slash as a path separator, including on Windows servers. | |
| perms[space_quota_max] | integer | 0 | No | |
| perms[edit_files] | boolean | 0 | No | Since 2026.3.1. Edit existing files, including managing their previous versions. |
| perms[rename_move_delete] | boolean | 0 | No | Since 2026.3.1. Rename, move and delete files and folders, including the trash. Named changes before, which is still accepted as an alias. |
| perms[collections] | boolean | 0 | No | Since 2026.3.1. Create and manage collections and photo albums. |
| perms[starring] | boolean | 0 | No | Since 2026.3.1. Star files and folders. |
| perms[upload] | boolean | 1 | No | |
| perms[upload_max_size] | integer | 0 | No | |
| perms[upload_limit_types] | string | No | Comma delimited list of file extensions | |
| perms[download] | boolean | 1 | No | |
| perms[download_folders] | boolean | 1 | No | |
| perms[read_comments] | boolean | 1 | No | |
| perms[write_comments] | boolean | 1 | No | |
| perms[weblink] | boolean | 1 | No | |
| perms[share] | boolean | 1 | No | |
| perms[share_guests] | boolean | 1 | No | |
| perms[metadata] | boolean | 1 | No | |
| perms[write_metadata] | boolean | 0 | No | Since 2026.3.1. Change tags, ratings and other metadata. |
| perms[file_history] | boolean | 1 | No | |
| perms[users_may_see] | string | -ALL- | No | |
| perms[change_auth] | boolean | 1 | No | Whether the user may change their password and sign-in methods. (Named change_pass before 2026.3.0.) |
| perms[edit_profile] | boolean | 1 | No | |
| groups | array | No | A list of group names. If groups with the specified names are not found, they are automatically created. Every group must be one the administrator is allowed to manage; otherwise the request is refused before the account is created. |
The permissions left out of the request are stored as 0. Send every permission the account is meant to have.
Example response
Example response after successful request:
1{
2 "success": true,
3 "msg": ["..."],
4 "data": {
5 "generated_password": "12345678",
6 "uid": "44"
7 }
8}
Where "44" is the ID of the newly created user account and "12345678" is the password generated by FileRun.
Example response after failed request:
1{
2 "success": false,
3 "msg": ["..."]
4}