API: Managing groups
Available since FileRun 2026.3.0.
All the endpoints below require the admin scope, take POST requests and answer with JSON.
| Action | Target URL |
|---|---|
| Search groups | /api.php/Core/!admin/groups/search |
| Get group information | /api.php/Core/!admin/groups/info |
| Add a group | /api.php/Core/!admin/groups/add |
| Edit a group | /api.php/Core/!admin/groups/edit |
| Delete a group | /api.php/Core/!admin/groups/delete |
| Add users to a group | /api.php/Core/!admin/groups/add_users |
| Remove a user from a group | /api.php/Core/!admin/groups/remove_user |
Who can manage groups
- The superuser manages every group.
- An independent administrator manages the groups they own (the groups they created).
- A simple administrator manages the groups selected in the "Can manage" option of their account. A simple administrator set to manage all users manages every group.
- Creating a group is allowed to the superuser, to independent administrators and to simple administrators who manage all users.
A request on a group the administrator does not manage is refused with "You are not allowed to manage this group.".
Searching groups
| Parameter | Type | Required | Description |
|---|---|---|---|
| search | string | Yes | Keyword to look for in the group names. |
The response carries the matching groups the administrator manages in the data array, sorted by name, each with id, name and description. A search matching nothing answers with an empty array.
Getting group information
| Parameter | Type | Required | Description |
|---|---|---|---|
| id | integer | Yes | The group id |
The response carries the group in data: id, name, description and users, the list of members. Each member has id, public_id, name (the full name) and email.
Adding a group
| Parameter | Type | Required | Description |
|---|---|---|---|
| name | string | Yes | |
| description | string | No |
The group name has to be unique among the groups of the same owner. The response carries the id of the new group as data.gid. Creating a group creates the group alone. The members are added through the add users endpoint.
Editing a group
| Parameter | Type | Required | Description |
|---|---|---|---|
| id | integer | Yes | The group id |
| name | string | No | |
| description | string | No |
Only the values sent are changed. A parameter left out leaves the group as it is. A request which names nothing to change is refused with "No changes were made!". A group cannot be renamed to an empty name, nor to a name already used.
Deleting a group
| Parameter | Type | Required | Description |
|---|---|---|---|
| id | integer | Yes | The group id |
Deleting a group removes the memberships of its users, the shares made with the group and the notification rules set for it. A guest account left without any share is deleted along with the group. The response carries the group id as data.gid.
Adding users to a group
| Parameter | Type | Required | Description |
|---|---|---|---|
| id | integer | Yes | The group id |
| uids | array | Yes | The ids of the user accounts to add |
Each user is added on its own. The response carries the ids of the users which were added as data.uidsAdded, and the request is successful only when every user was added. A user who is already a member, a user who does not exist, or a user the administrator is not allowed to manage is refused, while the others are still added.
An administrator can add only the accounts they are allowed to manage (an account which is a member of a group they administer), plus their own account.
Removing a user from a group
| Parameter | Type | Required | Description |
|---|---|---|---|
| id | integer | Yes | The group id |
| uid | integer | Yes | The user id |
The request is refused if the user is not a member of the group ("The user is not part of the group!").