Create a user account

Set to 1 to include confidential data in the response, such as the password hash and secret keys and data. This option is ignored unless the authenticated user has the `*` permission.

Free form text field for external systems

creation time as unix timestamp in milliseconds. It will be 0 for users created before v2.2.0

optional description, for example the user full name

Maximum download bandwidth as KB/s, 0 means unlimited. Enforced as an aggregate across the user concurrent downloads on an instance: the combined download rate stays within this value regardless of the number of parallel transfers or protocols in use

Maximum data transfer allowed for downloads as MB. 0 means no limit

The user's email address.

expiration date as unix timestamp in milliseconds. An expired account cannot login. 0 means no expiration

Storage filesystem details. The `provider` field selects which sub-config is active — all other sub-configs are ignored / cleared on save. See `FsProviders` for the mapping. * `provider: -1` → no sub-config (None; users and groups) * `provider: 0` → `osconfig` (local; root is the user's `home_dir`) * `provider: 1` → `s3config` * `provider: 2` → `gcsconfig` * `provider: 3` → `azblobconfig` * `provider: 4` → `cryptconfig` (encrypted local; root is the user's `home_dir`) * `provider: 5` → `sftpconfig` * `provider: 6` → `httpconfig` * `provider: 7` → `ftpconfig`

Additional user options, including access restrictions, authentication settings, and account preferences.

first download time as unix timestamp in milliseconds

first upload time as unix timestamp in milliseconds

if you run SFTPGo as root user, the created files and directories will be assigned to this gid. 0 means no change, the group will be the one of the user that runs SFTPGo. Ignored on windows

Groups associated with the user. Each entry specifies a group name and a type: 1 for primary, 2 for secondary, or 3 for membership only.

Indicates whether the password is set

path to the user home directory. The user cannot upload or download files outside this directory. SFTPGo tries to automatically create this folder if missing. Must be an absolute path

Last user login as unix timestamp in milliseconds. It is saved at most once every 10 minutes

last password change time as unix timestamp in milliseconds

Last quota update as unix timestamp in milliseconds

Maximum number of concurrent sessions and file transfers for the user. 0 means unlimited

This field is passed to the pre-login hook if custom OIDC token fields have been configured. Field values can be of any type (this is a free form object) and depend on the type of the configured OIDC token fields

If the password has no known hashing algo prefix it will be stored, by default, using bcrypt, argon2id is supported too. You can send a password hashed as bcrypt ($2a$ prefix), argon2id, pbkdf2 or unix crypt and it will be stored as is. For security reasons this field is omitted when you search/get users

hash map with directory as key and an array of permissions as value. Directories must be absolute paths, permissions for root directory ("/") are required

Public keys in OpenSSH authorized_keys format. A key prefixed with from="<CIDR>[,<CIDR>...]" authenticates from the listed networks. This is the supported option, written in this exact form.

Quota as number of files. 0 means unlimited. Please note that quota is updated if files are added/removed via SFTPGo otherwise a quota scan or a manual quota update is needed

Quota as size in bytes. 0 means unlimited. Please note that quota is updated if files are added/removed via SFTPGo otherwise a quota scan or a manual quota update is needed

Role name for the user. Administrators carrying the role manage the users carrying it. Where the role isolates its resources, the account reaches the groups and the folders of its own role, and its home directory and filesystem are measured against the role storage allowlist on every save

Account status: * `0` user is disabled, login is not allowed * `1` user is enabled

Maximum total data transfer as MB. 0 means unlimited. You can set a total data transfer instead of the individual values for uploads and downloads

if you run SFTPGo as root user, the created files and directories will be assigned to this uid. 0 means no change, the owner will be the user that runs SFTPGo. Ignored on windows

last update time as unix timestamp in milliseconds

Maximum upload bandwidth as KB/s, 0 means unlimited. Enforced as an aggregate across the user concurrent uploads on an instance: the combined upload rate stays within this value regardless of the number of parallel transfers or protocols in use

Maximum data transfer allowed for uploads as MB. 0 means no limit

Downloaded size, as bytes, since the last reset

Uploaded size, as bytes, since the last reset

Unique username. After creation it is immutable via the API.

mapping between virtual SFTPGo paths and virtual folders