Child Site Management Policies

A Child Site Management Policy is a centralized policy defined by a parent site to enforce consistent configurations across child sites. These policies allow parent sites to maintain control over specific aspects of their child sites' functionality and appearance.

Non-default policies apply only to the child sites listed in child_site_ids, and each child site can be explicitly assigned to only one policy.

One policy can be designated as the default policy. It applies to every child site not explicitly assigned to another policy or listed in its skip_child_site_ids, including newly created child sites. Only a default policy can exclude child sites. The value field contains the policy configuration data, with the format varying based on the policy type. When a policy is active, its managed configurations are automatically enforced on applicable child sites, and attribute modifications are not permitted.

Settings Policy

Manages site settings and root folder behaviors for child sites. Allows centralized control of site configuration across multiple child sites.

Policy Details
Policy type	`settings`
Supported site settings	See the Value Hash section below.
Non-centrally managed settings	name, subdomain, domain, custom_namespace, disable_files_certificate_generation, legacy_checksums_mode, welcome_screen, show_request_access_link, disable_2fa_with_delay
Requires site admin?	Yes
Can skip child sites?	Yes, supply an array for `skip_child_site_id`` for the child sites to skip when applying the policy.

Value Hash Parameter	Description
domain_hsts_header	Send HSTS (HTTP Strict Transport Security) header when visitors access the site via a custom domain?
domain_letsencrypt_chain	Letsencrypt chain to use when registering SSL Certificate for domain. No longer used as of 2026.
email	Main email for this site
reply_to_email	Reply-to email for this site
allow_bundle_names	Are manual Bundle names allowed?
bundle_expiration	Site-wide Bundle expiration in days
welcome_email_enabled	Will the welcome email be sent to new users?
ask_about_overwrites	If false, rename conflicting files instead of asking for overwrite confirmation. Only applies to web interface.
always_mkdir_parents	Create parent directories if they do not exist during uploads? This is primarily used to work around broken upload clients that assume servers will perform this step.
welcome_email_cc	Include this email in welcome emails if enabled
welcome_email_subject	Include this email subject in welcome emails if enabled
welcome_custom_text	Custom text send in user welcome email
language	Site default language
windows_mode_ftp	Does FTP user Windows emulation mode?
default_time_zone	Site default time zone
desktop_app	Is the desktop app enabled?
desktop_app_session_ip_pinning	Is desktop app session IP pinning enabled?
desktop_app_session_lifetime	Desktop app session lifetime (in hours)
mobile_app	Is the mobile app enabled?
mobile_app_session_ip_pinning	Is mobile app session IP pinning enabled?
mobile_app_session_lifetime	Mobile app session lifetime (in hours)
folder_permissions_groups_only	If true, permissions for this site must be bound to a group (not a user).
office_integration_available	If true, allows users to use a document editing integration.
office_integration_type	Which document editing integration to support. Files.com Editor or Microsoft Office for the Web.
pin_all_remote_servers_to_site_region	If true, we will ensure that all internal communications with any remote server are made through the primary region of the site. This setting overrides individual remote server settings.
motd_text	A message to show users when they connect via FTP or SFTP.
motd_use_for_ftp	Show message to users connecting via FTP
motd_use_for_sftp	Show message to users connecting via SFTP
left_navigation_visibility	Visibility settings for account navigation
disable_all_ai_features	If true, all AI features are disabled for this site.
ai_feature_availability	Availability settings for AI features by user class
mcp_dcr_enabled	Is OAuth DCR (dynamic client registration) for MCP enabled?
additional_text_file_types	Additional extensions that are considered text files
bundle_require_note	Do Bundles require internal notes?
bundle_send_shared_receipts	Do Bundle creators receive receipts of invitations?
bundles_default_owned_by_primary_group	If true, new Share Links created by a user with a primary group will default to that group as owner.
calculate_file_checksums_crc32	Calculate CRC32 checksums for files?
calculate_file_checksums_md5	Calculate MD5 checksums for files?
calculate_file_checksums_sha1	Calculate SHA1 checksums for files?
calculate_file_checksums_sha256	Calculate SHA256 checksums for files?
migrate_remote_server_sync_to_sync	If true, we will migrate all remote server syncs to the new Sync model.
as2_message_retention_days	Number of days to retain AS2 messages (incoming and outgoing).
username_display	How usernames are displayed in the web UI. Can be `username_only`, `full_name_only`, `full_name_username`, `full_name_company`, or `full_name_username_company`.
session_expiry_minutes	Session expiry in minutes
ssl_required	Is SSL required? Disabling this is insecure.
sftp_insecure_ciphers	If true, we will allow weak and known insecure ciphers to be used for SFTP connections. Enabling this setting severely weakens the security of your site and it is not recommend, except as a last resort for compatibility.
sftp_insecure_diffie_hellman	If true, we will allow weak Diffie Hellman parameters to be used within ciphers for SFTP that are otherwise on our secure list. This has the effect of making the cipher weaker than our normal threshold for security, but is required to support certain legacy or broken SSH and MFT clients. Enabling this weakens security, but not nearly as much as enabling the full `sftp_insecure_ciphers` option.
fedramp	Are FedRAMP security restrictions enabled for this site?
user_lockout	Will users be locked out after incorrect login attempts?
user_lockout_tries	Number of login tries within `user_lockout_within` hours before users are locked out
user_lockout_within	Number of hours for user lockout window
user_lockout_lock_period	How many hours to lock user out for failed password?
include_password_in_welcome_email	Include password in emails to new users?
allowed_countries	Comma separated list of allowed Country codes
allowed_ips	List of allowed IP addresses
allow_user_level_2fa_override	Allow the site-wide two-factor authentication requirement to be overriden on a per-user-basis?
allow_user_level_allowed_ip_override	Allow the site-wide allowed IP restriction to be overriden on a per-user-basis?
allow_user_level_ssl_override	Allow the site-wide FTP SSL requirement to be overriden on a per-user-basis?
disallowed_countries	Comma separated list of disallowed Country codes
days_to_retain_backups	Number of days to keep deleted files
max_prior_passwords	Number of prior passwords to disallow
password_validity_days	Number of days password is valid
password_min_length	Shortest password length for users
password_require_letter	Require a letter in passwords?
password_require_mixed	Require lower and upper case letters in passwords?
password_require_special	Require special characters in password?
password_require_number	Require a number in passwords?
password_require_unbreached	Require passwords that have not been previously breached? (see https://haveibeenpwned.com/)
require_logout_from_bundles_and_inboxes	If true, we will hide the 'Remember Me' box on Inbox and Bundle registration pages, requiring that the user logout and log back in every time they visit the page.
dav_user_root_enabled	Use user FTP roots also for WebDAV?
sftp_user_root_enabled	Use user FTP roots also for SFTP?
disable_password_reset	Is password reset disabled?
immutable_files	Are files protected from modification?
bundle_not_found_message	Custom error message to show when bundle is not found.
bundle_password_required	Do Bundles require password protection?
bundle_require_registration	Do Bundles require registration?
bundle_require_share_recipient	Do Bundles require recipients for sharing?
bundle_send_one_time_password_to_recipient_at_registration	If true, new Share Links must send a one-time password to the recipient when they register. Requires bundle_require_share_recipient and cannot be enabled with bundle_password_required.
bundle_registration_notifications	Do Bundle owners receive registration notification?
bundle_activity_notifications	Do Bundle owners receive activity notifications?
bundle_upload_receipt_notifications	Do Bundle uploaders receive upload confirmation notifications?
document_edits_in_bundle_allowed	If true, allow public viewers of Bundles with full permissions to use document editing integrations.
password_requirements_apply_to_bundles	Require bundles' passwords, and passwords for other items (inboxes, public shares, etc.) to conform to the same requirements as users' passwords?
prevent_root_permissions_for_non_site_admins	If true, we will prevent non-administrators from receiving any permissions directly on the root folder. This is commonly used to prevent the accidental application of permissions.
restrict_root_folder_behaviors_to_site_admins	If true, only site admins may create, modify, or delete any behavior at the site root, or a skip that would disable one.
root_folder_behaviors_apply_to_workspaces	If true, supported protective behaviors at the site root also apply within named workspaces. Requires restrict_root_folder_behaviors_to_site_admins to be enabled.
opt_out_global	Use servers in the USA only?
use_provided_modified_at	Allow uploaders to set `provided_modified_at` for uploaded files?
non_sso_groups_allowed	If true, groups can be manually created / modified / deleted by Site Admins. Otherwise, groups can only be managed via your SSO provider.
non_sso_users_allowed	If true, users can be manually created / modified / deleted by Site Admins. Otherwise, users can only be managed via your SSO provider.
sharing_enabled	Allow bundle creation
snapshot_sharing_enabled	Allow snapshot share links creation
user_requests_enabled	Enable User Requests feature
user_requests_notify_admins	Send email to site admins when a user request is received?
dav_enabled	Is WebDAV enabled?
ftp_enabled	Is FTP enabled?
sftp_enabled	Is SFTP enabled?
sftp_finalize_partial_uploads	Finalize partial SFTP uploads from interrupted connections? Default: true.
users_can_create_api_keys	Allow users to create their own API keys?
users_can_create_ssh_keys	Allow users to create their own SSH keys?
show_user_notifications_log_in_link	Show log in link in user notifications?
sftp_host_key_type	Sftp Host Key Type
active_sftp_host_key_id	Id of the currently selected custom SFTP Host Key
active_sftp_host_key_ids	Ids of the selected custom SFTP Host Keys
protocol_access_groups_only	If true, protocol access permissions on users will be ignored, and only protocol access permissions set on Groups will be honored. Make sure that your current user is a member of a group with API permission when changing this value to avoid locking yourself out of your site.
revoke_bundle_access_on_disable_or_delete	Auto-removes bundles for disabled/deleted users and enforces bundle expiry within user access period.
bundle_watermark_value	Preview watermark settings applied to all bundle items. Uses the same keys as Behavior.value
group_admins_can_add_users	Allow group admins to create users in their groups
group_admins_can_manage_group_memberships	Allow group admins to add or remove existing users in their groups
group_admins_can_delete_users	Allow group admins to delete users in their groups
group_admins_can_enable_disable_users	Allow group admins to enable or disable users in their groups
group_admins_can_modify_users	Allow group admins to modify users in their groups
group_admins_can_bypass_user_lifecycle_rules	Allow group admins to exempt users in their groups from lifecycle rules
group_admins_can_reset_passwords	Allow group admins to reset passwords for users in their groups
group_admins_can_set_user_password	Allow group admins to set password authentication method
bundle_recipient_blacklist_free_email_domains	Disallow free email domains for Bundle/Inbox recipients?
bundle_recipient_blacklist_domains	List of email domains to disallow when entering a Bundle/Inbox recipients
admins_bypass_locked_subfolders	Allow admins to bypass the locked subfolders setting.
allowed_2fa_method_sms	Is SMS two factor authentication allowed?
allowed_2fa_method_totp	Is TOTP two factor authentication allowed?
allowed_2fa_method_webauthn	Is WebAuthn two factor authentication allowed?
allowed_2fa_method_yubi	Is yubikey two factor authentication allowed?
allowed_2fa_method_email	Is OTP via email two factor authentication allowed?
allowed_2fa_method_static	Is OTP via static codes for two factor authentication allowed?
allowed_2fa_method_bypass_for_ftp_sftp_dav	Are users allowed to configure their two factor authentication to be bypassed for FTP/SFTP/WebDAV?
require_2fa	Require two-factor authentication for all users?
require_2fa_exempt_all_sso_users	If true, SSO users using the default user-level two-factor authentication setting are exempt from the site-wide two-factor authentication requirement.
require_2fa_user_type	What type of user is required to use two-factor authentication (when require_2fa is set to `true` for this site)?
color2_top	Top bar background color
color2_left	Page link and button color
color2_link	Top bar link color
color2_text	Page link and button color
color2_top_text	Top bar text color
site_header	Custom site header text for authenticated pages
site_footer	Custom site footer text for authenticated pages
site_public_header	Custom site header text for public pages
site_public_footer	Custom site footer text for public pages
login_help_text	Login help text
use_dedicated_ips_for_smtp	If using custom SMTP, should we use dedicated IPs to deliver emails?
email_footer_custom_text	Custom footer text for system-generated emails. Supports standard strftime date/time patterns like %Y (4-digit year), %m (month), %d (day).
smtp_address	SMTP server hostname or IP
smtp_authentication	SMTP server authentication type
smtp_from	From address to use when mailing through custom SMTP
smtp_username	SMTP server username
smtp_password	Setting: Smtp password
smtp_port	SMTP server port
ldap_enabled	Main LDAP setting: is LDAP enabled?
ldap_type	LDAP type
ldap_host	LDAP host
ldap_host_2	LDAP backup host
ldap_host_3	LDAP backup host
ldap_port	LDAP port
ldap_secure	Use secure LDAP?
ldap_username	Username for signing in to LDAP server.
ldap_username_field	LDAP username field
ldap_domain	Domain name that will be appended to usernames
ldap_user_action	Should we sync users from LDAP server?
ldap_group_action	Should we sync groups from LDAP server?
ldap_user_include_groups	Comma or newline separated list of group names (with optional wildcards) - if provided, only users in these groups will be added or synced.
ldap_group_exclusion	Comma or newline separated list of group names (with optional wildcards) to exclude when syncing.
ldap_group_inclusion	Comma or newline separated list of group names (with optional wildcards) to include when syncing.
ldap_base_dn	Base DN for looking up users in LDAP server
ldap_password_change	Setting: Ldap password change
ldap_password_change_confirmation	Setting: Ldap password change confirmation
uploads_via_email_authentication	Do incoming emails in the Inboxes require checking for SPF/DKIM/DMARC?
folder_behaviors	Root folder behaviors to configure and manage on applicable child sites. Currently available behavior types: malware_scanning, file_expiration, limit_file_extensions, limit_file_regex.

Example Request

files-cli child-site-management-policies create \
  --value='{"domain_hsts_header":true,"domain_letsencrypt_chain":"example","email":"john.doe@files.com","reply_to_email":"jane.doe@files.com","allow_bundle_names":true,"bundle_expiration":1,"welcome_email_enabled":true,"ask_about_overwrites":true,"always_mkdir_parents":false,"welcome_email_cc":"example","welcome_email_subject":"example","welcome_custom_text":"Welcome to my site!","language":"en","windows_mode_ftp":true,"default_time_zone":"Pacific Time (US & Canada)","desktop_app":true,"desktop_app_session_ip_pinning":true,"desktop_app_session_lifetime":1,"mobile_app":true,"mobile_app_session_ip_pinning":true,"mobile_app_session_lifetime":1,"folder_permissions_groups_only":true,"office_integration_available":true,"office_integration_type":"example","pin_all_remote_servers_to_site_region":true,"motd_text":"example","motd_use_for_ftp":true,"motd_use_for_sftp":true,"left_navigation_visibility":{"sharing":{"admin":true,"all":true},"automation_flow":{"admin":false,"all":false},"integrations":{"admin":false,"all":false},"clients_protocols":{"admin":false,"all":false}},"disable_all_ai_features":true,"ai_feature_availability":{"in_app_ai_assistant":{"site_admins":true,"workspace_admins":true,"folder_admins":true,"all_users":true}},"mcp_dcr_enabled":true,"additional_text_file_types":["example"],"bundle_require_note":true,"bundle_send_shared_receipts":true,"bundles_default_owned_by_primary_group":true,"calculate_file_checksums_crc32":true,"calculate_file_checksums_md5":true,"calculate_file_checksums_sha1":true,"calculate_file_checksums_sha256":true,"migrate_remote_server_sync_to_sync":true,"as2_message_retention_days":1,"username_display":"username_only","session_expiry_minutes":360,"ssl_required":true,"sftp_insecure_ciphers":false,"sftp_insecure_diffie_hellman":false,"fedramp":true,"user_lockout":true,"user_lockout_tries":1,"user_lockout_within":6,"user_lockout_lock_period":1,"include_password_in_welcome_email":true,"allowed_countries":"US,DE","allowed_ips":"example","allow_user_level_2fa_override":true,"allow_user_level_allowed_ip_override":true,"allow_user_level_ssl_override":true,"disallowed_countries":"US,DE","days_to_retain_backups":30,"max_prior_passwords":1,"password_validity_days":1,"password_min_length":1,"password_require_letter":true,"password_require_mixed":true,"password_require_special":true,"password_require_number":true,"password_require_unbreached":true,"require_logout_from_bundles_and_inboxes":false,"dav_user_root_enabled":false,"sftp_user_root_enabled":false,"disable_password_reset":true,"immutable_files":false,"bundle_not_found_message":"example","bundle_password_required":true,"bundle_require_registration":true,"bundle_require_share_recipient":true,"bundle_send_one_time_password_to_recipient_at_registration":true,"bundle_registration_notifications":"never","bundle_activity_notifications":"never","bundle_upload_receipt_notifications":"never","document_edits_in_bundle_allowed":false,"password_requirements_apply_to_bundles":true,"prevent_root_permissions_for_non_site_admins":true,"restrict_root_folder_behaviors_to_site_admins":true,"root_folder_behaviors_apply_to_workspaces":true,"opt_out_global":true,"use_provided_modified_at":true,"non_sso_groups_allowed":true,"non_sso_users_allowed":true,"sharing_enabled":true,"snapshot_sharing_enabled":true,"user_requests_enabled":true,"user_requests_notify_admins":true,"dav_enabled":true,"ftp_enabled":true,"sftp_enabled":true,"sftp_finalize_partial_uploads":true,"users_can_create_api_keys":true,"users_can_create_ssh_keys":true,"show_user_notifications_log_in_link":true,"sftp_host_key_type":"default","active_sftp_host_key_id":1,"active_sftp_host_key_ids":[1],"protocol_access_groups_only":false,"revoke_bundle_access_on_disable_or_delete":false,"bundle_watermark_value":{"key":"example value"},"group_admins_can_add_users":true,"group_admins_can_manage_group_memberships":true,"group_admins_can_delete_users":true,"group_admins_can_enable_disable_users":true,"group_admins_can_modify_users":true,"group_admins_can_bypass_user_lifecycle_rules":true,"group_admins_can_reset_passwords":true,"group_admins_can_set_user_password":true,"bundle_recipient_blacklist_free_email_domains":true,"bundle_recipient_blacklist_domains":["example"],"admins_bypass_locked_subfolders":false,"allowed_2fa_method_sms":true,"allowed_2fa_method_totp":true,"allowed_2fa_method_webauthn":true,"allowed_2fa_method_yubi":true,"allowed_2fa_method_email":true,"allowed_2fa_method_static":true,"allowed_2fa_method_bypass_for_ftp_sftp_dav":true,"require_2fa":true,"require_2fa_exempt_all_sso_users":true,"require_2fa_user_type":"`site_admins`","color2_top":"#000000","color2_left":"#0066a7","color2_link":"#d34f5d","color2_text":"#0066a7","color2_top_text":"#ffffff","site_header":"example","site_footer":"example","site_public_header":"example","site_public_footer":"example","login_help_text":"Login page help text.","use_dedicated_ips_for_smtp":true,"email_footer_custom_text":"Copyright © %Y MyCompany Inc.","smtp_address":"smtp.my-mail-server.com","smtp_authentication":"plain","smtp_from":"me@my-mail-server.com","smtp_username":"mail","smtp_password":null,"smtp_port":25,"ldap_enabled":true,"ldap_type":"open_ldap","ldap_host":"ldap.site.com","ldap_host_2":"ldap2.site.com","ldap_host_3":"ldap3.site.com","ldap_port":1,"ldap_secure":true,"ldap_username":"[ldap username]","ldap_username_field":"sAMAccountName","ldap_domain":"mysite.com","ldap_user_action":"disabled","ldap_group_action":"disabled","ldap_user_include_groups":"example","ldap_group_exclusion":"example","ldap_group_inclusion":"example","ldap_base_dn":"example","ldap_password_change":null,"ldap_password_change_confirmation":null,"uploads_via_email_authentication":true,"folder_behaviors":[{"behavior":"file_expiration","value":{"days_to_retain":30}}]}' \
  --policy-type="settings"

List Child Site Management Policies

Command

files-cli child-site-management-policies list

Output

Outputs a list of ChildSiteManagementPolicy objects according to the output format.

Authorization Requirement

Requires either a Site-Wide API key or User API key or session from a User with Site Admin permissions.

Additional Arguments

Example Request

files-cli child-site-management-policies list

Show Child Site Management Policy

Command

files-cli child-site-management-policies find

Output

Outputs a ChildSiteManagementPolicy object according to the output format.

Authorization Requirement

Requires either a Site-Wide API key or User API key or session from a User with Site Admin permissions.

Flags

Flag	Description
--id= int64 Required	Child Site Management Policy ID.

Example Request

files-cli child-site-management-policies find \
  --id=1

Create Child Site Management Policy

Command

files-cli child-site-management-policies create

Output

Outputs a ChildSiteManagementPolicy object according to the output format.

Authorization Requirement

Requires either a Site-Wide API key or User API key or session from a User with Site Admin permissions.

Flags

Flag	Default	Description
--value= object		Policy configuration data. Attributes differ by policy type. For more information, refer to the Value Hash section of the developer documentation.
--skip-child-site-ids= array(int64)		IDs of child sites excluded from this default policy.
--child-site-ids= array(int64)		IDs of child sites explicitly assigned to this non-default policy.
--default-policy boolean	`true`	Whether this policy applies to child sites not explicitly assigned to another policy.
--policy-type= string Required		Type of policy. Valid values: `settings`. Possible values: `settings`
--name= string		Name for this policy.
--description= string		Description for this policy.

Example Request

files-cli child-site-management-policies create \
  --policy-type="settings"

Update Child Site Management Policy

Command

files-cli child-site-management-policies update

Output

Outputs a ChildSiteManagementPolicy object according to the output format.

Authorization Requirement

Requires either a Site-Wide API key or User API key or session from a User with Site Admin permissions.

Flags

Flag	Description
--id= int64 Required	Child Site Management Policy ID.
--value= object	Policy configuration data. Attributes differ by policy type. For more information, refer to the Value Hash section of the developer documentation.
--skip-child-site-ids= array(int64)	IDs of child sites excluded from this default policy.
--child-site-ids= array(int64)	IDs of child sites explicitly assigned to this non-default policy.
--default-policy boolean	Whether this policy applies to child sites not explicitly assigned to another policy.
--policy-type= string	Type of policy. Valid values: `settings`. Possible values: `settings`
--name= string	Name for this policy.
--description= string	Description for this policy.

Example Request

files-cli child-site-management-policies update \
  --id=1

Delete Child Site Management Policy

Command

files-cli child-site-management-policies delete

Output

No output is returned.

Authorization Requirement

Requires either a Site-Wide API key or User API key or session from a User with Site Admin permissions.

Flags

Flag	Description
--id= int64 Required	Child Site Management Policy ID.

Example Request

files-cli child-site-management-policies delete \
  --id=1

The ChildSiteManagementPolicy Object

Some of the commands above return a ChildSiteManagementPolicy object. The attributes of this object are listed below.

Attribute	Description
id int64	Policy ID.
policy_type string	Type of policy. Valid values: `settings`. Possible values: `settings`
name string	Name for this policy.
description string	Description for this policy.
value object	Policy configuration data. Settings policies accept site settings plus an optional `folder_behaviors` array for parent-managed root behaviors on child sites. For more information, refer to the Value Hash section of the developer documentation.
applied_child_site_ids array(int64)	IDs of child sites that this policy has been applied to. This field is read-only.
skip_child_site_ids array(int64)	IDs of child sites excluded from this default policy.
child_site_ids array(int64)	IDs of child sites explicitly assigned to this non-default policy.
default_policy boolean	Whether this policy applies to child sites not explicitly assigned to another policy.
created_at date-time	When this policy was created.
updated_at date-time	When this policy was last updated.

Child Site Management Policies

Settings Policy

List Child Site Management Policies

Command

Output

Authorization Requirement

Additional Arguments

Pagination

Show Child Site Management Policy

Command

Output

Authorization Requirement

Flags

Create Child Site Management Policy

Command

Output

Authorization Requirement

Flags

Update Child Site Management Policy

Command

Output

Authorization Requirement

Flags

Delete Child Site Management Policy

Command

Output

Authorization Requirement

Flags

The ChildSiteManagementPolicy Object