Users

A User represents a human or system/service user with the ability to connect to Files.com via any of the available connectivity methods (unless restricted to specific protocols).

Users are associated with API Keys, SSH (SFTP) Keys, Notifications, Permissions, and Group memberships.

Authentication

The authentication_method property on a User determines exactly how that user can login and authenticate to their Files.com account. Files.com offers a variety of authentication methods to ensure flexibility, security, migration, and compliance.

These authentication methods can be configured during user creation and can be modified at any time by site administrators. The meanings of the available values are as follows:

  • password - Allows authentication via a password. If API Keys or SSH (SFTP) Keys are also configured, those can be used instead of the password. If Two Factor Authentication (2FA) methods are also configured, a valid 2nd factor is required in addition to the password.
  • email_signup - When set upon user creation, an email will be sent to the new user with a link for them to create their password. Once the user has created their password, their authentication type will change to password.
  • sso - Allows authentication via a linked Single Sign On provider. If API Keys or SSH (SFTP) Keys are also configured, those can be used instead of Single Sign On. If Two Factor Authentication (2FA) methods are also configured, a valid 2nd factor is required in addition to Single Sign On. When using this method, you must also provide a valid sso_strategy_id to associate the User to the appropriate SSO provider.
  • password_with_imported_hash - Works like the password method but allows importing a hashed password in MD5, SHA-1, or SHA-256 format. Provide the imported hash in the field imported_password_hash. Upon first use, the password will be converted to Files.com's internal storage format and the authentication type will change to password. Typically only used when migrating to Files.com from another MFT solution.
  • none - Does not allow authentication via username and password, but does allow authentication via API Key or SSH (SFTP) Key. Typically only used for service users.
  • password_and_ssh_key - Allows authentication only by providing a password and also a valid SSH (SFTP) Key in a single attempt. If API Keys are also configured, those can be used instead of the password and key combination. This method only works with (typically enterprise) SSH/SFTP clients capable of sending both authentication methods at once. Typically only used for service users.

List Users

Command

files-cli users list

Output

Outputs a list of User objects according to the output format.

Authorization Requirement

Requires either a Site-Wide API key or User API key or session from a User with Folder Admin permissions.

Flags

FlagDescription
--ids=
string
comma-separated list of User IDs
--include-parent-site-users
boolean
Include users from the parent site.
--search=
string
Searches for partial matches of name, username, or email.

Additional Arguments

Example Request

files-cli users list

Show User

Command

files-cli users find

Output

Outputs a User object according to the output format.

Authorization Requirement

Requires either a Site-Wide API key or User API key or session from a User with Folder Admin permissions.

Flags

FlagDescription
--id=
int64
Required
User ID.

Example Request

files-cli users find \
  --id=1

Create User

Command

files-cli users create

Output

Outputs a User object according to the output format.

Authorization Requirement

Available to all authenticated keys or sessions.

Flags

FlagDefaultDescription
--avatar-file=
file
An image file for your user avatar. See Attaching Files to API Requests.
--avatar-delete
boolean
If true, the avatar will be deleted.
--change-password=
string
Used for changing a password on an existing user.
--change-password-confirmation=
string
Optional, but if provided, we will ensure that it matches the value sent in change_password.
--email=
string
User's email.
--grant-permission=
string
Permission to grant on the User Root upon user creation. Can be blank or full, read, write, list, read+write, or list+write
--group-id=
int64
Group ID to associate this user with.
--group-ids=
string
A list of group ids to associate this user with. Comma delimited.
--imported-password-hash=
string
Pre-calculated hash of the user's password. If supplied, this will be used to authenticate the user on first login. Supported hash methods are MD5, SHA1, and SHA256.
--password=
string
User password.
--password-confirmation=
string
Optional, but if provided, we will ensure that it matches the value sent in password.
--announcements-read
boolean
Signifies that the user has read all the announcements in the UI.
--ai-assistant-personality-id=
int64
AI Assistant Personality ID assigned directly to this user, if any.
--allowed-ips=
string
A list of allowed IPs if applicable. Newline delimited
--attachments-permission
boolean
falseDEPRECATED: If true, the user can user create Bundles (aka Share Links). Use the bundle permission instead.
--authenticate-until=
string
Scheduled Date/Time at which user will be deactivated
--authentication-method=
string
"password"How is this user authenticated?
Possible values: password, sso, none, email_signup, password_with_imported_hash, password_and_ssh_key
--billing-permission
boolean
falseAllow this user to perform operations on the account, payments, and invoices?
--bypass-user-lifecycle-rules
boolean
falseExempt this user from user lifecycle rules?
--bypass-site-allowed-ips
boolean
falseAllow this user to skip site-wide IP blacklists?
--dav-permission
boolean
trueCan the user connect with WebDAV?
--desktop-configuration-profile-id=
int64
Desktop Configuration Profile ID assigned directly to this user, if any.
--default-workspace-id=
int64
Workspace ID the user should land in by default when more than one Workspace is available.
--disabled
boolean
falseIs user disabled? Disabled users cannot log in, and do not count for billing purposes. Users can be automatically disabled after an inactivity period via a Site setting or schedule to be deactivated after specific date.
--filesystem-layout=
string
"site_root"File system layout
Possible values: site_root, user_root, partner_root, integration_centric, workspace_root
--ftp-permission
boolean
trueCan the user access with FTP/FTPS?
--header-text=
string
Text to display to the user in the header of the UI
--integration-centric-profile-id=
int64
Integration Centric Profile ID assigned directly to this user, if any.
--language=
string
""Preferred language
--notification-daily-send-time=
int64
Hour of the day at which daily notifications should be sent. Can be in range 0 to 23
--name=
string
User's full name
--company=
string
User's company
--notes=
string
Any internal notes on the user
--office-integration-enabled
boolean
trueEnable integration with Office for the web?
--partner-admin
boolean
falseIs this user a Partner administrator?
--partner-id=
int64
Partner ID if this user belongs to a Partner
--password-validity-days=
int64
0Number of days to allow user to use the same password
--primary-group-id=
int64
Primary group ID for Group Admin scoping
--readonly-site-admin
boolean
falseIs the user an allowed to view all (non-billing) site configuration for this site?
--receive-admin-alerts
boolean
falseDeprecated. Use notify_on_all_site_warnings and granular failure notification preferences instead.
--notify-on-all-site-warnings
boolean
falseShould the user receive site warnings via email?
--notify-on-all-sso-failures
boolean
falseShould the user receive sso/scim/ldap configuration/sync failures via email?
--notify-on-all-user-security-events
boolean
falseShould the user receive user security events via email?
--notify-on-all-pending-work-failures
boolean
falseShould the user receive pending work failures via email?
--notify-on-all-siem-http-destination-failures
boolean
falseShould the user receive siem failures via email?
--notify-on-all-sync-failures
boolean
falseShould the user receive sync failures via email?
--notify-on-all-automation-failures
boolean
falseShould the user receive automation failures via email?
--notify-on-all-expectation-failures
boolean
falseShould the user receive expectation failures and misses via email?
--require-login-by=
string
Require user to login by specified date otherwise it will be disabled.
--require-password-change
boolean
falseIs a password change required upon next user login?
--responsible-group-id=
int64
ID of the internal Group responsible for this Partner User, overriding the Partner default.
--responsible-user-id=
int64
ID of the internal User responsible for this Partner User, overriding the Partner default.
--restapi-permission
boolean
trueCan this user access the Web app, Desktop app, SDKs, or REST API? (All of these tools use the API internally, so this is one unified permission set.)
--self-managed
boolean
trueDoes this user manage it's own credentials or is it a shared/bot user?
--sftp-permission
boolean
trueCan the user access with SFTP?
--site-admin
boolean
falseIs the user an administrator for this site?
--skip-welcome-screen
boolean
falseSkip Welcome page in the UI?
--ssl-required=
string
"use_system_setting"SSL required setting
Possible values: use_system_setting, always_require, never_require
--sso-strategy-id=
int64
SSO (Single Sign On) strategy ID for the user, if applicable.
--subscribe-to-newsletter
boolean
falseIs the user subscribed to the newsletter?
--require-2fa=
string
"use_system_setting"2FA required setting. use_system_setting uses the site-wide setting, including SSO exemptions. always_require and never_require override the site-wide setting when user-level overrides are allowed.
Possible values: use_system_setting, always_require, never_require
--tags=
string
Comma-separated list of Tags for this user. Tags are used for other features, such as UserLifecycleRules, which can target specific tags. Tags must only contain lowercase letters, numbers, and hyphens.
--time-zone=
string
"Eastern Time (US & Canada)"User time zone
--user-root=
string
""If filesystem layout is user_root, this path is the root path the user is fixed to for all interfaces. If the filesystem layout is site_root or partner_root, this acts as a root folder only for FTP and SFTP (SFTP applicability also requires a site-wide setting to be set). For partner_root layout, this path is relative to the Partner root folder for all callers and blank opts out of an additional protocol root. In this situation, this path is not applied to the API, Desktop, or Web interface.
--user-home=
string
""Home folder for FTP/SFTP. For users with the partner_root filesystem layout, this path is relative to the Partner root folder. In all other cases, it is an absolute path. Only applies to FTP and SFTP, and not any other interface.
--workspace-admin
boolean
falseIs the user a Workspace administrator? Applicable only to the workspace ID related to this user, if one is set.
--username=
string
Required
User's username
--workspace-id=
int64
0Workspace ID

Example Request

files-cli users create \
  --username="user"

Unlock user who has been locked out due to failed logins

Command

files-cli users unlock

Output

No output is returned.

Authorization Requirement

Requires either a Site-Wide API key or User API key or session from a User with Site Admin permissions.

Flags

FlagDescription
--id=
int64
Required
User ID.

Example Request

files-cli users unlock \
  --id=1

Resend user welcome email

Command

files-cli users resend-welcome-email

Output

No output is returned.

Authorization Requirement

Requires either a Site-Wide API key or User API key or session from a User with Site Admin permissions.

Flags

FlagDescription
--id=
int64
Required
User ID.

Example Request

files-cli users resend-welcome-email \
  --id=1

Trigger 2FA Reset process for user who has lost access to their existing 2FA methods

Command

files-cli users user-2fa-reset

Output

No output is returned.

Authorization Requirement

Requires either a Site-Wide API key or User API key or session from a User with Site Admin permissions.

The X-Files-Reauthentication header is required for all requests to this endpoint.

Flags

FlagDescription
--id=
int64
Required
User ID.

Example Request

files-cli users user-2fa-reset \
  --id=1

Update User

Command

files-cli users update

Output

Outputs a User object according to the output format.

Authorization Requirement

Not available to user API keys or sessions from users that are marked as Shared/Bot users.

The X-Files-Reauthentication header is required for any requests including the following parameters: password, change_password, email, site_admin.

Flags

FlagDescription
--id=
int64
Required
User ID.
--avatar-file=
file
An image file for your user avatar. See Attaching Files to API Requests.
--avatar-delete
boolean
If true, the avatar will be deleted.
--change-password=
string
Used for changing a password on an existing user.
--change-password-confirmation=
string
Optional, but if provided, we will ensure that it matches the value sent in change_password.
--email=
string
User's email.
--grant-permission=
string
Permission to grant on the User Root upon user creation. Can be blank or full, read, write, list, read+write, or list+write
--group-id=
int64
Group ID to associate this user with.
--group-ids=
string
A list of group ids to associate this user with. Comma delimited.
--imported-password-hash=
string
Pre-calculated hash of the user's password. If supplied, this will be used to authenticate the user on first login. Supported hash methods are MD5, SHA1, and SHA256.
--password=
string
User password.
--password-confirmation=
string
Optional, but if provided, we will ensure that it matches the value sent in password.
--announcements-read
boolean
Signifies that the user has read all the announcements in the UI.
--ai-assistant-personality-id=
int64
AI Assistant Personality ID assigned directly to this user, if any.
--allowed-ips=
string
A list of allowed IPs if applicable. Newline delimited
--attachments-permission
boolean
DEPRECATED: If true, the user can user create Bundles (aka Share Links). Use the bundle permission instead.
--authenticate-until=
string
Scheduled Date/Time at which user will be deactivated
--authentication-method=
string
How is this user authenticated?
Possible values: password, sso, none, email_signup, password_with_imported_hash, password_and_ssh_key
--billing-permission
boolean
Allow this user to perform operations on the account, payments, and invoices?
--bypass-user-lifecycle-rules
boolean
Exempt this user from user lifecycle rules?
--bypass-site-allowed-ips
boolean
Allow this user to skip site-wide IP blacklists?
--dav-permission
boolean
Can the user connect with WebDAV?
--desktop-configuration-profile-id=
int64
Desktop Configuration Profile ID assigned directly to this user, if any.
--default-workspace-id=
int64
Workspace ID the user should land in by default when more than one Workspace is available.
--disabled
boolean
Is user disabled? Disabled users cannot log in, and do not count for billing purposes. Users can be automatically disabled after an inactivity period via a Site setting or schedule to be deactivated after specific date.
--filesystem-layout=
string
File system layout
Possible values: site_root, user_root, partner_root, integration_centric, workspace_root
--ftp-permission
boolean
Can the user access with FTP/FTPS?
--header-text=
string
Text to display to the user in the header of the UI
--integration-centric-profile-id=
int64
Integration Centric Profile ID assigned directly to this user, if any.
--language=
string
Preferred language
--notification-daily-send-time=
int64
Hour of the day at which daily notifications should be sent. Can be in range 0 to 23
--name=
string
User's full name
--company=
string
User's company
--notes=
string
Any internal notes on the user
--office-integration-enabled
boolean
Enable integration with Office for the web?
--partner-admin
boolean
Is this user a Partner administrator?
--partner-id=
int64
Partner ID if this user belongs to a Partner
--password-validity-days=
int64
Number of days to allow user to use the same password
--primary-group-id=
int64
Primary group ID for Group Admin scoping
--readonly-site-admin
boolean
Is the user an allowed to view all (non-billing) site configuration for this site?
--receive-admin-alerts
boolean
Deprecated. Use notify_on_all_site_warnings and granular failure notification preferences instead.
--notify-on-all-site-warnings
boolean
Should the user receive site warnings via email?
--notify-on-all-sso-failures
boolean
Should the user receive sso/scim/ldap configuration/sync failures via email?
--notify-on-all-user-security-events
boolean
Should the user receive user security events via email?
--notify-on-all-pending-work-failures
boolean
Should the user receive pending work failures via email?
--notify-on-all-siem-http-destination-failures
boolean
Should the user receive siem failures via email?
--notify-on-all-sync-failures
boolean
Should the user receive sync failures via email?
--notify-on-all-automation-failures
boolean
Should the user receive automation failures via email?
--notify-on-all-expectation-failures
boolean
Should the user receive expectation failures and misses via email?
--require-login-by=
string
Require user to login by specified date otherwise it will be disabled.
--require-password-change
boolean
Is a password change required upon next user login?
--responsible-group-id=
int64
ID of the internal Group responsible for this Partner User, overriding the Partner default.
--responsible-user-id=
int64
ID of the internal User responsible for this Partner User, overriding the Partner default.
--restapi-permission
boolean
Can this user access the Web app, Desktop app, SDKs, or REST API? (All of these tools use the API internally, so this is one unified permission set.)
--self-managed
boolean
Does this user manage it's own credentials or is it a shared/bot user?
--sftp-permission
boolean
Can the user access with SFTP?
--site-admin
boolean
Is the user an administrator for this site?
--skip-welcome-screen
boolean
Skip Welcome page in the UI?
--ssl-required=
string
SSL required setting
Possible values: use_system_setting, always_require, never_require
--sso-strategy-id=
int64
SSO (Single Sign On) strategy ID for the user, if applicable.
--subscribe-to-newsletter
boolean
Is the user subscribed to the newsletter?
--require-2fa=
string
2FA required setting. use_system_setting uses the site-wide setting, including SSO exemptions. always_require and never_require override the site-wide setting when user-level overrides are allowed.
Possible values: use_system_setting, always_require, never_require
--tags=
string
Comma-separated list of Tags for this user. Tags are used for other features, such as UserLifecycleRules, which can target specific tags. Tags must only contain lowercase letters, numbers, and hyphens.
--time-zone=
string
User time zone
--user-root=
string
If filesystem layout is user_root, this path is the root path the user is fixed to for all interfaces. If the filesystem layout is site_root or partner_root, this acts as a root folder only for FTP and SFTP (SFTP applicability also requires a site-wide setting to be set). For partner_root layout, this path is relative to the Partner root folder for all callers and blank opts out of an additional protocol root. In this situation, this path is not applied to the API, Desktop, or Web interface.
--user-home=
string
Home folder for FTP/SFTP. For users with the partner_root filesystem layout, this path is relative to the Partner root folder. In all other cases, it is an absolute path. Only applies to FTP and SFTP, and not any other interface.
--workspace-admin
boolean
Is the user a Workspace administrator? Applicable only to the workspace ID related to this user, if one is set.
--username=
string
User's username
--workspace-id=
int64
Workspace ID
--clear-2fa
boolean
If true when changing authentication_method from password to sso, remove all two-factor methods. Ignored in all other cases.
--convert-to-partner-user
boolean
Required when assigning a Partner to an existing non-Partner user. If true, convert the user by assigning the partner_id provided.

Example Request

files-cli users update \
  --id=1

Delete User

Command

files-cli users delete

Output

No output is returned.

Authorization Requirement

Requires either a Site-Wide API key or User API key or session from a User with Site Admin permissions.

The X-Files-Reauthentication header is required for all requests to this endpoint.

Flags

FlagDescription
--id=
int64
Required
User ID.
--new-owner-id=
int64
Provide a User ID here to transfer ownership of certain resources such as Automations and Share Links (Bundles) to that new user.

Example Request

files-cli users delete \
  --id=1

The User Object

Some of the commands above return a User object. The attributes of this object are listed below.

AttributeDescription
id
int64
User ID
username
string
User's username
admin_group_ids
array(int64)
List of group IDs of which this user is an administrator
allowed_ips
string
A list of allowed IPs if applicable. Newline delimited
attachments_permission
boolean
If true, the user can user create Bundles (aka Share Links). Use the bundle permission instead.
api_keys_count
int64
Number of API keys associated with this user
authenticate_until
date-time
Scheduled Date/Time at which user will be deactivated
authentication_method
string
How is this user authenticated?
Possible values: password, sso, none, email_signup, password_with_imported_hash, password_and_ssh_key
avatar_url
string
URL holding the user's avatar
billable
boolean
Is this a billable user record?
billing_permission
boolean
Allow this user to perform operations on the account, payments, and invoices?
bypass_site_allowed_ips
boolean
Allow this user to skip site-wide IP blacklists?
bypass_user_lifecycle_rules
boolean
Exempt this user from user lifecycle rules?
created_at
date-time
When this user was created
dav_permission
boolean
Can the user connect with WebDAV?
disabled
boolean
Is user disabled? Disabled users cannot log in, and do not count for billing purposes. Users can be automatically disabled after an inactivity period via a Site setting or schedule to be deactivated after specific date.
disabled_expired_or_inactive
boolean
Computed property that returns true if user disabled or expired or inactive.
ai_assistant_personality_id
int64
AI Assistant Personality ID assigned directly to this user, if any.
desktop_configuration_profile_id
int64
Desktop Configuration Profile ID assigned directly to this user, if any.
integration_centric_profile_id
int64
Integration Centric Profile ID assigned directly to this user, if any.
email
email
User email address
filesystem_layout
string
File system layout
Possible values: site_root, user_root, partner_root, integration_centric, workspace_root
first_login_at
date-time
User's first login time
ftp_permission
boolean
Can the user access with FTP/FTPS?
group_ids
string
Comma-separated list of group IDs of which this user is a member
header_text
string
Text to display to the user in the header of the UI
language
string
Preferred language
last_login_at
date-time
User's most recent login time via any protocol
last_web_login_at
date-time
User's most recent login time via web
last_ftp_login_at
date-time
User's most recent login time via FTP
last_sftp_login_at
date-time
User's most recent login time via SFTP
last_dav_login_at
date-time
User's most recent login time via WebDAV
last_desktop_login_at
date-time
User's most recent login time via Desktop app
last_restapi_login_at
date-time
User's most recent login time via Rest API
last_api_use_at
date-time
User's most recent API use time
last_active_at
date-time
User's most recent activity time, which is the latest of most recent login, most recent API use, enablement, or creation
last_protocol_cipher
string
The most recent protocol and cipher used
lockout_expires
date-time
Time in the future that the user will no longer be locked out if applicable
name
string
User's full name
company
string
User's company
notes
string
Any internal notes on the user
notification_daily_send_time
int64
Hour of the day at which daily notifications should be sent. Can be in range 0 to 23
office_integration_enabled
boolean
Enable integration with Office for the web?
partner_admin
boolean
Is this user a Partner administrator?
partner_id
int64
Partner ID if this user belongs to a Partner
partner_name
string
Name of the Partner if this user belongs to a Partner
password_set_at
date-time
Last time the user's password was set
password_validity_days
int64
Number of days to allow user to use the same password
primary_group_id
int64
Primary group ID for Group Admin scoping
public_keys_count
int64
Number of public keys associated with this user
receive_admin_alerts
boolean
Deprecated. Use notify_on_all_site_warnings and granular failure notification preferences instead.
notify_on_all_site_warnings
boolean
Should the user receive site warnings via email?
notify_on_all_sso_failures
boolean
Should the user receive sso/scim/ldap configuration/sync failures via email?
notify_on_all_user_security_events
boolean
Should the user receive user security events via email?
notify_on_all_pending_work_failures
boolean
Should the user receive pending work failures via email?
notify_on_all_siem_http_destination_failures
boolean
Should the user receive siem failures via email?
notify_on_all_sync_failures
boolean
Should the user receive sync failures via email?
notify_on_all_automation_failures
boolean
Should the user receive automation failures via email?
notify_on_all_expectation_failures
boolean
Should the user receive expectation failures and misses via email?
require_2fa
string
2FA required setting. use_system_setting uses the site-wide setting, including SSO exemptions. always_require and never_require override the site-wide setting when user-level overrides are allowed.
Possible values: use_system_setting, always_require, never_require
require_login_by
date-time
Require user to login by specified date otherwise it will be disabled.
active_2fa
boolean
Is 2fa active for the user?
require_password_change
boolean
Is a password change required upon next user login?
password_expired
boolean
Is user's password expired?
responsible_group_id
int64
ID of the internal Group responsible for this Partner User, overriding the Partner default.
responsible_user_id
int64
ID of the internal User responsible for this Partner User, overriding the Partner default.
readonly_site_admin
boolean
Is the user an allowed to view all (non-billing) site configuration for this site?
restapi_permission
boolean
Can this user access the Web app, Desktop app, SDKs, or REST API? (All of these tools use the API internally, so this is one unified permission set.)
self_managed
boolean
Does this user manage it's own credentials or is it a shared/bot user?
sftp_permission
boolean
Can the user access with SFTP?
site_admin
boolean
Is the user an administrator for this site?
workspace_admin
boolean
Is the user a Workspace administrator? Applicable only to the workspace ID related to this user, if one is set.
site_id
int64
Site ID
workspace_id
int64
Workspace ID
default_workspace_id
int64
Workspace ID the user should land in by default when more than one Workspace is available.
skip_welcome_screen
boolean
Skip Welcome page in the UI?
ssl_required
string
SSL required setting
Possible values: use_system_setting, always_require, never_require
sso_strategy_id
int64
SSO (Single Sign On) strategy ID for the user, if applicable.
subscribe_to_newsletter
boolean
Is the user subscribed to the newsletter?
externally_managed
boolean
Is this user managed by a SsoStrategy?
tags
string
Comma-separated list of Tags for this user. Tags are used for other features, such as UserLifecycleRules, which can target specific tags. Tags must only contain lowercase letters, numbers, and hyphens.
time_zone
string
User time zone
type_of_2fa
string
Type(s) of 2FA methods in use, for programmatic use. Will be either sms, totp, webauthn, yubi, email, or multiple values sorted alphabetically and joined by an underscore. Does not specify whether user has more than one of a given method.
type_of_2fa_for_display
string
Type(s) of 2FA methods in use, formatted for displaying in the UI. Unlike type_of_2fa, this value will make clear when a user has more than 1 of the same type of method.
user_root
string
If filesystem layout is user_root, this path is the root path the user is fixed to for all interfaces. If the filesystem layout is site_root or partner_root, this acts as a root folder only for FTP and SFTP (SFTP applicability also requires a site-wide setting to be set). For partner_root layout, this path is relative to the Partner root folder for all callers and blank opts out of an additional protocol root. In this situation, this path is not applied to the API, Desktop, or Web interface.
user_home
string
Home folder for FTP/SFTP. For users with the partner_root filesystem layout, this path is relative to the Partner root folder. In all other cases, it is an absolute path. Only applies to FTP and SFTP, and not any other interface.
days_remaining_until_password_expire
int64
Number of days remaining until password expires
password_expire_at
date-time
Password expiration datetime