Users

A User represents a human or system/service user with the ability to connect to Files.com via any of the available connectivity methods (unless restricted to specific protocols).

Users are associated with API Keys, SSH (SFTP) Keys, Notifications, Permissions, and Group memberships.

Authentication

The authentication_method property on a User determines exactly how that user can login and authenticate to their Files.com account. Files.com offers a variety of authentication methods to ensure flexibility, security, migration, and compliance.

These authentication methods can be configured during user creation and can be modified at any time by site administrators. The meanings of the available values are as follows:

password - Allows authentication via a password. If API Keys or SSH (SFTP) Keys are also configured, those can be used instead of the password. If Two Factor Authentication (2FA) methods are also configured, a valid 2nd factor is required in addition to the password.
email_signup - When set upon user creation, an email will be sent to the new user with a link for them to create their password. Once the user has created their password, their authentication type will change to password.
sso - Allows authentication via a linked Single Sign On provider. If API Keys or SSH (SFTP) Keys are also configured, those can be used instead of Single Sign On. If Two Factor Authentication (2FA) methods are also configured, a valid 2nd factor is required in addition to Single Sign On. When using this method, you must also provide a valid sso_strategy_id to associate the User to the appropriate SSO provider.
password_with_imported_hash - Works like the password method but allows importing a hashed password in MD5, SHA-1, or SHA-256 format. Provide the imported hash in the field imported_password_hash. Upon first use, the password will be converted to Files.com's internal storage format and the authentication type will change to password. Typically only used when migrating to Files.com from another MFT solution.
none - Does not allow authentication via username and password, but does allow authentication via API Key or SSH (SFTP) Key. Typically only used for service users.
password_and_ssh_key - Allows authentication only by providing a password and also a valid SSH (SFTP) Key in a single attempt. If API Keys are also configured, those can be used instead of the password and key combination. This method only works with (typically enterprise) SSH/SFTP clients capable of sending both authentication methods at once. Typically only used for service users.

Resource Schema

Required

Property	Description
username String	User's username

Optional

Property	Description
allowed_ips String	A list of allowed IPs if applicable. Newline delimited
attachments_permission Bool	If `true`, the user can user create Bundles (aka Share Links). Use the bundle permission instead.
authenticate_until String	Scheduled Date/Time at which user will be deactivated
authentication_method String	How is this user authenticated? Possible values: `password`, `sso`, `none`, `email_signup`, `password_with_imported_hash`, `password_and_ssh_key`
billing_permission Bool	Allow this user to perform operations on the account, payments, and invoices?
bypass_site_allowed_ips Bool	Allow this user to skip site-wide IP blacklists?
bypass_user_lifecycle_rules Bool	Exempt this user from user lifecycle rules?
dav_permission Bool	Can the user connect with WebDAV?
disabled Bool	Is user disabled? Disabled users cannot log in, and do not count for billing purposes. Users can be automatically disabled after an inactivity period via a Site setting or schedule to be deactivated after specific date.
ai_assistant_personality_id Int64	AI Assistant Personality ID assigned directly to this user, if any.
desktop_configuration_profile_id Int64	Desktop Configuration Profile ID assigned directly to this user, if any.
integration_centric_profile_id Int64	Integration Centric Profile ID assigned directly to this user, if any.
email String	User email address
filesystem_layout String	File system layout Possible values: `site_root`, `user_root`, `partner_root`, `integration_centric`, `workspace_root`
ftp_permission Bool	Can the user access with FTP/FTPS?
group_ids String	Comma-separated list of group IDs of which this user is a member
header_text String	Text to display to the user in the header of the UI
language String	Preferred language
name String	User's full name
company String	User's company
notes String	Any internal notes on the user
notification_daily_send_time Int64	Hour of the day at which daily notifications should be sent. Can be in range 0 to 23
office_integration_enabled Bool	Enable integration with Office for the web?
partner_admin Bool	Is this user a Partner administrator?
partner_id Int64	Partner ID if this user belongs to a Partner
password_validity_days Int64	Number of days to allow user to use the same password
primary_group_id Int64	Primary group ID for Group Admin scoping
receive_admin_alerts Bool	Deprecated. Use notify_on_all_site_warnings and granular failure notification preferences instead.
notify_on_all_site_warnings Bool	Should the user receive site warnings via email?
notify_on_all_sso_failures Bool	Should the user receive sso/scim/ldap configuration/sync failures via email?
notify_on_all_user_security_events Bool	Should the user receive user security events via email?
notify_on_all_pending_work_failures Bool	Should the user receive pending work failures via email?
notify_on_all_siem_http_destination_failures Bool	Should the user receive siem failures via email?
notify_on_all_sync_failures Bool	Should the user receive sync failures via email?
notify_on_all_automation_failures Bool	Should the user receive automation failures via email?
notify_on_all_expectation_failures Bool	Should the user receive expectation failures and misses via email?
require_2fa String	2FA required setting. `use_system_setting` uses the site-wide setting, including SSO exemptions. `always_require` and `never_require` override the site-wide setting when user-level overrides are allowed. Possible values: `use_system_setting`, `always_require`, `never_require`
require_login_by String	Require user to login by specified date otherwise it will be disabled.
require_password_change Bool	Is a password change required upon next user login?
responsible_group_id Int64	ID of the internal Group responsible for this Partner User, overriding the Partner default.
responsible_user_id Int64	ID of the internal User responsible for this Partner User, overriding the Partner default.
readonly_site_admin Bool	Is the user an allowed to view all (non-billing) site configuration for this site?
restapi_permission Bool	Can this user access the Web app, Desktop app, SDKs, or REST API? (All of these tools use the API internally, so this is one unified permission set.)
self_managed Bool	Does this user manage it's own credentials or is it a shared/bot user?
sftp_permission Bool	Can the user access with SFTP?
site_admin Bool	Is the user an administrator for this site?
workspace_admin Bool	Is the user a Workspace administrator? Applicable only to the workspace ID related to this user, if one is set.
workspace_id Int64	Workspace ID
default_workspace_id Int64	Workspace ID the user should land in by default when more than one Workspace is available.
skip_welcome_screen Bool	Skip Welcome page in the UI?
ssl_required String	SSL required setting Possible values: `use_system_setting`, `always_require`, `never_require`
sso_strategy_id Int64	SSO (Single Sign On) strategy ID for the user, if applicable.
subscribe_to_newsletter Bool	Is the user subscribed to the newsletter?
tags String	Comma-separated list of Tags for this user. Tags are used for other features, such as UserLifecycleRules, which can target specific tags. Tags must only contain lowercase letters, numbers, and hyphens.
time_zone String	User time zone
user_root String	If filesystem layout is user_root, this path is the root path the user is fixed to for all interfaces. If the filesystem layout is site_root or partner_root, this acts as a root folder only for FTP and SFTP (SFTP applicability also requires a site-wide setting to be set). For partner_root layout, this path is relative to the Partner root folder for all callers and blank opts out of an additional protocol root. In this situation, this path is not applied to the API, Desktop, or Web interface.
user_home String	Home folder for FTP/SFTP. For users with the partner_root filesystem layout, this path is relative to the Partner root folder. In all other cases, it is an absolute path. Only applies to FTP and SFTP, and not any other interface.
avatar_delete Bool	If true, the avatar will be deleted.
change_password String	Used for changing a password on an existing user.
change_password_confirmation String	Optional, but if provided, we will ensure that it matches the value sent in `change_password`.
grant_permission String	Permission to grant on the User Root upon user creation. Can be blank or `full`, `read`, `write`, `list`, `read+write`, or `list+write`
group_id Int64	Group ID to associate this user with.
imported_password_hash String	Pre-calculated hash of the user's password. If supplied, this will be used to authenticate the user on first login. Supported hash methods are MD5, SHA1, and SHA256.
password String	User password.
password_confirmation String	Optional, but if provided, we will ensure that it matches the value sent in `password`.
announcements_read Bool	Signifies that the user has read all the announcements in the UI.

Read Only

Property	Description
id Int64	User ID
admin_group_ids List	List of group IDs of which this user is an administrator
api_keys_count Int64	Number of API keys associated with this user
avatar_url String	URL holding the user's avatar
billable Bool	Is this a billable user record?
created_at String	When this user was created
disabled_expired_or_inactive Bool	Computed property that returns true if user disabled or expired or inactive.
first_login_at String	User's first login time
last_login_at String	User's most recent login time via any protocol
last_web_login_at String	User's most recent login time via web
last_ftp_login_at String	User's most recent login time via FTP
last_sftp_login_at String	User's most recent login time via SFTP
last_dav_login_at String	User's most recent login time via WebDAV
last_desktop_login_at String	User's most recent login time via Desktop app
last_restapi_login_at String	User's most recent login time via Rest API
last_api_use_at String	User's most recent API use time
last_active_at String	User's most recent activity time, which is the latest of most recent login, most recent API use, enablement, or creation
last_protocol_cipher String	The most recent protocol and cipher used
lockout_expires String	Time in the future that the user will no longer be locked out if applicable
partner_name String	Name of the Partner if this user belongs to a Partner
password_set_at String	Last time the user's password was set
public_keys_count Int64	Number of public keys associated with this user
active_2fa Bool	Is 2fa active for the user?
password_expired Bool	Is user's password expired?
site_id Int64	Site ID
externally_managed Bool	Is this user managed by a SsoStrategy?
type_of_2fa String	Type(s) of 2FA methods in use, for programmatic use. Will be either `sms`, `totp`, `webauthn`, `yubi`, `email`, or multiple values sorted alphabetically and joined by an underscore. Does not specify whether user has more than one of a given method.
type_of_2fa_for_display String	Type(s) of 2FA methods in use, formatted for displaying in the UI. Unlike `type_of_2fa`, this value will make clear when a user has more than 1 of the same type of method.
days_remaining_until_password_expire Int64	Number of days remaining until password expires
password_expire_at String	Password expiration datetime

Example Resource

resource "files_user" "example_user" {
  avatar_delete                                = false
  email                                        = "john.doe@files.com"
  group_id                                     = 1
  group_ids                                    = "example"
  announcements_read                           = false
  ai_assistant_personality_id                  = 1
  allowed_ips                                  = "10.0.0.0/8\n127.0.0.1"
  attachments_permission                       = true
  authenticate_until                           = "2000-01-01T01:00:00Z"
  authentication_method                        = "password"
  billing_permission                           = false
  bypass_user_lifecycle_rules                  = false
  bypass_site_allowed_ips                      = false
  dav_permission                               = true
  desktop_configuration_profile_id             = 1
  default_workspace_id                         = 1
  disabled                                     = true
  filesystem_layout                            = "site_root"
  ftp_permission                               = true
  header_text                                  = "User-specific message."
  integration_centric_profile_id               = 1
  language                                     = "en"
  notification_daily_send_time                 = 18
  name                                         = "John Doe"
  company                                      = "ACME Corp."
  notes                                        = "Internal notes on this user."
  office_integration_enabled                   = true
  partner_admin                                = true
  partner_id                                   = 1
  password_validity_days                       = 1
  primary_group_id                             = 1
  readonly_site_admin                          = true
  receive_admin_alerts                         = true
  notify_on_all_site_warnings                  = true
  notify_on_all_sso_failures                   = true
  notify_on_all_user_security_events           = true
  notify_on_all_pending_work_failures          = true
  notify_on_all_siem_http_destination_failures = true
  notify_on_all_sync_failures                  = true
  notify_on_all_automation_failures            = true
  notify_on_all_expectation_failures           = true
  require_login_by                             = "2000-01-01T01:00:00Z"
  require_password_change                      = true
  responsible_group_id                         = 1
  responsible_user_id                          = 1
  restapi_permission                           = true
  self_managed                                 = true
  sftp_permission                              = true
  site_admin                                   = true
  skip_welcome_screen                          = true
  ssl_required                                 = "always_require"
  sso_strategy_id                              = 1
  subscribe_to_newsletter                      = true
  require_2fa                                  = "always_require"
  tags                                         = "example"
  time_zone                                    = "Pacific Time (US & Canada)"
  user_root                                    = "example"
  user_home                                    = "example"
  workspace_admin                              = true
  username                                     = "user"
  workspace_id                                 = 1
}

Resource Import

This Resource supports importing using the following syntax:

Example Import Command

# Users can be imported by specifying the id.
terraform import files_user.example_user 1

Data Source Schema

Required

Property	Description
id Int64	User ID

Read Only

Property	Description
username String	User's username
admin_group_ids List	List of group IDs of which this user is an administrator
allowed_ips String	A list of allowed IPs if applicable. Newline delimited
attachments_permission Bool	If `true`, the user can user create Bundles (aka Share Links). Use the bundle permission instead.
api_keys_count Int64	Number of API keys associated with this user
authenticate_until String	Scheduled Date/Time at which user will be deactivated
authentication_method String	How is this user authenticated? Possible values: `password`, `sso`, `none`, `email_signup`, `password_with_imported_hash`, `password_and_ssh_key`
avatar_url String	URL holding the user's avatar
billable Bool	Is this a billable user record?
billing_permission Bool	Allow this user to perform operations on the account, payments, and invoices?
bypass_site_allowed_ips Bool	Allow this user to skip site-wide IP blacklists?
bypass_user_lifecycle_rules Bool	Exempt this user from user lifecycle rules?
created_at String	When this user was created
dav_permission Bool	Can the user connect with WebDAV?
disabled Bool	Is user disabled? Disabled users cannot log in, and do not count for billing purposes. Users can be automatically disabled after an inactivity period via a Site setting or schedule to be deactivated after specific date.
disabled_expired_or_inactive Bool	Computed property that returns true if user disabled or expired or inactive.
ai_assistant_personality_id Int64	AI Assistant Personality ID assigned directly to this user, if any.
desktop_configuration_profile_id Int64	Desktop Configuration Profile ID assigned directly to this user, if any.
integration_centric_profile_id Int64	Integration Centric Profile ID assigned directly to this user, if any.
email String	User email address
filesystem_layout String	File system layout Possible values: `site_root`, `user_root`, `partner_root`, `integration_centric`, `workspace_root`
first_login_at String	User's first login time
ftp_permission Bool	Can the user access with FTP/FTPS?
group_ids String	Comma-separated list of group IDs of which this user is a member
header_text String	Text to display to the user in the header of the UI
language String	Preferred language
last_login_at String	User's most recent login time via any protocol
last_web_login_at String	User's most recent login time via web
last_ftp_login_at String	User's most recent login time via FTP
last_sftp_login_at String	User's most recent login time via SFTP
last_dav_login_at String	User's most recent login time via WebDAV
last_desktop_login_at String	User's most recent login time via Desktop app
last_restapi_login_at String	User's most recent login time via Rest API
last_api_use_at String	User's most recent API use time
last_active_at String	User's most recent activity time, which is the latest of most recent login, most recent API use, enablement, or creation
last_protocol_cipher String	The most recent protocol and cipher used
lockout_expires String	Time in the future that the user will no longer be locked out if applicable
name String	User's full name
company String	User's company
notes String	Any internal notes on the user
notification_daily_send_time Int64	Hour of the day at which daily notifications should be sent. Can be in range 0 to 23
office_integration_enabled Bool	Enable integration with Office for the web?
partner_admin Bool	Is this user a Partner administrator?
partner_id Int64	Partner ID if this user belongs to a Partner
partner_name String	Name of the Partner if this user belongs to a Partner
password_set_at String	Last time the user's password was set
password_validity_days Int64	Number of days to allow user to use the same password
primary_group_id Int64	Primary group ID for Group Admin scoping
public_keys_count Int64	Number of public keys associated with this user
receive_admin_alerts Bool	Deprecated. Use notify_on_all_site_warnings and granular failure notification preferences instead.
notify_on_all_site_warnings Bool	Should the user receive site warnings via email?
notify_on_all_sso_failures Bool	Should the user receive sso/scim/ldap configuration/sync failures via email?
notify_on_all_user_security_events Bool	Should the user receive user security events via email?
notify_on_all_pending_work_failures Bool	Should the user receive pending work failures via email?
notify_on_all_siem_http_destination_failures Bool	Should the user receive siem failures via email?
notify_on_all_sync_failures Bool	Should the user receive sync failures via email?
notify_on_all_automation_failures Bool	Should the user receive automation failures via email?
notify_on_all_expectation_failures Bool	Should the user receive expectation failures and misses via email?
require_2fa String	2FA required setting. `use_system_setting` uses the site-wide setting, including SSO exemptions. `always_require` and `never_require` override the site-wide setting when user-level overrides are allowed. Possible values: `use_system_setting`, `always_require`, `never_require`
require_login_by String	Require user to login by specified date otherwise it will be disabled.
active_2fa Bool	Is 2fa active for the user?
require_password_change Bool	Is a password change required upon next user login?
password_expired Bool	Is user's password expired?
responsible_group_id Int64	ID of the internal Group responsible for this Partner User, overriding the Partner default.
responsible_user_id Int64	ID of the internal User responsible for this Partner User, overriding the Partner default.
readonly_site_admin Bool	Is the user an allowed to view all (non-billing) site configuration for this site?
restapi_permission Bool	Can this user access the Web app, Desktop app, SDKs, or REST API? (All of these tools use the API internally, so this is one unified permission set.)
self_managed Bool	Does this user manage it's own credentials or is it a shared/bot user?
sftp_permission Bool	Can the user access with SFTP?
site_admin Bool	Is the user an administrator for this site?
workspace_admin Bool	Is the user a Workspace administrator? Applicable only to the workspace ID related to this user, if one is set.
site_id Int64	Site ID
workspace_id Int64	Workspace ID
default_workspace_id Int64	Workspace ID the user should land in by default when more than one Workspace is available.
skip_welcome_screen Bool	Skip Welcome page in the UI?
ssl_required String	SSL required setting Possible values: `use_system_setting`, `always_require`, `never_require`
sso_strategy_id Int64	SSO (Single Sign On) strategy ID for the user, if applicable.
subscribe_to_newsletter Bool	Is the user subscribed to the newsletter?
externally_managed Bool	Is this user managed by a SsoStrategy?
tags String	Comma-separated list of Tags for this user. Tags are used for other features, such as UserLifecycleRules, which can target specific tags. Tags must only contain lowercase letters, numbers, and hyphens.
time_zone String	User time zone
type_of_2fa String	Type(s) of 2FA methods in use, for programmatic use. Will be either `sms`, `totp`, `webauthn`, `yubi`, `email`, or multiple values sorted alphabetically and joined by an underscore. Does not specify whether user has more than one of a given method.
type_of_2fa_for_display String	Type(s) of 2FA methods in use, formatted for displaying in the UI. Unlike `type_of_2fa`, this value will make clear when a user has more than 1 of the same type of method.
user_root String	If filesystem layout is user_root, this path is the root path the user is fixed to for all interfaces. If the filesystem layout is site_root or partner_root, this acts as a root folder only for FTP and SFTP (SFTP applicability also requires a site-wide setting to be set). For partner_root layout, this path is relative to the Partner root folder for all callers and blank opts out of an additional protocol root. In this situation, this path is not applied to the API, Desktop, or Web interface.
user_home String	Home folder for FTP/SFTP. For users with the partner_root filesystem layout, this path is relative to the Partner root folder. In all other cases, it is an absolute path. Only applies to FTP and SFTP, and not any other interface.
days_remaining_until_password_expire Int64	Number of days remaining until password expires
password_expire_at String	Password expiration datetime

Example Data Source

data "files_user" "example_user" {
  id = 1
}