---
title: "Add admin"
method: POST
path: "/admins"
tags: ["admins"]
---

# Add admin

`POST /admins`

Adds a new admin. Recovery codes and TOTP configuration cannot be set using this API: each admin must use the specific APIs

## Request body

- Admin
  - `id` integer
  - `status` 0 | 1 — status: * `0` user is disabled, login is not allowed * `1` user is enabled
  - `username` string — username is unique
  - `description` string — optional description, for example the admin full name
  - `password` string, password — Admin password. For security reasons this field is omitted when you search/get admins
  - `email` string, email
  - `permissions` AdminPermissions[]
  - `filters` AdminFilters
    - `allow_list` string[] — only clients connecting from these IP/Mask are allowed. IP/Mask must be in CIDR notation as defined in RFC 4632 and RFC 4291, for example "192.0.2.0/24" or "2001:db8::/32"
    - `allow_api_key_auth` boolean — API key auth allows to impersonate this administrator with an API key
    - `require_two_factor` boolean
    - `require_password_change` boolean
    - `totp_config` AdminTOTPConfig
      - `enabled` boolean
      - `config_name` string — This name must be defined within the "totp" section of the SFTPGo configuration file. You will be unable to save a user/admin referencing a missing config_name
      - `secret` Secret — The secret is encrypted before saving, so to set a new secret you must provide a payload and set the status to "Plain". The encryption key and additional data will be generated automatically. If you set the status to "Redacted" the existing secret will be preserved
        - `status` 'Plain' | 'AES-256-GCM' | 'Secretbox' | 'GCP' | 'AWS' | 'VaultTransit' | 'AzureKeyVault' | 'Redacted' — Set to "Plain" to add or update an existing secret, set to "Redacted" to preserve the existing value
        - `payload` string
        - `key` string
        - `additional_data` string
        - `mode` integer — 1 means encrypted using a master key
    - `recovery_codes` RecoveryCode[]
      - `secret` Secret — The secret is encrypted before saving, so to set a new secret you must provide a payload and set the status to "Plain". The encryption key and additional data will be generated automatically. If you set the status to "Redacted" the existing secret will be preserved
        - `status` 'Plain' | 'AES-256-GCM' | 'Secretbox' | 'GCP' | 'AWS' | 'VaultTransit' | 'AzureKeyVault' | 'Redacted' — Set to "Plain" to add or update an existing secret, set to "Redacted" to preserve the existing value
        - `payload` string
        - `key` string
        - `additional_data` string
        - `mode` integer — 1 means encrypted using a master key
      - `used` boolean
    - `preferences` AdminPreferences
      - `hide_user_page_sections` integer — Allow to hide some sections from the user page. These are not security settings and are not enforced server side in any way. They are only intended to simplify the user page in the WebAdmin UI. 1 means hide groups section, 2 means hide filesystem section, "users_base_dir" must be set in the config file otherwise this setting is ignored, 4 means hide virtual folders section, 8 means hide profile section, 16 means hide ACLs section, 32 means hide disk and bandwidth quota limits section, 64 means hide advanced settings section. The settings can be combined
      - `default_users_expiration` integer — Defines the default expiration for newly created users as number of days. 0 means no expiration
  - `additional_info` string — Free form text field
  - `groups` AdminGroupMapping[] — Groups automatically selected for new users created by this admin. The admin will still be able to choose different groups. These settings are only used for this admin UI and they will be ignored in REST API/hooks.
    - `name` string — group name
    - `options` AdminGroupMappingOptions
      - `add_to_users_as` unknown
  - `created_at` integer — creation time as unix timestamp in milliseconds. It will be 0 for admins created before v2.2.0
  - `updated_at` integer — last update time as unix timestamp in milliseconds
  - `last_login` integer — Last user login as unix timestamp in milliseconds. It is saved at most once every 10 minutes
  - `role` string — If set the admin can only administer users with the same role. Role admins cannot have the "*" permission

## Response `201`

successful operation

- Admin
  - `id` integer
  - `status` 0 | 1 — status: * `0` user is disabled, login is not allowed * `1` user is enabled
  - `username` string — username is unique
  - `description` string — optional description, for example the admin full name
  - `password` string, password — Admin password. For security reasons this field is omitted when you search/get admins
  - `email` string, email
  - `permissions` AdminPermissions[]
  - `filters` AdminFilters
    - `allow_list` string[] — only clients connecting from these IP/Mask are allowed. IP/Mask must be in CIDR notation as defined in RFC 4632 and RFC 4291, for example "192.0.2.0/24" or "2001:db8::/32"
    - `allow_api_key_auth` boolean — API key auth allows to impersonate this administrator with an API key
    - `require_two_factor` boolean
    - `require_password_change` boolean
    - `totp_config` AdminTOTPConfig
      - `enabled` boolean
      - `config_name` string — This name must be defined within the "totp" section of the SFTPGo configuration file. You will be unable to save a user/admin referencing a missing config_name
      - `secret` Secret — The secret is encrypted before saving, so to set a new secret you must provide a payload and set the status to "Plain". The encryption key and additional data will be generated automatically. If you set the status to "Redacted" the existing secret will be preserved
        - `status` 'Plain' | 'AES-256-GCM' | 'Secretbox' | 'GCP' | 'AWS' | 'VaultTransit' | 'AzureKeyVault' | 'Redacted' — Set to "Plain" to add or update an existing secret, set to "Redacted" to preserve the existing value
        - `payload` string
        - `key` string
        - `additional_data` string
        - `mode` integer — 1 means encrypted using a master key
    - `recovery_codes` RecoveryCode[]
      - `secret` Secret — The secret is encrypted before saving, so to set a new secret you must provide a payload and set the status to "Plain". The encryption key and additional data will be generated automatically. If you set the status to "Redacted" the existing secret will be preserved
        - `status` 'Plain' | 'AES-256-GCM' | 'Secretbox' | 'GCP' | 'AWS' | 'VaultTransit' | 'AzureKeyVault' | 'Redacted' — Set to "Plain" to add or update an existing secret, set to "Redacted" to preserve the existing value
        - `payload` string
        - `key` string
        - `additional_data` string
        - `mode` integer — 1 means encrypted using a master key
      - `used` boolean
    - `preferences` AdminPreferences
      - `hide_user_page_sections` integer — Allow to hide some sections from the user page. These are not security settings and are not enforced server side in any way. They are only intended to simplify the user page in the WebAdmin UI. 1 means hide groups section, 2 means hide filesystem section, "users_base_dir" must be set in the config file otherwise this setting is ignored, 4 means hide virtual folders section, 8 means hide profile section, 16 means hide ACLs section, 32 means hide disk and bandwidth quota limits section, 64 means hide advanced settings section. The settings can be combined
      - `default_users_expiration` integer — Defines the default expiration for newly created users as number of days. 0 means no expiration
  - `additional_info` string — Free form text field
  - `groups` AdminGroupMapping[] — Groups automatically selected for new users created by this admin. The admin will still be able to choose different groups. These settings are only used for this admin UI and they will be ignored in REST API/hooks.
    - `name` string — group name
    - `options` AdminGroupMappingOptions
      - `add_to_users_as` unknown
  - `created_at` integer — creation time as unix timestamp in milliseconds. It will be 0 for admins created before v2.2.0
  - `updated_at` integer — last update time as unix timestamp in milliseconds
  - `last_login` integer — Last user login as unix timestamp in milliseconds. It is saved at most once every 10 minutes
  - `role` string — If set the admin can only administer users with the same role. Role admins cannot have the "*" permission

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Forbidden
- `500` — Internal Server Error
- `default` — Unexpected Error

---

[API](https://skmtc.net/kanton-bern/apis/sftpgo.md) · [All operations](https://skmtc.net/kanton-bern/apis/sftpgo/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/kanton-bern/sftpgo/versions/d8d616a479b0/schema)