---
title: "Find groups by name"
method: GET
path: "/groups/{name}"
tags: ["groups"]
---

# Find groups by name

`GET /groups/{name}`

Returns the group with the given name if it exists.

## Query parameters

- `confidential_data` integer

## Response `200`

successful operation

- Group
  - `id` integer
  - `name` string — name is unique
  - `description` string — optional description
  - `created_at` integer — creation time as unix timestamp in milliseconds
  - `updated_at` integer — last update time as unix timestamp in milliseconds
  - `user_settings` GroupUserSettings
    - `home_dir` string
    - `max_sessions` integer
    - `quota_size` integer
    - `quota_files` integer
    - `permissions` object — hash map with directory as key and an array of permissions as value. Directories must be absolute paths, permissions for root directory ("/") are required
    - `upload_bandwidth` integer — Maximum upload bandwidth as KB/s
    - `download_bandwidth` integer — Maximum download bandwidth as KB/s
    - `upload_data_transfer` integer — Maximum data transfer allowed for uploads as MB
    - `download_data_transfer` integer — Maximum data transfer allowed for downloads as MB
    - `total_data_transfer` integer — Maximum total data transfer as MB
    - `expires_in` integer — Account expiration in number of days from creation. 0 means no expiration
    - `filters` BaseUserFilters — Additional user options
      - `allowed_ip` string[] — only clients connecting from these IP/Mask are allowed. IP/Mask must be in CIDR notation as defined in RFC 4632 and RFC 4291, for example "192.0.2.0/24" or "2001:db8::/32"
      - `denied_ip` string[] — clients connecting from these IP/Mask are not allowed. Denied rules are evaluated before allowed ones
      - `denied_login_methods` LoginMethods[] — if null or empty any available login method is allowed
      - `denied_protocols` SupportedProtocols[] — if null or empty any available protocol is allowed
      - `file_patterns` PatternsFilter[] — filters based on shell like file patterns. These restrictions do not apply to files listing for performance reasons, so a denied file cannot be downloaded/overwritten/renamed but it will still be in the list of files. Please note that these restrictions can be easily bypassed
        - `path` string — virtual path as seen by users, if no other specific filter is defined, the filter applies for sub directories too. For example if filters are defined for the paths "/" and "/sub" then the filters for "/" are applied for any file outside the "/sub" directory
        - `allowed_patterns` string[] — list of, case insensitive, allowed shell like patterns. Allowed patterns are evaluated before the denied ones
        - `denied_patterns` string[] — list of, case insensitive, denied shell like patterns
        - `deny_policy` 0 | 1 — Policies for denied patterns * `0` - default policy. Denied files/directories matching the filters are visible in directory listing but cannot be uploaded/downloaded/overwritten/renamed * `1` - deny policy hide. This policy applies the same restrictions as the default one and denied files/directories matching the filters will also be hidden in directory listing. This mode may cause performance issues for large directories
      - `max_upload_file_size` integer — maximum allowed size, as bytes, for a single file upload. The upload will be aborted if/when the size of the file being sent exceeds this limit. 0 means unlimited. This restriction does not apply for SSH system commands such as `git` and `rsync`
      - `tls_username` string — defines the TLS certificate field to use as username. For FTP clients it must match the name provided using the "USER" command. For WebDAV, if no username is provided, the CN will be used as username. For WebDAV clients it must match the implicit or provided username. Ignored if mutual TLS is disabled. Currently the only supported value is `CommonName`
      - `tls_certs` string[]
      - `hooks` HooksFilter — User specific hook overrides
        - `external_auth_disabled` boolean — If true, the external auth hook, if defined, will not be executed
        - `pre_login_disabled` boolean — If true, the pre-login hook, if defined, will not be executed
        - `check_password_disabled` boolean — If true, the check password hook, if defined, will not be executed
      - `disable_fs_checks` boolean — Disable checks for existence and automatic creation of home directory and virtual folders. SFTPGo requires that the user's home directory, virtual folder root, and intermediate paths to virtual folders exist to work properly. If you already know that the required directories exist, disabling these checks will speed up login. You could, for example, disable these checks after the first login
      - `web_client` WebClientOptions[] — WebClient/user REST API related configuration options
      - `allow_api_key_auth` boolean — API key authentication allows to impersonate this user with an API key
      - `user_type` '' | 'LDAPUser' | 'OSUser' — This is an hint for authentication plugins. It is ignored when using SFTPGo internal authentication
      - `bandwidth_limits` BandwidthLimit[]
        - `sources` string[] — Source networks in CIDR notation as defined in RFC 4632 and RFC 4291 for example `192.0.2.0/24` or `2001:db8::/32`. The limit applies if the defined networks contain the client IP
        - `upload_bandwidth` integer — Maximum upload bandwidth as KB/s, 0 means unlimited
        - `download_bandwidth` integer — Maximum download bandwidth as KB/s, 0 means unlimited
      - `external_auth_cache_time` integer — Defines the cache time, in seconds, for users authenticated using an external auth hook. 0 means no cache
      - `start_directory` string — Specifies an alternate starting directory. If not set, the default is "/". This option is supported for SFTP/SCP, FTP and HTTP (WebClient/REST API) protocols. Relative paths will use this directory as base.
      - `two_factor_protocols` MFAProtocols[] — Defines protocols that require two factor authentication
      - `ftp_security` 0 | 1 — Set to `1` to require TLS for both data and control connection. his setting is useful if you want to allow both encrypted and plain text FTP sessions globally and then you want to require encrypted sessions on a per-user basis. It has no effect if TLS is already required for all users in the configuration file.
      - `is_anonymous` boolean — If enabled the user can login with any password or no password at all. Anonymous users are supported for FTP and WebDAV protocols and permissions will be automatically set to "list" and "download" (read only)
      - `default_shares_expiration` integer — Defines the default expiration for newly created shares as number of days. 0 means no expiration
      - `max_shares_expiration` integer — Defines the maximum allowed expiration, as a number of days, when a user creates or updates a share. 0 means no expiration
      - `password_expiration` integer — The password expires after the defined number of days. 0 means no expiration
      - `password_strength` integer — Defines the minimum password strength. 0 means disabled, any password will be accepted. Values in the 50-70 range are suggested for common use cases
      - `access_time` TimePeriod[]
        - `day_of_week` 0 | 1 | 2 | 3 | 4 | 5 | 6 — Day of week, 0 Sunday, 6 Saturday
        - `from` string — Start time in HH:MM format
        - `to` string — End time in HH:MM format
    - `filesystem` FilesystemConfig — Storage filesystem details
      - `provider` 0 | 1 | 2 | 3 | 4 | 5 | 6 — Filesystem providers: * `0` - Local filesystem * `1` - S3 Compatible Object Storage * `2` - Google Cloud Storage * `3` - Azure Blob Storage * `4` - Local filesystem encrypted * `5` - SFTP * `6` - HTTP filesystem
      - `osconfig` OSFsConfig
        - `read_buffer_size` integer — The read buffer size, as MB, to use for downloads. 0 means no buffering, that's fine in most use cases.
        - `write_buffer_size` integer — The write buffer size, as MB, to use for uploads. 0 means no buffering, that's fine in most use cases.
      - `s3config` S3Config — S3 Compatible Object Storage configuration details
        - `bucket` string
        - `region` string
        - `access_key` string
        - `access_secret` Secret — The secret is encrypted before saving, so to set a new secret you must provide a payload and set the status to "Plain". The encryption key and additional data will be generated automatically. If you set the status to "Redacted" the existing secret will be preserved
          - `status` 'Plain' | 'AES-256-GCM' | 'Secretbox' | 'GCP' | 'AWS' | 'VaultTransit' | 'AzureKeyVault' | 'Redacted' — Set to "Plain" to add or update an existing secret, set to "Redacted" to preserve the existing value
          - `payload` string
          - `key` string
          - `additional_data` string
          - `mode` integer — 1 means encrypted using a master key
        - `role_arn` string — Optional IAM Role ARN to assume
        - `session_token` string — Optional Session token that is a part of temporary security credentials provisioned by AWS STS
        - `endpoint` string — optional endpoint
        - `storage_class` string
        - `acl` string — The canned ACL to apply to uploaded objects. Leave empty to use the default ACL. For more information and available ACLs, see here: https://docs.aws.amazon.com/AmazonS3/latest/userguide/acl-overview.html#canned-acl
        - `upload_part_size` integer — the buffer size (in MB) to use for multipart uploads. The minimum allowed part size is 5MB, and if this value is set to zero, the default value (5MB) for the AWS SDK will be used. The minimum allowed value is 5.
        - `upload_concurrency` integer — the number of parts to upload in parallel. If this value is set to zero, the default value (5) will be used
        - `upload_part_max_time` integer — the maximum time allowed, in seconds, to upload a single chunk (the chunk size is defined via "upload_part_size"). 0 means no timeout
        - `download_part_size` integer — the buffer size (in MB) to use for multipart downloads. The minimum allowed part size is 5MB, and if this value is set to zero, the default value (5MB) for the AWS SDK will be used. The minimum allowed value is 5. Ignored for partial downloads
        - `download_concurrency` integer — the number of parts to download in parallel. If this value is set to zero, the default value (5) will be used. Ignored for partial downloads
        - `download_part_max_time` integer — the maximum time allowed, in seconds, to download a single chunk (the chunk size is defined via "download_part_size"). 0 means no timeout. Ignored for partial downloads.
        - `force_path_style` boolean — Set this to "true" to force the request to use path-style addressing, i.e., "http://s3.amazonaws.com/BUCKET/KEY". By default, the S3 client will use virtual hosted bucket addressing when possible ("http://BUCKET.s3.amazonaws.com/KEY")
        - `key_prefix` string — key_prefix is similar to a chroot directory for a local filesystem. If specified the user will only see contents that starts with this prefix and so you can restrict access to a specific virtual folder. The prefix, if not empty, must not start with "/" and must end with "/". If empty the whole bucket contents will be available
      - `gcsconfig` GCSConfig — Google Cloud Storage configuration details. The "credentials" field must be populated only when adding/updating a user. It will be always omitted, since there are sensitive data, when you search/get users
        - `bucket` string
        - `credentials` Secret — The secret is encrypted before saving, so to set a new secret you must provide a payload and set the status to "Plain". The encryption key and additional data will be generated automatically. If you set the status to "Redacted" the existing secret will be preserved
          - `status` 'Plain' | 'AES-256-GCM' | 'Secretbox' | 'GCP' | 'AWS' | 'VaultTransit' | 'AzureKeyVault' | 'Redacted' — Set to "Plain" to add or update an existing secret, set to "Redacted" to preserve the existing value
          - `payload` string
          - `key` string
          - `additional_data` string
          - `mode` integer — 1 means encrypted using a master key
        - `automatic_credentials` 0 | 1 — Automatic credentials: * `0` - disabled, explicit credentials, using a JSON credentials file, must be provided. This is the default value if the field is null * `1` - enabled, we try to use the Application Default Credentials (ADC) strategy to find your application's credentials
        - `storage_class` string
        - `acl` string — The ACL to apply to uploaded objects. Leave empty to use the default ACL. For more information and available ACLs, refer to the JSON API here: https://cloud.google.com/storage/docs/access-control/lists#predefined-acl
        - `key_prefix` string — key_prefix is similar to a chroot directory for a local filesystem. If specified the user will only see contents that starts with this prefix and so you can restrict access to a specific virtual folder. The prefix, if not empty, must not start with "/" and must end with "/". If empty the whole bucket contents will be available
        - `upload_part_size` integer — The buffer size (in MB) to use for multipart uploads. The default value is 16MB. 0 means use the default
        - `upload_part_max_time` integer — The maximum time allowed, in seconds, to upload a single chunk. The default value is 32. 0 means use the default
      - `azblobconfig` AzureBlobFsConfig — Azure Blob Storage configuration details
        - `container` string
        - `account_name` string — Storage Account Name, leave blank to use SAS URL
        - `account_key` Secret — The secret is encrypted before saving, so to set a new secret you must provide a payload and set the status to "Plain". The encryption key and additional data will be generated automatically. If you set the status to "Redacted" the existing secret will be preserved
          - `status` 'Plain' | 'AES-256-GCM' | 'Secretbox' | 'GCP' | 'AWS' | 'VaultTransit' | 'AzureKeyVault' | 'Redacted' — Set to "Plain" to add or update an existing secret, set to "Redacted" to preserve the existing value
          - `payload` string
          - `key` string
          - `additional_data` string
          - `mode` integer — 1 means encrypted using a master key
        - `sas_url` Secret — The secret is encrypted before saving, so to set a new secret you must provide a payload and set the status to "Plain". The encryption key and additional data will be generated automatically. If you set the status to "Redacted" the existing secret will be preserved
          - `status` 'Plain' | 'AES-256-GCM' | 'Secretbox' | 'GCP' | 'AWS' | 'VaultTransit' | 'AzureKeyVault' | 'Redacted' — Set to "Plain" to add or update an existing secret, set to "Redacted" to preserve the existing value
          - `payload` string
          - `key` string
          - `additional_data` string
          - `mode` integer — 1 means encrypted using a master key
        - `endpoint` string — optional endpoint. Default is "blob.core.windows.net". If you use the emulator the endpoint must include the protocol, for example "http://127.0.0.1:10000"
        - `upload_part_size` integer — the buffer size (in MB) to use for multipart uploads. If this value is set to zero, the default value (5MB) will be used.
        - `upload_concurrency` integer — the number of parts to upload in parallel. If this value is set to zero, the default value (5) will be used
        - `download_part_size` integer — the buffer size (in MB) to use for multipart downloads. If this value is set to zero, the default value (5MB) will be used.
        - `download_concurrency` integer — the number of parts to download in parallel. If this value is set to zero, the default value (5) will be used
        - `access_tier` '' | 'Archive' | 'Hot' | 'Cool'
        - `key_prefix` string — key_prefix is similar to a chroot directory for a local filesystem. If specified the user will only see contents that starts with this prefix and so you can restrict access to a specific virtual folder. The prefix, if not empty, must not start with "/" and must end with "/". If empty the whole container contents will be available
        - `use_emulator` boolean
      - `cryptconfig` CryptFsConfig — Crypt filesystem configuration details
        - `passphrase` Secret — The secret is encrypted before saving, so to set a new secret you must provide a payload and set the status to "Plain". The encryption key and additional data will be generated automatically. If you set the status to "Redacted" the existing secret will be preserved
          - `status` 'Plain' | 'AES-256-GCM' | 'Secretbox' | 'GCP' | 'AWS' | 'VaultTransit' | 'AzureKeyVault' | 'Redacted' — Set to "Plain" to add or update an existing secret, set to "Redacted" to preserve the existing value
          - `payload` string
          - `key` string
          - `additional_data` string
          - `mode` integer — 1 means encrypted using a master key
        - `read_buffer_size` integer — The read buffer size, as MB, to use for downloads. 0 means no buffering, that's fine in most use cases.
        - `write_buffer_size` integer — The write buffer size, as MB, to use for uploads. 0 means no buffering, that's fine in most use cases.
      - `sftpconfig` SFTPFsConfig
        - `endpoint` string — remote SFTP endpoint as host:port
        - `username` string — you can specify a password or private key or both. In the latter case the private key will be tried first.
        - `password` Secret — The secret is encrypted before saving, so to set a new secret you must provide a payload and set the status to "Plain". The encryption key and additional data will be generated automatically. If you set the status to "Redacted" the existing secret will be preserved
          - `status` 'Plain' | 'AES-256-GCM' | 'Secretbox' | 'GCP' | 'AWS' | 'VaultTransit' | 'AzureKeyVault' | 'Redacted' — Set to "Plain" to add or update an existing secret, set to "Redacted" to preserve the existing value
          - `payload` string
          - `key` string
          - `additional_data` string
          - `mode` integer — 1 means encrypted using a master key
        - `private_key` Secret — The secret is encrypted before saving, so to set a new secret you must provide a payload and set the status to "Plain". The encryption key and additional data will be generated automatically. If you set the status to "Redacted" the existing secret will be preserved
          - `status` 'Plain' | 'AES-256-GCM' | 'Secretbox' | 'GCP' | 'AWS' | 'VaultTransit' | 'AzureKeyVault' | 'Redacted' — Set to "Plain" to add or update an existing secret, set to "Redacted" to preserve the existing value
          - `payload` string
          - `key` string
          - `additional_data` string
          - `mode` integer — 1 means encrypted using a master key
        - `key_passphrase` Secret — The secret is encrypted before saving, so to set a new secret you must provide a payload and set the status to "Plain". The encryption key and additional data will be generated automatically. If you set the status to "Redacted" the existing secret will be preserved
          - `status` 'Plain' | 'AES-256-GCM' | 'Secretbox' | 'GCP' | 'AWS' | 'VaultTransit' | 'AzureKeyVault' | 'Redacted' — Set to "Plain" to add or update an existing secret, set to "Redacted" to preserve the existing value
          - `payload` string
          - `key` string
          - `additional_data` string
          - `mode` integer — 1 means encrypted using a master key
        - `fingerprints` string[] — SHA256 fingerprints to use for host key verification. If you don't provide any fingerprint the remote host key will not be verified, this is a security risk
        - `prefix` string — Specifying a prefix you can restrict all operations to a given path within the remote SFTP server.
        - `disable_concurrent_reads` boolean — Concurrent reads are safe to use and disabling them will degrade performance. Some servers automatically delete files once they are downloaded. Using concurrent reads is problematic with such servers.
        - `buffer_size` integer — The size of the buffer (in MB) to use for transfers. By enabling buffering, the reads and writes, from/to the remote SFTP server, are split in multiple concurrent requests and this allows data to be transferred at a faster rate, over high latency networks, by overlapping round-trip times. With buffering enabled, resuming uploads is not supported and a file cannot be opened for both reading and writing at the same time. 0 means disabled.
        - `equality_check_mode` 0 | 1 — Defines how to check if this config points to the same server as another config. If different configs point to the same server the renaming between the fs configs is allowed: * `0` username and endpoint must match. This is the default * `1` only the endpoint must match
      - `httpconfig` HTTPFsConfig
        - `endpoint` string — HTTP/S endpoint URL. SFTPGo will use this URL as base, for example for the `stat` API, SFTPGo will add `/stat/{name}`
        - `username` string
        - `password` Secret — The secret is encrypted before saving, so to set a new secret you must provide a payload and set the status to "Plain". The encryption key and additional data will be generated automatically. If you set the status to "Redacted" the existing secret will be preserved
          - `status` 'Plain' | 'AES-256-GCM' | 'Secretbox' | 'GCP' | 'AWS' | 'VaultTransit' | 'AzureKeyVault' | 'Redacted' — Set to "Plain" to add or update an existing secret, set to "Redacted" to preserve the existing value
          - `payload` string
          - `key` string
          - `additional_data` string
          - `mode` integer — 1 means encrypted using a master key
        - `api_key` Secret — The secret is encrypted before saving, so to set a new secret you must provide a payload and set the status to "Plain". The encryption key and additional data will be generated automatically. If you set the status to "Redacted" the existing secret will be preserved
          - `status` 'Plain' | 'AES-256-GCM' | 'Secretbox' | 'GCP' | 'AWS' | 'VaultTransit' | 'AzureKeyVault' | 'Redacted' — Set to "Plain" to add or update an existing secret, set to "Redacted" to preserve the existing value
          - `payload` string
          - `key` string
          - `additional_data` string
          - `mode` integer — 1 means encrypted using a master key
        - `skip_tls_verify` boolean
        - `equality_check_mode` 0 | 1 — Defines how to check if this config points to the same server as another config. If different configs point to the same server the renaming between the fs configs is allowed: * `0` username and endpoint must match. This is the default * `1` only the endpoint must match
  - `virtual_folders` VirtualFolder[] — mapping between virtual SFTPGo paths and folders
    - `id` integer
    - `name` string — unique name for this virtual folder
    - `mapped_path` string — absolute filesystem path to use as virtual folder
    - `description` string — optional description
    - `used_quota_size` integer
    - `used_quota_files` integer
    - `last_quota_update` integer — Last quota update as unix timestamp in milliseconds
    - `users` string[] — list of usernames associated with this virtual folder
    - `filesystem` FilesystemConfig — Storage filesystem details
      - `provider` 0 | 1 | 2 | 3 | 4 | 5 | 6 — Filesystem providers: * `0` - Local filesystem * `1` - S3 Compatible Object Storage * `2` - Google Cloud Storage * `3` - Azure Blob Storage * `4` - Local filesystem encrypted * `5` - SFTP * `6` - HTTP filesystem
      - `osconfig` OSFsConfig
        - `read_buffer_size` integer — The read buffer size, as MB, to use for downloads. 0 means no buffering, that's fine in most use cases.
        - `write_buffer_size` integer — The write buffer size, as MB, to use for uploads. 0 means no buffering, that's fine in most use cases.
      - `s3config` S3Config — S3 Compatible Object Storage configuration details
        - `bucket` string
        - `region` string
        - `access_key` string
        - `access_secret` Secret — The secret is encrypted before saving, so to set a new secret you must provide a payload and set the status to "Plain". The encryption key and additional data will be generated automatically. If you set the status to "Redacted" the existing secret will be preserved
          - `status` 'Plain' | 'AES-256-GCM' | 'Secretbox' | 'GCP' | 'AWS' | 'VaultTransit' | 'AzureKeyVault' | 'Redacted' — Set to "Plain" to add or update an existing secret, set to "Redacted" to preserve the existing value
          - `payload` string
          - `key` string
          - `additional_data` string
          - `mode` integer — 1 means encrypted using a master key
        - `role_arn` string — Optional IAM Role ARN to assume
        - `session_token` string — Optional Session token that is a part of temporary security credentials provisioned by AWS STS
        - `endpoint` string — optional endpoint
        - `storage_class` string
        - `acl` string — The canned ACL to apply to uploaded objects. Leave empty to use the default ACL. For more information and available ACLs, see here: https://docs.aws.amazon.com/AmazonS3/latest/userguide/acl-overview.html#canned-acl
        - `upload_part_size` integer — the buffer size (in MB) to use for multipart uploads. The minimum allowed part size is 5MB, and if this value is set to zero, the default value (5MB) for the AWS SDK will be used. The minimum allowed value is 5.
        - `upload_concurrency` integer — the number of parts to upload in parallel. If this value is set to zero, the default value (5) will be used
        - `upload_part_max_time` integer — the maximum time allowed, in seconds, to upload a single chunk (the chunk size is defined via "upload_part_size"). 0 means no timeout
        - `download_part_size` integer — the buffer size (in MB) to use for multipart downloads. The minimum allowed part size is 5MB, and if this value is set to zero, the default value (5MB) for the AWS SDK will be used. The minimum allowed value is 5. Ignored for partial downloads
        - `download_concurrency` integer — the number of parts to download in parallel. If this value is set to zero, the default value (5) will be used. Ignored for partial downloads
        - `download_part_max_time` integer — the maximum time allowed, in seconds, to download a single chunk (the chunk size is defined via "download_part_size"). 0 means no timeout. Ignored for partial downloads.
        - `force_path_style` boolean — Set this to "true" to force the request to use path-style addressing, i.e., "http://s3.amazonaws.com/BUCKET/KEY". By default, the S3 client will use virtual hosted bucket addressing when possible ("http://BUCKET.s3.amazonaws.com/KEY")
        - `key_prefix` string — key_prefix is similar to a chroot directory for a local filesystem. If specified the user will only see contents that starts with this prefix and so you can restrict access to a specific virtual folder. The prefix, if not empty, must not start with "/" and must end with "/". If empty the whole bucket contents will be available
      - `gcsconfig` GCSConfig — Google Cloud Storage configuration details. The "credentials" field must be populated only when adding/updating a user. It will be always omitted, since there are sensitive data, when you search/get users
        - `bucket` string
        - `credentials` Secret — The secret is encrypted before saving, so to set a new secret you must provide a payload and set the status to "Plain". The encryption key and additional data will be generated automatically. If you set the status to "Redacted" the existing secret will be preserved
          - `status` 'Plain' | 'AES-256-GCM' | 'Secretbox' | 'GCP' | 'AWS' | 'VaultTransit' | 'AzureKeyVault' | 'Redacted' — Set to "Plain" to add or update an existing secret, set to "Redacted" to preserve the existing value
          - `payload` string
          - `key` string
          - `additional_data` string
          - `mode` integer — 1 means encrypted using a master key
        - `automatic_credentials` 0 | 1 — Automatic credentials: * `0` - disabled, explicit credentials, using a JSON credentials file, must be provided. This is the default value if the field is null * `1` - enabled, we try to use the Application Default Credentials (ADC) strategy to find your application's credentials
        - `storage_class` string
        - `acl` string — The ACL to apply to uploaded objects. Leave empty to use the default ACL. For more information and available ACLs, refer to the JSON API here: https://cloud.google.com/storage/docs/access-control/lists#predefined-acl
        - `key_prefix` string — key_prefix is similar to a chroot directory for a local filesystem. If specified the user will only see contents that starts with this prefix and so you can restrict access to a specific virtual folder. The prefix, if not empty, must not start with "/" and must end with "/". If empty the whole bucket contents will be available
        - `upload_part_size` integer — The buffer size (in MB) to use for multipart uploads. The default value is 16MB. 0 means use the default
        - `upload_part_max_time` integer — The maximum time allowed, in seconds, to upload a single chunk. The default value is 32. 0 means use the default
      - `azblobconfig` AzureBlobFsConfig — Azure Blob Storage configuration details
        - `container` string
        - `account_name` string — Storage Account Name, leave blank to use SAS URL
        - `account_key` Secret — The secret is encrypted before saving, so to set a new secret you must provide a payload and set the status to "Plain". The encryption key and additional data will be generated automatically. If you set the status to "Redacted" the existing secret will be preserved
          - `status` 'Plain' | 'AES-256-GCM' | 'Secretbox' | 'GCP' | 'AWS' | 'VaultTransit' | 'AzureKeyVault' | 'Redacted' — Set to "Plain" to add or update an existing secret, set to "Redacted" to preserve the existing value
          - `payload` string
          - `key` string
          - `additional_data` string
          - `mode` integer — 1 means encrypted using a master key
        - `sas_url` Secret — The secret is encrypted before saving, so to set a new secret you must provide a payload and set the status to "Plain". The encryption key and additional data will be generated automatically. If you set the status to "Redacted" the existing secret will be preserved
          - `status` 'Plain' | 'AES-256-GCM' | 'Secretbox' | 'GCP' | 'AWS' | 'VaultTransit' | 'AzureKeyVault' | 'Redacted' — Set to "Plain" to add or update an existing secret, set to "Redacted" to preserve the existing value
          - `payload` string
          - `key` string
          - `additional_data` string
          - `mode` integer — 1 means encrypted using a master key
        - `endpoint` string — optional endpoint. Default is "blob.core.windows.net". If you use the emulator the endpoint must include the protocol, for example "http://127.0.0.1:10000"
        - `upload_part_size` integer — the buffer size (in MB) to use for multipart uploads. If this value is set to zero, the default value (5MB) will be used.
        - `upload_concurrency` integer — the number of parts to upload in parallel. If this value is set to zero, the default value (5) will be used
        - `download_part_size` integer — the buffer size (in MB) to use for multipart downloads. If this value is set to zero, the default value (5MB) will be used.
        - `download_concurrency` integer — the number of parts to download in parallel. If this value is set to zero, the default value (5) will be used
        - `access_tier` '' | 'Archive' | 'Hot' | 'Cool'
        - `key_prefix` string — key_prefix is similar to a chroot directory for a local filesystem. If specified the user will only see contents that starts with this prefix and so you can restrict access to a specific virtual folder. The prefix, if not empty, must not start with "/" and must end with "/". If empty the whole container contents will be available
        - `use_emulator` boolean
      - `cryptconfig` CryptFsConfig — Crypt filesystem configuration details
        - `passphrase` Secret — The secret is encrypted before saving, so to set a new secret you must provide a payload and set the status to "Plain". The encryption key and additional data will be generated automatically. If you set the status to "Redacted" the existing secret will be preserved
          - `status` 'Plain' | 'AES-256-GCM' | 'Secretbox' | 'GCP' | 'AWS' | 'VaultTransit' | 'AzureKeyVault' | 'Redacted' — Set to "Plain" to add or update an existing secret, set to "Redacted" to preserve the existing value
          - `payload` string
          - `key` string
          - `additional_data` string
          - `mode` integer — 1 means encrypted using a master key
        - `read_buffer_size` integer — The read buffer size, as MB, to use for downloads. 0 means no buffering, that's fine in most use cases.
        - `write_buffer_size` integer — The write buffer size, as MB, to use for uploads. 0 means no buffering, that's fine in most use cases.
      - `sftpconfig` SFTPFsConfig
        - `endpoint` string — remote SFTP endpoint as host:port
        - `username` string — you can specify a password or private key or both. In the latter case the private key will be tried first.
        - `password` Secret — The secret is encrypted before saving, so to set a new secret you must provide a payload and set the status to "Plain". The encryption key and additional data will be generated automatically. If you set the status to "Redacted" the existing secret will be preserved
          - `status` 'Plain' | 'AES-256-GCM' | 'Secretbox' | 'GCP' | 'AWS' | 'VaultTransit' | 'AzureKeyVault' | 'Redacted' — Set to "Plain" to add or update an existing secret, set to "Redacted" to preserve the existing value
          - `payload` string
          - `key` string
          - `additional_data` string
          - `mode` integer — 1 means encrypted using a master key
        - `private_key` Secret — The secret is encrypted before saving, so to set a new secret you must provide a payload and set the status to "Plain". The encryption key and additional data will be generated automatically. If you set the status to "Redacted" the existing secret will be preserved
          - `status` 'Plain' | 'AES-256-GCM' | 'Secretbox' | 'GCP' | 'AWS' | 'VaultTransit' | 'AzureKeyVault' | 'Redacted' — Set to "Plain" to add or update an existing secret, set to "Redacted" to preserve the existing value
          - `payload` string
          - `key` string
          - `additional_data` string
          - `mode` integer — 1 means encrypted using a master key
        - `key_passphrase` Secret — The secret is encrypted before saving, so to set a new secret you must provide a payload and set the status to "Plain". The encryption key and additional data will be generated automatically. If you set the status to "Redacted" the existing secret will be preserved
          - `status` 'Plain' | 'AES-256-GCM' | 'Secretbox' | 'GCP' | 'AWS' | 'VaultTransit' | 'AzureKeyVault' | 'Redacted' — Set to "Plain" to add or update an existing secret, set to "Redacted" to preserve the existing value
          - `payload` string
          - `key` string
          - `additional_data` string
          - `mode` integer — 1 means encrypted using a master key
        - `fingerprints` string[] — SHA256 fingerprints to use for host key verification. If you don't provide any fingerprint the remote host key will not be verified, this is a security risk
        - `prefix` string — Specifying a prefix you can restrict all operations to a given path within the remote SFTP server.
        - `disable_concurrent_reads` boolean — Concurrent reads are safe to use and disabling them will degrade performance. Some servers automatically delete files once they are downloaded. Using concurrent reads is problematic with such servers.
        - `buffer_size` integer — The size of the buffer (in MB) to use for transfers. By enabling buffering, the reads and writes, from/to the remote SFTP server, are split in multiple concurrent requests and this allows data to be transferred at a faster rate, over high latency networks, by overlapping round-trip times. With buffering enabled, resuming uploads is not supported and a file cannot be opened for both reading and writing at the same time. 0 means disabled.
        - `equality_check_mode` 0 | 1 — Defines how to check if this config points to the same server as another config. If different configs point to the same server the renaming between the fs configs is allowed: * `0` username and endpoint must match. This is the default * `1` only the endpoint must match
      - `httpconfig` HTTPFsConfig
        - `endpoint` string — HTTP/S endpoint URL. SFTPGo will use this URL as base, for example for the `stat` API, SFTPGo will add `/stat/{name}`
        - `username` string
        - `password` Secret — The secret is encrypted before saving, so to set a new secret you must provide a payload and set the status to "Plain". The encryption key and additional data will be generated automatically. If you set the status to "Redacted" the existing secret will be preserved
          - `status` 'Plain' | 'AES-256-GCM' | 'Secretbox' | 'GCP' | 'AWS' | 'VaultTransit' | 'AzureKeyVault' | 'Redacted' — Set to "Plain" to add or update an existing secret, set to "Redacted" to preserve the existing value
          - `payload` string
          - `key` string
          - `additional_data` string
          - `mode` integer — 1 means encrypted using a master key
        - `api_key` Secret — The secret is encrypted before saving, so to set a new secret you must provide a payload and set the status to "Plain". The encryption key and additional data will be generated automatically. If you set the status to "Redacted" the existing secret will be preserved
          - `status` 'Plain' | 'AES-256-GCM' | 'Secretbox' | 'GCP' | 'AWS' | 'VaultTransit' | 'AzureKeyVault' | 'Redacted' — Set to "Plain" to add or update an existing secret, set to "Redacted" to preserve the existing value
          - `payload` string
          - `key` string
          - `additional_data` string
          - `mode` integer — 1 means encrypted using a master key
        - `skip_tls_verify` boolean
        - `equality_check_mode` 0 | 1 — Defines how to check if this config points to the same server as another config. If different configs point to the same server the renaming between the fs configs is allowed: * `0` username and endpoint must match. This is the default * `1` only the endpoint must match
    - `virtual_path` string, required
    - `quota_size` integer — Quota as size in bytes. 0 means unlimited, -1 means included in user quota. Please note that quota is updated if files are added/removed via SFTPGo otherwise a quota scan or a manual quota update is needed
    - `quota_files` integer — Quota as number of files. 0 means unlimited, , -1 means included in user quota. Please note that quota is updated if files are added/removed via SFTPGo otherwise a quota scan or a manual quota update is needed
  - `users` string[] — list of usernames associated with this group
  - `admins` string[] — list of admins usernames associated with this group

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Forbidden
- `404` — Not Found
- `500` — Internal Server Error
- `default` — Unexpected Error

---

[API](https://skmtc.net/kanton-bern/apis/sftpgo.md) · [All operations](https://skmtc.net/kanton-bern/apis/sftpgo/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/kanton-bern/sftpgo/versions/d8d616a479b0/schema)