DRACOON API

Request group member users or / and users who can become a member ### Description: Retrieve a list of group member users or / and users who can become a member. ### Precondition: Right 🔓 read groups required. ### Postcondition: List of users is returned. ### Further Information: ### Filtering: All filter fields are connected via logical conjunction (**AND**) Filter string syntax: `FIELD_NAME:OPERATOR:VALUE` Example `isMember:eq:false|user:cn:searchString` Get all users that are **NOT** in this group **AND** whose (`firstName` **OR** `lastName` **OR** `email` **OR** `username`) is like `searchString`. ### Filtering options: Expand | `FIELD_NAME` | Filter Description | `OPERATOR` | Operator Description | `VALUE` | | :--- | :--- | :--- | :--- | :--- | | `user` | User filter | `cn` | User contains value (`firstName` **OR** `lastName` **OR** `email` **OR** `username`). | `search String` | | `isMember` | Filter group members | `eq` | | `true``false``any`default: `true` | ### Deprecated filtering options: Expand | `FIELD_NAME` | Filter Description | `OPERATOR` | Operator Description | `VALUE` | | :--- | :--- | :--- | :--- | :--- | | `displayName` | User display name filter (use `user` filter) | `cn` | User display name contains value (`firstName` **OR** `lastName` **OR** `email`). | `search String` |

Request list of roles assigned to the group ### Description: Retrieve a list of all roles granted to a group. ### Precondition: Right 🔓 read groups required. ### Postcondition: List of granted roles is returned. ### Further Information: None.

Request rooms granted to the group or / and rooms that can be granted ### Description: Retrieves a list of rooms granted to the group and / or that can be granted. ### Precondition: Right 🔓 read groups required. ### Postcondition: List of rooms is returned. ### Further Information: ### Filtering: All filter fields are connected via logical conjunction (**AND**) Filter string syntax: `FIELD_NAME:OPERATOR:VALUE` Example `isGranted:eq:false|name:cn:searchString` Get all rooms where the group is **NOT** granted **AND** whose name is like `searchString`. ### Filtering options: Expand | `FIELD_NAME` | Filter Description | `OPERATOR` | Operator Description | `VALUE` | | :--- | :--- | :--- | :--- | :--- | | `name` | Room name filter | `cn` | Room name contains value. | `search String` | | `isGranted` | Filter rooms which the group is (not) granted | `eq` | | `true``false``any`default: `true` | | `effectivePerm` | Filter rooms with DIRECT or DIRECT **AND** EFFECTIVE permissions`false`: DIRECT permissions`true`: DIRECT **AND** EFFECTIVE permissionsDIRECT means: e.g. room administrator grants `read` permissions to group of users **directly** on desired room.EFFECTIVE means: e.g. group of users gets `read` permissions on desired room through **inheritance**. | `eq` | | `true or false`default: `true` |

Request list of user groups ### Description: Returns a list of user groups. ### Precondition: Right 🔓 read groups required. ### Postcondition: List of user groups is returned. ### Further Information: ### Filtering: All filter fields are connected via logical conjunction (**AND**) Filter string syntax: `FIELD_NAME:OPERATOR:VALUE` Example `name:cn:searchString` Filter by group name containing `searchString`. ### Filtering options: Expand | `FIELD_NAME` | Filter Description | `OPERATOR` | Operator Description | `VALUE` | | :--- | :--- | :--- | :--- | :--- | | `name` | Group name filter | `cn` | Group name contains value. | `search String` | | `hasRole` | (**`NEW`**) Group role filterFor more information about roles check **`GET /roles`** API | `eq` | Group role equals value. | `CONFIG_MANAGER` - Manages global configuration`USER_MANAGER` - Manages users`GROUP_MANAGER` - Manages user groups`ROOM_MANAGER` - Manages top level rooms`LOG_AUDITOR` - Reads audit logs`NONMEMBER_VIEWER` - Views users and groups when having room _"manage"_ permission | --- ### Sorting: Sort string syntax: `FIELD_NAME:ORDER` `ORDER` can be `asc` or `desc`. Multiple sort fields are supported. Example `name:asc|expireAt:desc` Sort by `name` ascending **AND** by `expireAt` descending. ### Sorting options: Expand | `FIELD_NAME` | Description | | :--- | :--- | | `name` | Group name | | `createdAt` | Creation date | | `expireAt` | Expiration date | | `cntUsers` | Amount of users |

Request guest user policies ### Description: Retrieve guest user policies. ### Precondition: Right 🔓 read global config of the Provider Customer required. ### Postcondition: Guest user policies are returned. ### Further Information: None.

Request guest users policies ### Description: Retrieve a list of guest users policies. ### Precondition: Authenticated user. ### Postcondition: List of configured guest users policies is returned. ### Further Information: None.

Request infrastructure properties ### Description: DRACOON infrastructure properties entry point. ### Precondition: Right 🔓 read global config and role 👤 Config Manager of the Provider Customer required. ### Postcondition: Returns a list of read-only infrastructure properties. ### Further Information: Source: `core-service.properties` ### Read-only infrastructure properties: Expand | Setting | Description | Value | | :--- | :--- | :--- | | `smsConfigEnabled` | Determines whether sending of share passwords via SMS is **system-wide** enabled. | `true or false` | | `mediaServerConfigEnabled` | Determines whether media server is **system-wide** enabled. | `true or false` | | `s3DefaultRegion` | Suggested S3 region | `Region name` | | `s3EnforceDirectUpload` | Enforce direct upload to S3 | `true or false` | | `dracoonCloud` | Determines if the **DRACOON Core** is deployed in the cloud environment | `true or false` | | `tenantUuid` | Current tenant UUID | `UUID` |

Request infrastructure properties ### Description: Returns a list of read-only infrastructure properties. ### Precondition: Authenticated user. ### Postcondition: List of infrastructure properties is returned. ### Further Information: Source: `core-service.properties` ### Read-only infrastructure properties: Expand | Setting | Description | Value | | :--- | :--- | :--- | | `smsConfigEnabled` | Determines whether sending of share passwords via SMS is **system-wide** enabled. | `true or false` | | `mediaServerConfigEnabled` | Determines whether media server is **system-wide** enabled. | `true or false` | | `s3DefaultRegion` | Suggested S3 region | `Region name` | | `s3EnforceDirectUpload` | Enforce direct upload to S3 | `true or false` | | `isDracoonCloud` | Determines if the **DRACOON Core** is deployed in the cloud environment | `true or false` | | `tenantUuid` | Current tenant UUID | `UUID` |

Request rooms where the group is defined as last admin group ### Description: Retrieve a list of all rooms where the group is defined as last admin group. ### Precondition: Right 🔓 change groups required. ### Postcondition: List of rooms is returned. ### Further Information: An empty list is returned if no rooms were found where the group is defined as last admin group.

Request rooms where the user is last admin ### Description: Retrieve a list of all rooms where the user is last admin (except homeroom and its subordinary rooms). ### Precondition: Right 🔓 change users required. ### Postcondition: List of rooms is returned. ### Further Information: An empty list is returned if no rooms were found where the user is last admin.

Request list of event types ### Description: Get a list of available (for 👤 Config Manager) event types. ### Precondition: Right 🔓 change config required. ### Postcondition: List of available event types is returned. ### Further Information: None.

Request list of event types ### Description: Get a list of available event types. ### Precondition: Right 🔓 manage webhook required. ### Postcondition: List of available event types is returned. ### Further Information: None.

Request list of notification configurations ### Description: Retrieve a list of notification configurations for current user. ### Precondition: Authenticated user. ### Postcondition: List of available notification configurations is returned. ### Further Information: None.

Request list of tenant webhooks ### Description: Get a list of webhooks for the tenant scope. ### Precondition: Right 🔓 manage webhook required. ### Postcondition: List of webhooks is returned. ### Further Information: Output is limited to **500** entries. For more results please use filter criteria and paging (`offset` + `limit`). `EncryptionInfo` is **NOT** provided. Wildcard character is the asterisk character: **`*`** ### Filtering: All filter fields are connected via logical conjunction (**AND**) Filter string syntax: `FIELD_NAME:OPERATOR:VALUE[:VALUE...]` Example `name:cn:goo|createdAt:ge:2015-01-01` Get webhooks where name contains `goo` **AND** webhook creation date is **>=** `2015-01-01`. ### Filtering options: Expand | `FIELD_NAME` | Filter Description | `OPERATOR` | Operator Description | `VALUE` | | :--- | :--- | :--- | :--- | :--- | | **`id`** | Webhook id filter | `eq` | Webhook id equals value.Multiple values are allowed and will be connected via logical disjunction (**OR**). |`positive number`| | **`name`** | Webhook type name| `cn, eq` | Webhook name contains / equals value. | `search String` | | **`isEnabled`** | Webhook isEnabled filter | `eq` | | `true or false` | | **`createdAt`** | Creation date filter | `ge, le` | Creation date is greater / less equals than value.Multiple operator values are allowed and will be connected via logical conjunction (**AND**).e.g. `createdAt:ge:2016-12-31`|`createdAt:le:2018-01-01` | `Date (yyyy-MM-dd)` | | **`updatedAt`** | Last modification date filter | `ge, le` | Last modification date is greater / less equals than value.Multiple operator values are allowed and will be connected via logical conjunction (**AND**).e.g. `updatedAt:ge:2016-12-31`|`updatedAt:le:2018-01-01` | `Date (yyyy-MM-dd)` | | **`expiration`** | Expiration date filter | `ge, le, eq` | Expiration date is greater / less equals than value.Multiple operator values are allowed and will be connected via logical conjunction (**AND**).e.g. `expiration:ge:2016-12-31`|`expiration:le:2018-01-01` | `Date (yyyy-MM-dd)` | | **`lastFailStatus`** | Failure status filter | `eq` | Last HTTP status code. Set when a webhook is auto-disabled due to repeated delivery failures |`positive number`| --- ### Sorting: Sort string syntax: `FIELD_NAME:ORDER` `ORDER` can be `asc` or `desc`. Multiple sort criteria are possible. Fields are connected via logical conjunction **AND**. Example `name:desc|isEnabled:asc` Sort by `name` descending and `isEnabled` ascending. ### Sorting options: Expand | `FIELD_NAME` | Description | | :--- | :--- | | **`id`** | Webhook id | | **`name`** | Webhook name | | **`isEnabled`** | Webhook isEnabled | | **`createdAt`** | Creation date | | **`updatedAt`** | Last modification date | | **`expiration`** | Expiration date |

Request list of webhooks ### Description: Get a list of webhooks for the customer scope. ### Precondition: Right 🔓 change config required. ### Postcondition: List of webhooks is returned. ### Filtering: All filter fields are connected via logical conjunction (**AND**) Filter string syntax: `FIELD_NAME:OPERATOR:VALUE[:VALUE...]` Example `name:cn:goo|createdAt:ge:2015-01-01` Get webhooks where name contains `goo` **AND** webhook creation date is **>=** `2015-01-01`. ### Filtering options: Expand | `FIELD_NAME` | Filter Description | `OPERATOR` | Operator Description | `VALUE` | | :--- | :--- | :--- | :--- | :--- | | **`id`** | Webhook id filter | `eq` | Webhook id equals value.Multiple values are allowed and will be connected via logical disjunction (**OR**). |`positive number`| | **`name`** | Webhook type name| `cn, eq` | Webhook name contains / equals value. | `search String` | | **`isEnabled`** | Webhook isEnabled filter | `eq` | | `true or false` | | **`createdAt`** | Creation date filter | `ge, le` | Creation date is greater / less equals than value.Multiple operator values are allowed and will be connected via logical conjunction (**AND**).e.g. `createdAt:ge:2016-12-31`|`createdAt:le:2018-01-01` | `Date (yyyy-MM-dd)` | | **`updatedAt`** | Last modification date filter | `ge, le` | Last modification date is greater / less equals than value.Multiple operator values are allowed and will be connected via logical conjunction (**AND**).e.g. `updatedAt:ge:2016-12-31`|`updatedAt:le:2018-01-01` | `Date (yyyy-MM-dd)` | | **`expiration`** | Expiration date filter | `ge, le, eq` | Expiration date is greater / less equals than value.Multiple operator values are allowed and will be connected via logical conjunction (**AND**).e.g. `expiration:ge:2016-12-31`|`expiration:le:2018-01-01` | `Date (yyyy-MM-dd)` | | **`lastFailStatus`** | Failure status filter | `eq` | Last HTTP status code. Set when a webhook is auto-disabled due to repeated delivery failures |`positive number`| --- ### Sorting: Sort string syntax: `FIELD_NAME:ORDER` `ORDER` can be `asc` or `desc`. Multiple sort criteria are possible. Fields are connected via logical conjunction **AND**. Example `name:desc|isEnabled:asc` Sort by `name` descending and `isEnabled` ascending. ### Sorting options: Expand | `FIELD_NAME` | Description | | :--- | :--- | | **`id`** | Webhook id | | **`name`** | Webhook name | | **`isEnabled`** | Webhook isEnabled | | **`createdAt`** | Creation date | | **`updatedAt`** | Last modification date | | **`expiration`** | Expiration date |

Request list of webhooks that are assigned or can be assigned to this room ### Description: Get a list of webhooks for the room scope with their assignment status. ### Precondition: User needs to be a 👤 Room Administrator. ### Postcondition: List of webhooks is returned. ### Further Information: ### Filtering: All filter fields are connected via logical conjunction (**AND**) Filter string syntax: `FIELD_NAME:OPERATOR:VALUE[:VALUE...]` Example `isAssigned:eq:true` Get a list of assigned webhooks to the room. ### Filtering options: Expand | `FIELD_NAME` | Filter Description | `OPERATOR` | Operator Description | `VALUE` | | :--- | :--- | :--- | :--- | :--- | | **`isAssigned`** | Assigned/unassigned webhooks filter | `eq` | | `true or false` |

Request system events ### Description: Retrieve eventlog (audit log) events. ### Precondition: Role 👤 Log Auditor required. ### Postcondition: List of audit log events is returned. ### Further Information: Output is limited to **500** entries. For more results please use filter criteria and paging (`offset` + `limit`). Allowed `Accept-Header`: * `Accept: application/json` * `Accept: text/csv` --- Sort string syntax: `FIELD_NAME:ORDER` `ORDER` can be `asc` or `desc`. Multiple sort fields are supported. Example `time:desc` Sort by `time` descending (default sort option). ### Sorting options: Expand | `FIELD_NAME` | Description | | :--- | :--- | | `time` | Event timestamp |

Request allowed Log Operations ### Description: Retrieve eventlog (audit log) operation IDs and the associated log operation description. ### Precondition: Role 👤 Log Auditor required. ### Postcondition: List of available log operations is returned. ### Further Information: None.

Request MFA policies ### Description: Retrieve a list of multi-factor authentication policies. ### Precondition: Right 🔓 read global config of the Provider Customer required. ### Postcondition: List of configured multi-factor authentication policies is returned. ### Further Information: None.

Request files without user's file key ### Description: Requests a list of missing file keys that may be generated by the current user. ### Precondition: User has a key pair. Only returns users that owns one of the following permissions: 🔓 manage, 🔓 read, 🔓 manage download share ### Postcondition: None. ### Further Information: Clients **SHOULD** regularly request missing file keys to provide access to files for other users. The returned list is ordered by priority (emergency passwords / rescue keys are returned first). There is an enforced limit of **100** items per request. A total value greater than limit signals that there are more entries but does not necessarily reflect the precise number of total items.

Request node ### Description: Get node (room, folder or file). ### Precondition: User has 🔓 read permissions in auth parent room. ### Postcondition: Requested node is returned. ### Further Information: None.

Request custom node attributes ### Description: Retrieve a list of node attributes. ### Precondition: User has 🔓 read permissions in auth parent room. ### Postcondition: List of attributes is returned. ### Further Information: ### Filtering: All filter fields are connected via logical conjunction (**AND**) Filter string syntax: `FIELD_NAME:OPERATOR:VALUE[:VALUE...]` Example `key:cn:searchString_1|value:cn:searchString_2` Filter by attribute key contains `searchString_1` **AND** attribute value contains `searchString_2`. ### Filtering options: Expand | `FIELD_NAME` | Filter Description | `OPERATOR` | Operator Description | `VALUE` | | :--- |:----------------------------| :--- | :--- | :--- | | `key` | Node attribute key filter | `cn, eq, sw` | Attribute key contains / equals / starts with value. | `search String` | | `value` | Node attribute value filter | `cn, eq, sw` | Attribute value contains / equals / starts with value. | `search String` | --- ### Sorting: Sort string syntax: `FIELD_NAME:ORDER` `ORDER` can be `asc` or `desc`. Multiple sort fields are supported. Example `key:asc|value:desc` Sort by `key` ascending **AND** by `value` descending. ### Sorting options: Expand | `FIELD_NAME` | Description | | :--- | :--- | | `key` | Node attribute key | | `value` | Node attribute value |

Request list of node comments ### Description: Get comments for a specific node. ### Precondition: User has 🔓 read permissions on the node. ### Postcondition: List with comments (sorted by `createdAt` timestamp) is returned. ### Further Information: An empty list is returned if no comments were found. Output is limited to **500** entries. For more results please use filter criteria and paging (`offset` + `limit`).

Request list of parent nodes ### Description: Requests a list of node ancestors, sorted from root node to the node's direct parent node. ### Precondition: User is allowed to browse through the node tree until the requested node. ### Postcondition: List of parent nodes is returned. ### Further Information: None.

Request list of nodes ### Description: Provides a hierarchical list of file system nodes (rooms, folders or files) of a given parent that are accessible by the current user. ### Precondition: Authenticated user. ### Postcondition: List of nodes is returned. ### Further Information: `EncryptionInfo` is **NOT** provided. ### Filtering: All filter fields are connected via logical conjunction (**AND**) Filter string syntax: `FIELD_NAME:OPERATOR:VALUE[:VALUE...]` Example `type:eq:room:folder|perm:eq:read` Get nodes where type equals (`room` **OR** `folder`) **AND** user has `read` permissions. ### Filtering options: Expand | `FIELD_NAME` | Filter Description | `OPERATOR` | Operator Description | `VALUE` | | :--- | :--- | :--- | :--- | :--- | | `type` | Node type filter | `eq` | Node type equals value.Multiple values are allowed and will be connected via logical disjunction (**OR**).e.g. `type:eq:room:folder` | `room``folder``file` | | `perm` | Permission filter | `eq` | Permission equals value.Multiple values are allowed and will be connected via logical disjunction (**OR**).e.g. `perm:eq:read:create:delete` | `manage``read``change``create``delete``manageDownloadShare``manageUploadShare``canReadRecycleBin``canRestoreRecycleBin``canDeleteRecycleBin` | | `childPerm` | Same as `perm`, but less restrictive (applies to child nodes only).Child nodes of the parent node which do not meet the filter conditionare **NOT** returned. | `eq` | cf. `perm` | cf. `perm` | | `name` | Node name filter | `cn, eq` | Node name contains / equals value. | `search String` | | `encrypted` | Node encryption status filter | `eq` | | `true or false` | | `branchVersion` | Node branch version filter | `ge, le` | Branch version is greater / less equals than value.Multiple operator values are allowed and will be connected via logical conjunction (**AND**).e.g. `branchVersion:ge:1423280937404`|`branchVersion:le:1523280937404` | `version number` | | `timestampCreation` | Creation timestamp filter | `ge, le` | Creation timestamp is greater / less equals than value.Multiple operator values are allowed and will be connected via logical conjunction (**AND**).e.g. `timestampCreation:ge:2016-12-31T23:00:00.123`|`timestampCreation:le:2018-01-01T11:00:00.540` | `Date (yyyy-MM-dd)` | | `timestampModification` | Modification timestamp filter | `ge, le` | Modification timestamp is greater / less equals than value.Multiple operator values are allowed and will be connected via logical conjunction (**AND**).e.g. `timestampModification:ge:2016-12-31T23:00:00.123`|`timestampModification:le:2018-01-01T11:00:00.540` | `Date (yyyy-MM-dd)` | | `referenceId` | Reference ID filter | `eq` | Reference ID equals value. | `Integer ` | --- ### Sorting: Sort string syntax: `FIELD_NAME:ORDER` `ORDER` can be `asc` or `desc`. Multiple sort criteria are possible. Fields are connected via logical conjunction **AND**. Nodes are sorted by type first, then by sent sort string. Example `name:desc|fileType:asc` Sort by `name` descending **AND** `fileType` ascending. ### Sorting options: Expand | `FIELD_NAME` | Description | | :--- | :--- | | `name` | Node name | | `createdAt` | Creation date | | `createdBy` | Creator first name, last name | | `updatedAt` | Last modification date | | `updatedBy` | Last modifier first name, last name | | `fileType` | File type (extension) | | `classification` | Classification ID:1 - public2 - internal3 - confidential4 - strictly confidential | | `size` | Node size | | `cntDeletedVersions` | Number of deleted versions of this file / folder (**NOT** recursive; for files and folders only) | | `timestampCreation` | Creation timestamp | | `timestampModification` | Modification timestamp | ### Deprecated sorting options: Expand | `FIELD_NAME` | Description | | :--- | :--- | | `cntChildren` | Number of direct children (**NOT** recursive; for rooms and folders only) |

Request list of notification channels ### Description: Retrieve a list of configured notification channels. ### Precondition: Right _"change config"_ required. ### Postcondition: List of notification channels is returned. ### Further Information: None.

Request list of notification channels ### Description: Retrieve a list of configured notification channels. ### Precondition: Authenticated user. ### Postcondition: List of notification channels is returned. ### Further Information: None.

Request list of OAuth client approvals ### Functional Description: Retrieve information about all OAuth client approvals. ### Precondition: Authenticated user. ### Postcondition: None. ### Further Information: None. ### Sorting: Sort string syntax: `FIELD_NAME:ORDER` `ORDER` can be `asc` or `desc`. Multiple sort criteria are possible. Fields are connected via logical conjunction **AND**. Example `clientName:desc` Sort by `clientName` descending. ### Sorting options: Expand | `FIELD_NAME` | Description | | :--- | :--- | | `clientName` | Client name |

Request list of OAuth client authorizations ### Description: Retrieve information about all OAuth client authorizations. ### Precondition: Authenticated user. ### Postcondition: List of OAuth client authorizations is returned. ### Further Information: ### Filtering: Filter string syntax: `FIELD_NAME:OPERATOR:VALUE[:VALUE...]` Example `isStandard:eq:true` Get standard OAuth clients. ### Filtering options: Expand | `FIELD_NAME` | Filter Description | `OPERATOR` | Operator Description | `VALUE` | | :--- | :--- | :--- | :--- | :--- | | `isStandard` | Standard client filter | `eq` | | `true or false` | --- ### Sorting: Sort string syntax: `FIELD_NAME:ORDER` `ORDER` can be `asc` or `desc`. Multiple sort criteria are possible. Fields are connected via logical conjunction **AND**. Example `clientName:desc` Sort by `clientName` descending. ### Sorting options: Expand | `FIELD_NAME` | Description | | :--- | :--- | | `clientName` | Client name |

Request OAuth client ### Description: Retrieve the configuration of an OAuth client. ### Precondition: Right 🔓 change global config and role 👤 Config Manager of the Provider Customer required. ### Postcondition: OAuth client is returned. ### Further Information: None.

Request list of OAuth clients ### Description: Retrieve a list of configured OAuth clients. ### Precondition: Right 🔓 change global config and role 👤 Config Manager of the Provider Customer required. ### Postcondition: List of OAuth clients is returned. ### Further Information: ### Filtering: All filter fields are connected via logical conjunction (**AND**) Filter string syntax: `FIELD_NAME:OPERATOR:VALUE[:VALUE...]` Example `isStandard:eq:true` Get standard OAuth clients. ### Filtering options: Expand | `FIELD_NAME` | Filter Description | `OPERATOR` | Operator Description | `VALUE` | | :--- | :--- | :--- | :--- | :--- | | `isStandard` | Standard client filter | `eq` | | `true or false` | | `isExternal` | External client filter | `eq` | | `true or false` | | `isEnabled` | Enabled/disabled clients filter | `eq` | | `true or false` | --- ### Sorting: Sort string syntax: `FIELD_NAME:ORDER` `ORDER` can be `asc` or `desc`. Multiple sort criteria are possible. Fields are connected via logical conjunction **AND**. Example `clientName:desc|isStandard:asc` Sort by `clientName` descending **AND** `isStandard` ascending. ### Sorting options: Expand | `FIELD_NAME` | Description | | :--- | :--- | | `clientName` | Client name | | `isStandard` | Is a standard client | | `isExternal` | Is a external client | | `isEnabled` | Is a enabled client |

Request OpenID Connect provider authentication information ### Description: Provides information about OpenID Connect authentication options. ### Precondition: None. ### Postcondition: OpenID Connect authentication options information is returned. ### Further Information: None.

Request OpenID Connect IDP configuration ### Description: Retrieve an OpenID Connect IDP configuration. ### Precondition: Right 🔓 change global config and role 👤 Config Manager of the Provider Customer required. ### Postcondition: OpenID Connect IDP configuration is returned. ### Further Information: None.

Request list of OpenID Connect IDP configurations ### Description: Retrieve a list of configured OpenID Connect IDPs. ### Precondition: Right 🔓 change global config and role 👤 Config Manager of the Provider Customer required. ### Postcondition: List of OpenID Connect IDP configurations is returned. ### Further Information: ### Filtering: All filter fields are connected via logical conjunction (**AND**) Filter string syntax: `FIELD_NAME:OPERATOR:VALUE[:VALUE...]` Example `isStandard:eq:true` Get standard OpenID Connect IDPs. ### Filtering options: Expand | `FIELD_NAME` | Filter Description | `OPERATOR` | Operator Description | `VALUE` | | :--- | :--- | :--- | :--- | :--- | | `isStandard` | Standard IDP filter | `eq` | | `true or false` | | `isEnabled` | Enabled/disabled IDPs filter | `eq` | | `true or false` | --- ### Sorting: Sort string syntax: `FIELD_NAME:ORDER` `ORDER` can be `asc` or `desc`. Multiple sort criteria are possible. Fields are connected via logical conjunction **AND**. Example `name:desc|isStandard:asc` Sort by `name` descending **AND** `isStandard` ascending. ### Sorting options: Expand | `FIELD_NAME` | Description | |:---|:---| | `name` | Name | | `isStandard` | Is a standard IDP | | `isEnabled` | Is a enabled IDP |

Request password policies ### Description: Retrieve a list of configured password policies for all password types: * `login` * `shares` * `encryption` ### Precondition: Right 🔓 read global config and role 👤 Config Manager of the Provider Customer required. ### Postcondition: List of configured password policies is returned. ### Further Information: None. ### Available password policies: Expand | Name | Description | Value | Password Type | | :--- | :--- | :--- | :--- | | `mustContainCharacters` | Characters which a password must contain:`alpha` - at least one alphabetical character (`uppercase` **OR** `lowercase`)a b c d e f g h i j k l m n o p q r s t u v w x y zA B C D E F G H I J K L M N O P Q R S T U V W X Y Z`uppercase` - at least one uppercase characterA B C D E F G H I J K L M N O P Q R S T U V W X Y Z`lowercase` - at least one lowercase charactera b c d e f g h i j k l m n o p q r s t u v w x y z`numeric` - at least one numeric character0 1 2 3 4 5 6 7 8 9`special` - at least one special character (letters and digits excluded)! " # $ % ( ) * + , - . / : ; = ? @ [ \ ] ^ _ { | } ~`none` - none of the above | `alpha``uppercase``lowercase``numeric``special``none` | `login``shares``encryption` | | `numberOfCharacteristicsToEnforce` | Number of characteristics to enforce.e.g. from `["uppercase", "lowercase", "numeric", "special"]`all 4 character sets can be enforced; but also only 2 of them | `Integer between 0 and 4` | `login``shares``encryption` | | `minLength` | Minimum number of characters a password must contain. | `login`: `Integer between 1 and 1024``shares`: `Integer between 1 and 72``encryption`: `Integer between 1 and 1024` | `login``shares``encryption` | | `rejectDictionaryWords` | Determines whether a password must **NOT** contain word(s) from a dictionary.In `core-service.properties` a path to directory with dictionary files (`*.txt`) can be definedcf. `policies.passwords.dictionary.directory`.If this rule gets enabled `policies.passwords.dictionary.directory` must be defined and contain dictionary files.Otherwise, the rule will not have any effect on password validation process. | `true or false` | `login``shares` | | `rejectUserInfo` | Determines whether a password must **NOT** contain user info.Affects user's **first name**, **last name**, **email** and **user name**. | `true or false` | `login``shares``encryption` | | `rejectKeyboardPatterns` | Determines whether a password must **NOT** contain keyboard patterns.e.g. `qwertz`, `asdf` (min. 4 character pattern) | `true or false` | `login``shares``encryption` | | `numberOfArchivedPasswords` | Number of passwords to archive.Value `0` means that password history is disabled. | `Integer between 0 and 10` | `login` | | `passwordExpiration.enabled` | Determines whether password expiration is enabled. | `true or false` | `login` | | `maxPasswordAge` | Maximum allowed password age (in **days**) | `positive Integer` | `login` | | `userLockout.enabled` | Determines whether user lockout is enabled. | `true or false` | `login` | | `maxNumberOfLoginFailures` | Maximum allowed number of failed login attempts. | `positive Integer` | `login` | | `lockoutPeriod` | Amount of **minutes** a user has to wait to make another login attemptafter `maxNumberOfLoginFailures` has been exceeded. | `positive Integer` | `login` |

Request password policies ### Description: Retrieve a list of configured password policies for all password types: * `login` * `shares` * `encryption` ### Precondition: Authenticated user. ### Postcondition: List of configured password policies is returned. ### Further Information: None. ### Available password policies: Expand | Name | Description | Value | Password Type | | :--- | :--- | :--- | :--- | | `mustContainCharacters` | Characters which a password must contain:`alpha` - at least one alphabetical character (`uppercase` **OR** `lowercase`)a b c d e f g h i j k l m n o p q r s t u v w x y zA B C D E F G H I J K L M N O P Q R S T U V W X Y Z`uppercase` - at least one uppercase characterA B C D E F G H I J K L M N O P Q R S T U V W X Y Z`lowercase` - at least one lowercase charactera b c d e f g h i j k l m n o p q r s t u v w x y z`numeric` - at least one numeric character0 1 2 3 4 5 6 7 8 9`special` - at least one special character (letters and digits excluded)! " # $ % ( ) * + , - . / : ; = ? @ [ \ ] ^ _ { | } ~`none` - none of the above | `alpha``uppercase``lowercase``numeric``special``none` | `login``shares``encryption` | | `numberOfCharacteristicsToEnforce` | Number of characteristics to enforce.e.g. from `["uppercase", "lowercase", "numeric", "special"]`all 4 character sets can be enforced; but also only 2 of them | `Integer between 0 and 4` | `login``shares``encryption` | | `minLength` | Minimum number of characters a password must contain. | `login`: `Integer between 1 and 1024``shares`: `Integer between 1 and 72``encryption`: `Integer between 1 and 1024` | `login``shares``encryption` | | `rejectDictionaryWords` | Determines whether a password must **NOT** contain word(s) from a dictionary.In `core-service.properties` a path to directory with dictionary files (`*.txt`) can be definedcf. `policies.passwords.dictionary.directory`.If this rule gets enabled `policies.passwords.dictionary.directory` must be defined and contain dictionary files.Otherwise, the rule will not have any effect on password validation process. | `true or false` | `login``shares` | | `rejectUserInfo` | Determines whether a password must **NOT** contain user info.Affects user's **first name**, **last name**, **email** and **user name**. | `true or false` | `login``shares``encryption` | | `rejectKeyboardPatterns` | Determines whether a password must **NOT** contain keyboard patterns.e.g. `qwertz`, `asdf` (min. 4 character pattern) | `true or false` | `login``shares``encryption` | | `numberOfArchivedPasswords` | Number of passwords to archive.Value `0` means that password history is disabled. | `Integer between 0 and 10` | `login` | | `passwordExpiration.enabled` | Determines whether password expiration is enabled. | `true or false` | `login` | | `maxPasswordAge` | Maximum allowed password age (in **days**) | `positive Integer` | `login` | | `userLockout.enabled` | Determines whether user lockout is enabled. | `true or false` | `login` | | `maxNumberOfLoginFailures` | Maximum allowed number of failed login attempts. | `positive Integer` | `login` | | `lockoutPeriod` | Amount of **minutes** a user has to wait to make another login attemptafter `maxNumberOfLoginFailures` has been exceeded. | `positive Integer` | `login` |

Request password policies for a certain password type ### Description: Retrieve a list of configured password policies for a certain password type: * `login` * `shares` * `encryption` ### Precondition: Right 🔓 read global config and role 👤 Config Manager of the Provider Customer required. ### Postcondition: List of configured password policies is returned. ### Further Information: None. ### Available password policies: Expand | Name | Description | Value | Password Type | | :--- | :--- | :--- | :--- | | `mustContainCharacters` | Characters which a password must contain:`alpha` - at least one alphabetical character (`uppercase` **OR** `lowercase`)a b c d e f g h i j k l m n o p q r s t u v w x y zA B C D E F G H I J K L M N O P Q R S T U V W X Y Z`uppercase` - at least one uppercase characterA B C D E F G H I J K L M N O P Q R S T U V W X Y Z`lowercase` - at least one lowercase charactera b c d e f g h i j k l m n o p q r s t u v w x y z`numeric` - at least one numeric character0 1 2 3 4 5 6 7 8 9`special` - at least one special character (letters and digits excluded)! " # $ % ( ) * + , - . / : ; = ? @ [ \ ] ^ _ { | } ~`none` - none of the above | `alpha``uppercase``lowercase``numeric``special``none` | `login``shares``encryption` | | `numberOfCharacteristicsToEnforce` | Number of characteristics to enforce.e.g. from `["uppercase", "lowercase", "numeric", "special"]`all 4 character sets can be enforced; but also only 2 of them | `Integer between 0 and 4` | `login``shares``encryption` | | `minLength` | Minimum number of characters a password must contain. | `login`: `Integer between 1 and 1024``shares`: `Integer between 1 and 72``encryption`: `Integer between 1 and 1024` | `login``shares``encryption` | | `rejectDictionaryWords` | Determines whether a password must **NOT** contain word(s) from a dictionary.In `core-service.properties` a path to directory with dictionary files (`*.txt`) can be definedcf. `policies.passwords.dictionary.directory`.If this rule gets enabled `policies.passwords.dictionary.directory` must be defined and contain dictionary files.Otherwise, the rule will not have any effect on password validation process. | `true or false` | `login``shares` | | `rejectUserInfo` | Determines whether a password must **NOT** contain user info.Affects user's **first name**, **last name**, **email** and **user name**. | `true or false` | `login``shares``encryption` | | `rejectKeyboardPatterns` | Determines whether a password must **NOT** contain keyboard patterns.e.g. `qwertz`, `asdf` (min. 4 character pattern) | `true or false` | `login``shares``encryption` | | `numberOfArchivedPasswords` | Number of passwords to archive.Value `0` means that password history is disabled. | `Integer between 0 and 10` | `login` | | `passwordExpiration.enabled` | Determines whether password expiration is enabled. | `true or false` | `login` | | `maxPasswordAge` | Maximum allowed password age (in **days**) | `positive Integer` | `login` | | `userLockout.enabled` | Determines whether user lockout is enabled. | `true or false` | `login` | | `maxNumberOfLoginFailures` | Maximum allowed number of failed login attempts. | `positive Integer` | `login` | | `lockoutPeriod` | Amount of **minutes** a user has to wait to make another login attemptafter `maxNumberOfLoginFailures` has been exceeded. | `positive Integer` | `login` |

Request password reset ### Description: Request an email with a password reset token for a certain user to reset password. ### Precondition: Registered user account. ### Postcondition: Provided user receives email with password reset token. ### Further Information: None.

Request user-room assignments per group ### Description: Requests a list of user-room assignments by groups that have **NOT** been approved yet These can have the state: * **WAITING** * **DENIED** * **ACCEPTED** **ACCEPTED** assignments are already removed from the list. ### Precondition: None. ### Postcondition: List of user-room assignments is returned. ### Further Information: Room administrators **SHOULD** regularly request pending assingments to provide access to rooms for other users. ### Filtering: All filter fields are connected via logical conjunction (**AND**) Filter string syntax: `FIELD_NAME:OPERATOR:VALUE` Example `state:eq:WAITING` Filter assignments by state `WAITING`. ### Filtering options: Expand | `FIELD_NAME` | Filter Description | `OPERATOR` | Operator Description | `VALUE` | | :--- | :--- | :--- | :--- | :--- | | `userId` | User ID filter | `eq` | User ID equals value. | `positive Integer` | | `groupId` | Group ID filter | `eq` | Group ID equals value. | `positive Integer` | | `roomId` | Room ID filter | `eq` | Room ID equals value. | `positive Integer` | | `state` | Assignment state | `eq` | Assignment state equals value. | `WAITING or DENIED` | --- ### Sorting: Sort string syntax: `FIELD_NAME:ORDER` `ORDER` can be `asc` or `desc`. Multiple sort criteria are possible. Fields are connected via logical conjunction **AND**. Example `userId:desc|state:asc` Sort by `userId` descending **AND** `state` ascending. ### Sorting options: Expand | `FIELD_NAME` | Description | | :--- | :--- | | `userId` | User ID | | `groupId` | Group ID | | `roomId` | Room ID | | `state` | State |

Request list of product packages ### Description: Returns a list of product packages. ### Precondition: Authenticated user ### Postcondition: List of Product Packages is returned. ### Further Information:

Request user profile attributes ### Description: Retrieve a list of user profile attributes. ### Precondition: None. ### Postcondition: List of attributes is returned. ### Further Information: ### Filtering: All filter fields are connected via logical conjunction (**AND**) Filter string syntax: `FIELD_NAME:OPERATOR:VALUE[:VALUE...]` Example `key:cn:searchString_1|value:cn:searchString_2` Filter by attribute key contains `searchString_1` **AND** attribute value contains `searchString_2`. ### Filtering options: Expand | `FIELD_NAME` | Filter Description | `OPERATOR` | Operator Description | `VALUE` | | :--- | :--- | :--- | :--- | :--- | | `key` | User profile attribute key filter | `cn, eq, sw` | Attribute key contains / equals / starts with value. | `search String` | | `value` | User profile attribute value filter | `cn, eq, sw` | Attribute value contains / equals / starts with value. | `search String` | --- ### Sorting: Sort string syntax: `FIELD_NAME:ORDER` `ORDER` can be `asc` or `desc`. Multiple sort fields are supported. Example `key:asc|value:desc` Sort by `key` ascending **AND** by `value` descending. ### Sorting options: Expand | `FIELD_NAME` | Description | | :--- | :--- | | `key` | User profile attribute key | | `value` | User profile attribute value |

Request public Download Share information ### Description: Retrieve the public information of a Download Share. ### Precondition: None. ### Postcondition: Download Share information is returned. ### Further Information: None.

Request public Upload Share information ### Description: Provides information about the desired Upload Share. ### Precondition: Only `userUserPublicKeyList` is returned to the users who owns one of the following permissions: 🔓 manage, 🔓 read, 🔓 manage download share, 🔓 manage upload share ### Postcondition: None. ### Further Information: If no password is set, the returned information is reduced to the following attributes (if available): * `name` * `createdAt` * `isProtected` * `isEncrypted` * `showUploadedFiles` * `userUserPublicKeyList` (if parent is end-to-end encrypted) Only if the password is transmitted as `X-Sds-Share-Password` header, all values are returned.

Request groups with specific role ### Description: Get all groups with a specific role. ### Precondition: Right 🔓 read groups required. ### Postcondition: List of to the role assigned groups is returned. ### Further Information: ### Filtering: All filter fields are connected via logical conjunction (**AND**) Filter string syntax: `FIELD_NAME:OPERATOR:VALUE` Example `isMember:eq:false|name:cn:searchString` Get all groups that are **NOT** a member of that role **AND** whose name contains `searchString`. ### Filtering options: Expand | `FIELD_NAME` | Filter Description | `OPERATOR` | Operator Description | `VALUE` | | :--- | :--- | :--- | :--- | :--- | | `isMember` | Filter the groups which are (not) member of that role | `eq` | | `true``false``any`default: `true` | | `name` | Group name filter | `cn` | Group name contains value. | `search String` |

Request users with specific role ### Description: Get all users with a specific role. ### Precondition: Right 🔓 read users required. ### Postcondition: List of users is returned. ### Further Information: ### Filtering: All filter fields are connected via logical conjunction (**AND**) Filter string syntax: `FIELD_NAME:OPERATOR:VALUE` Example `isMember:eq:false|user:cn:searchString` Get all users that are **NOT** member of that role **AND** whose (`firstName` **OR** `lastName` **OR** `email` **OR** `username`) is like `searchString`. ### Filtering options: Expand | `FIELD_NAME` | Filter Description | `OPERATOR` | Operator Description | `VALUE` | | :--- | :--- | :--- | :--- | :--- | | `user` | User filter | `cn` | User contains value (`firstName` **OR** `lastName` **OR** `email` **OR** `username`). | `search String` | | `isMember` | Filter the users which are (not) member of that role | `eq` | | `true``false``any`default: `true` | ### Deprecated filtering options: Expand | `FIELD_NAME` | Filter Description | `OPERATOR` | Operator Description | `VALUE` | | :--- | :--- | :--- | :--- | :--- | | `displayName` | User display name filter (use `user` filter) | `cn` | User display name contains value (`firstName` **OR** `lastName` **OR** `email`). | `search String` |

Request all roles with assigned rights ### Description: Retrieve a list of all roles with assigned rights. ### Precondition: Right 🔓 read users required. ### Postcondition: List of roles with assigned rights is returned. ### Further Information: None.

Request events of a room ### Description: Retrieve syslog (audit log) events related to a room. ### Precondition: Requires 🔓 read permissions on that room. ### Postcondition: List of events is returned. ### Further Information: Output may be limited to a certain number of entries. Please use filter criteria and paging. Sort string syntax: `FIELD_NAME:ORDER` `ORDER` can be `asc` or `desc`. Multiple sort fields are supported. Example `time:desc` Sort by `time` descending (default sort option). ### Sorting options: Expand | `FIELD_NAME` | Description | | :--- | :--- | | `time` | Event timestamp |

Request room granted group(s) or / and group(s) that can be granted ### Description: Retrieve a list of groups that are and / or can be granted to the room. ### Precondition: Any permissions on target room. ### Postcondition: List of groups is returned. ### Further Information: ### Filtering: All filter fields are connected via logical conjunction (**AND**) Filter string syntax: `FIELD_NAME:OPERATOR:VALUE` Example `isGranted:eq:false|name:cn:searchString` Get all groups that are **NOT** granted to this room **AND** whose name is like `searchString`. ### Filtering options: Expand | `FIELD_NAME` | Filter Description | `OPERATOR` | Operator Description | `VALUE` | | :--- | :--- | :--- | :--- | :--- | | `name` | Group name filter | `cn` | Group name contains value. | `search String` | | `groupId` | Group ID filter | `eq` | Group ID equals value. | `positive Integer` | | `isGranted` | Filter the groups that have (no) access to this room.**This filter is only available for room administrators.****Other users can only look for groups in their rooms, so this filter is `true` and **CANNOT** be overridden.** | `eq` | | `true``false``any`default: `true` | | `permissionsManage` | Filter the groups that do (not) have `manage` permissions in this room. | `eq` | | `true or false` | | `effectivePerm` | Filter groups with DIRECT or DIRECT **AND** EFFECTIVE permissions`false`: DIRECT permissions`true`: DIRECT **AND** EFFECTIVE permissionsDIRECT means: e.g. room administrator grants `read` permissions to group of users **directly** on desired room.EFFECTIVE means: e.g. group of users gets `read` permissions on desired room through **inheritance**. | `eq` | | `true or false`default: `false` | --- ### Sorting: Sort string syntax: `FIELD_NAME:ORDER` `ORDER` can be `asc` or `desc`. Multiple sort criteria are possible. Fields are connected via logical conjunction **AND**. Example `name:desc` Sort by `name` descending. ### Sorting options: Expand | `FIELD_NAME` | Description | | :--- | :--- | | `name` | Group name |

Request Room Policies ### Description: Retrieve the room policies: * `defaultExpirationPeriod` * `virusProtectionEnabled` ### Precondition: User has 🔓 read permissions in that room. ### Postcondition: Room Policies returned. ### Further Information: `defaultExpirationPeriod`: Default policy room expiration period in seconds. All existing and future files in a room will have their expiration date set to this period after their respective upload. Existing files can be set to expire earlier afterwards. `0` means no default expiration policy will be enforced. `virusProtectionEnabled`: Status of room policy for virus-protection. Can be activated for unencrypted data rooms. If enabled, the files are sent to the German IT security company G DATA CyberDefense for verification.

Request room rescue key ### Description: Returns the file key for the room emergency password / rescue key of a certain file (if available). ### Precondition: User with 🔓 read permissions in parent room. ### Postcondition: File key is returned. ### Further Information: None.