openapi: 3.0.3
info:
  title: CrushFTP 11 Admin API
  version: 1.0.0
  description: |-
    # CrushFTP 11 Admin API

    The administrative API exposed by the CrushFTP 11 WebInterface. Every operation is a request to a single endpoint, **`/WebInterface/function/`**, with the specific operation selected by a `command` field.

    ## How requests work

    Send an HTTP POST (or GET, for the read-only commands noted as such) to `/WebInterface/function/`. The pseudo-paths in this document encode the real request: `/WebInterface/function/getUser` means `POST /WebInterface/function/` with `command=getUser`. POST parameters go in an `application/x-www-form-urlencoded` body; GET parameters go in the query string.

    ## Authentication

    Two authentication methods are supported, and either is accepted:

    * **HTTP Basic authentication** — supply an administrator `user:password`. With Basic auth the `c2f` token is **not** required.
    * **Cookie-based session** — call `login` first; the server establishes a session cookie and issues a short `c2f` anti-CSRF token. When using the cookie session, `c2f` **is** required on every subsequent call (a form field on POST, a query parameter on GET).

    ## Notes

    Response payloads vary by command and server version. The `command` field is always required; other parameters depend on the operation and the options selected for it.
  contact:
    name: CrushFTP
    url: https://www.crushftp.com
externalDocs:
  description: CrushFTP 11 API wiki page
  url: https://www.crushftp.com/crush11wiki/Wiki.jsp?page=API
servers:
- url: '{scheme}://{host}:{port}'
  description: CrushFTP server
  variables:
    scheme:
      default: https
      enum:
      - https
      - http
    host:
      default: localhost
      description: CrushFTP server hostname
    port:
      default: '443'
tags:
- name: Authentication
  description: Establish and inspect the admin WebInterface session.
- name: Server Configuration
  description: Read and write server settings, info, and lifecycle.
- name: Monitoring & Dashboard
  description: Dashboard data, statistics, sessions, and logs.
- name: User & Group Management
  description: Manage users, groups, inheritance, and their VFS.
- name: Sessions & Access Control
  description: Blocked usernames and access control.
- name: Jobs (CrushTask)
  description: Create, inspect, and trigger CrushTask jobs.
- name: Reports
  description: Run and retrieve reports.
- name: SSL & Certificates
  description: Keystores, certificate generation, and CSRs.
- name: PGP
  description: PGP key management.
- name: Plugins & Integrations
  description: Server plugins, Let's Encrypt, and database tests.
- name: File Operations
  description: Admin file browsing and transfer operations.
- name: Diagnostics
  description: Diagnostic and miscellaneous admin actions.
components:
  securitySchemes:
    basicAuth:
      type: http
      scheme: basic
      description: HTTP Basic Authentication with an administrator account. When used, the `c2f` token
        is not required.
    adminSession:
      type: apiKey
      in: cookie
      name: CrushAuth
      description: Cookie-based session established by the `login` command. The cookie name shown is the
        CrushFTP default; confirm it on your server. When used, the `c2f` token must accompany every call.
  responses:
    CommandResponse:
      description: Command response. The content type and body depend on the specific command and server
        version.
      content:
        text/plain:
          schema:
            type: string
    Unauthorized:
      description: Authentication failed, the session expired, or the c2f token is missing/invalid under
        cookie-based authentication.
      content:
        text/plain:
          schema:
            type: string
paths:
  /WebInterface/function/getSessionTimeout:
    post:
      tags:
      - Authentication
      summary: Get the session timeout / keepalive value
      operationId: getSessionTimeout
      description: 'Request: `POST /WebInterface/function/` with `command=getSessionTimeout`.'
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - getSessionTimeout
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
                random:
                  type: string
                  description: Cache-busting random value (any number).
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/getUsername:
    post:
      tags:
      - Authentication
      summary: Get the currently logged-in username
      operationId: getUsername
      description: 'Request: `POST /WebInterface/function/` with `command=getUsername`.'
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - getUsername
                random:
                  type: string
                  description: Cache-busting random value (any number).
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/login:
    post:
      tags:
      - Authentication
      summary: Log in to the admin WebInterface and start a session
      operationId: login
      description: |-
        Request: `POST /WebInterface/function/` with `command=login`.

        Bootstraps a cookie-based session and issues the `c2f` token used by subsequent cookie-authenticated calls.
      security: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - login
                username:
                  type: string
                  description: Target user login name.
                password:
                  type: string
                encoded:
                  type: string
                  description: Whether the credentials are encoded.
                language:
                  type: string
                  description: UI language code, e.g. en.
                random:
                  type: string
                  description: Cache-busting random value (any number).
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/logout:
    post:
      tags:
      - Authentication
      summary: End the admin WebInterface session
      operationId: logout
      description: 'Request: `POST /WebInterface/function/` with `command=logout`.'
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - logout
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
                random:
                  type: string
                  description: Cache-busting random value (any number).
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/adminAction:
    post:
      tags:
      - Diagnostics
      summary: Perform a server lifecycle action (start / stop server)
      operationId: adminAction
      description: |-
        Request: `POST /WebInterface/function/` with `command=adminAction`.

        Performs an admin action selected by `action`. Known values: `getUserInfo` (look up details for a session you click on, taking the session `index`), `startServer`, and `stopServer`. Note this `action=getUserInfo` is distinct from the top-level `getUserInfo` command.
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - adminAction
                action:
                  type: string
                  enum:
                  - getUserInfo
                  - startServer
                  - stopServer
                index:
                  type: string
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/system.gc:
    post:
      tags:
      - Diagnostics
      summary: Request a JVM garbage collection
      operationId: system_gc
      description: 'Request: `POST /WebInterface/function/` with `command=system.gc`.'
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - system.gc
                random:
                  type: string
                  description: Cache-busting random value (any number).
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/telnetSocket:
    post:
      tags:
      - Diagnostics
      summary: Open, read, or close a telnet-style diagnostic socket
      operationId: telnetSocket
      description: 'Request: `POST /WebInterface/function/` with `command=telnetSocket`.'
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - telnetSocket
                sub_command:
                  type: string
                  enum:
                  - connect
                  - read
                  - close
                host:
                  type: string
                port:
                  type: string
                random:
                  type: string
                  description: Cache-busting random value (any number).
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
                id:
                  type: string
                  description: Item identifier.
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/testGeoIP:
    post:
      tags:
      - Diagnostics
      summary: Test a GeoIP lookup for an IP address
      operationId: testGeoIP
      description: 'Request: `POST /WebInterface/function/` with `command=testGeoIP`.'
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - testGeoIP
                ip:
                  type: string
                  description: IP address.
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/closeFile:
    post:
      tags:
      - File Operations
      summary: Finalize an upload / transfer session
      operationId: closeFile
      description: 'Request: `POST /WebInterface/function/` with `command=closeFile`.'
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - closeFile
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
                upload_id:
                  type: string
                total_chunks:
                  type: string
                total_bytes:
                  type: string
                filePath:
                  type: string
                lastModified:
                  type: string
                random:
                  type: string
                  description: Cache-busting random value (any number).
                transfer_type:
                  type: string
                download_id:
                  type: string
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/copy_paste:
    post:
      tags:
      - File Operations
      summary: Copy items to a destination path
      operationId: copy_paste
      description: 'Request: `POST /WebInterface/function/` with `command=copy_paste`.'
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - copy_paste
                destPath:
                  type: string
                newName:
                  type: string
                names:
                  type: string
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
                random:
                  type: string
                  description: Cache-busting random value (any number).
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/cut_paste:
    post:
      tags:
      - File Operations
      summary: Move items to a destination path
      operationId: cut_paste
      description: 'Request: `POST /WebInterface/function/` with `command=cut_paste`.'
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - cut_paste
                destPath:
                  type: string
                newName:
                  type: string
                names:
                  type: string
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
                random:
                  type: string
                  description: Cache-busting random value (any number).
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/delete:
    post:
      tags:
      - File Operations
      summary: Delete files or folders
      operationId: delete
      description: 'Request: `POST /WebInterface/function/` with `command=delete`.'
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - delete
                names:
                  type: string
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
                random:
                  type: string
                  description: Cache-busting random value (any number).
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/download:
    post:
      tags:
      - File Operations
      summary: Initiate a file download
      operationId: download
      description: 'Request: `POST /WebInterface/function/` with `command=download`.'
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - download
                transfer_type:
                  type: string
                path:
                  type: string
                  description: Virtual or server file-system path.
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
                random:
                  type: string
                  description: Cache-busting random value (any number).
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/editKeywords:
    post:
      tags:
      - File Operations
      summary: Set keywords / tags on items
      operationId: editKeywords
      description: 'Request: `POST /WebInterface/function/` with `command=editKeywords`.'
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - editKeywords
                keywords:
                  type: string
                names:
                  type: string
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
                random:
                  type: string
                  description: Cache-busting random value (any number).
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/getXMLListing:
    post:
      tags:
      - File Operations
      summary: List a directory
      operationId: getXMLListing
      description: 'Request: `POST /WebInterface/function/` with `command=getXMLListing`.'
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - getXMLListing
                format:
                  type: string
                  enum:
                  - JSON
                  - JSONOBJ
                  description: Requested response format.
                path:
                  type: string
                  description: Virtual or server file-system path.
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
                random:
                  type: string
                  description: Cache-busting random value (any number).
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/isOpen:
    post:
      tags:
      - File Operations
      summary: Check whether a transfer slot is open
      operationId: isOpen
      description: 'Request: `POST /WebInterface/function/` with `command=isOpen`.'
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - isOpen
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
                transfer_type:
                  type: string
                random:
                  type: string
                  description: Cache-busting random value (any number).
                path:
                  type: string
                  description: Virtual or server file-system path.
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/makedir:
    post:
      tags:
      - File Operations
      summary: Create a directory
      operationId: makedir
      description: 'Request: `POST /WebInterface/function/` with `command=makedir`.'
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - makedir
                path:
                  type: string
                  description: Virtual or server file-system path.
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
                random:
                  type: string
                  description: Cache-busting random value (any number).
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/openFile:
    post:
      tags:
      - File Operations
      summary: Begin an upload / transfer session
      operationId: openFile
      description: 'Request: `POST /WebInterface/function/` with `command=openFile`.'
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - openFile
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
                upload_path:
                  type: string
                upload_size:
                  type: string
                upload_id:
                  type: string
                start_resume_loc:
                  type: string
                random:
                  type: string
                  description: Cache-busting random value (any number).
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/paste_status:
    post:
      tags:
      - File Operations
      summary: Get the status of a copy / move operation
      operationId: paste_status
      description: 'Request: `POST /WebInterface/function/` with `command=paste_status`.'
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - paste_status
                id:
                  type: string
                  description: Item identifier.
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
                random:
                  type: string
                  description: Cache-busting random value (any number).
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/rename:
    post:
      tags:
      - File Operations
      summary: Rename a file or folder
      operationId: rename
      description: 'Request: `POST /WebInterface/function/` with `command=rename`.'
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - rename
                path:
                  type: string
                  description: Virtual or server file-system path.
                name1:
                  type: string
                name2:
                  type: string
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
                random:
                  type: string
                  description: Cache-busting random value (any number).
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/addJob:
    post:
      tags:
      - Jobs (CrushTask)
      summary: Create a new CrushTask job
      operationId: addJob
      description: 'Request: `POST /WebInterface/function/` with `command=addJob`.'
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - addJob
                name:
                  type: string
                  description: Item name.
                data:
                  type: string
                  description: Payload document (XML) to store.
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/getJob:
    post:
      tags:
      - Jobs (CrushTask)
      summary: Get a CrushTask job definition
      operationId: getJob
      description: 'Request: `POST /WebInterface/function/` with `command=getJob`.'
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - getJob
                schedule_info:
                  type: string
                  enum:
                  - 'true'
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
                name:
                  type: string
                  description: Item name.
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/getJobsSettings:
    post:
      tags:
      - Jobs (CrushTask)
      summary: Get global CrushTask job settings
      operationId: getJobsSettings
      description: 'Request: `POST /WebInterface/function/` with `command=getJobsSettings`.'
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - getJobsSettings
                random:
                  type: string
                  description: Cache-busting random value (any number).
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/getJobsSummary:
    post:
      tags:
      - Jobs (CrushTask)
      summary: Get a summary of CrushTask jobs
      operationId: getJobsSummary
      description: 'Request: `POST /WebInterface/function/` with `command=getJobsSummary`.'
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - getJobsSummary
                start_time:
                  type: string
                  description: Start of the time window (epoch milliseconds).
                hideUserActiveSchedules:
                  type: string
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
                end_time:
                  type: string
                  description: End of the time window (epoch milliseconds).
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/removeJob:
    post:
      tags:
      - Jobs (CrushTask)
      summary: Delete a CrushTask job
      operationId: removeJob
      description: 'Request: `POST /WebInterface/function/` with `command=removeJob`.'
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - removeJob
                name:
                  type: string
                  description: Item name.
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/renameJob:
    post:
      tags:
      - Jobs (CrushTask)
      summary: Rename an existing CrushTask job
      operationId: renameJob
      description: 'Request: `POST /WebInterface/function/` with `command=renameJob`.'
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - renameJob
                priorName:
                  type: string
                  description: The current (old) name of the item being renamed.
                name:
                  type: string
                  description: Item name.
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/testJobSchedule:
    post:
      tags:
      - Jobs (CrushTask)
      summary: Run a CrushTask job now (test / trigger)
      operationId: testJobSchedule
      description: 'Request: `POST /WebInterface/function/` with `command=testJobSchedule`.'
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - testJobSchedule
                scheduleName:
                  type: string
                  description: Name of the CrushTask job.
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/getDashboardHistory:
    get:
      tags:
      - Monitoring & Dashboard
      summary: Get historical dashboard data
      operationId: getDashboardHistory
      description: 'Request: `GET /WebInterface/function/` with `command=getDashboardHistory`.'
      security:
      - basicAuth: []
      - adminSession: []
      parameters:
      - name: command
        in: query
        required: true
        schema:
          type: string
          enum:
          - getDashboardHistory
      - name: c2f
        in: query
        required: false
        schema:
          type: string
          description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only REQUIRED
            when using cookie-based session authentication after a `login` call, where it is issued by
            that login.
      - name: history_date
        in: query
        required: false
        schema:
          type: string
          description: Date filter for historical data.
      - name: history_time
        in: query
        required: false
        schema:
          type: string
          description: Time filter for historical data.
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/getDashboardItems:
    get:
      tags:
      - Monitoring & Dashboard
      summary: Get current dashboard items
      operationId: getDashboardItems
      description: 'Request: `GET /WebInterface/function/` with `command=getDashboardItems`.'
      security:
      - basicAuth: []
      - adminSession: []
      parameters:
      - name: command
        in: query
        required: true
        schema:
          type: string
          enum:
          - getDashboardItems
      - name: c2f
        in: query
        required: false
        schema:
          type: string
          description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only REQUIRED
            when using cookie-based session authentication after a `login` call, where it is issued by
            that login.
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/getDataFlowItems:
    get:
      tags:
      - Monitoring & Dashboard
      summary: Get data-flow items
      operationId: getDataFlowItems
      description: 'Request: `GET /WebInterface/function/` with `command=getDataFlowItems`.'
      security:
      - basicAuth: []
      - adminSession: []
      parameters:
      - name: command
        in: query
        required: true
        schema:
          type: string
          enum:
          - getDataFlowItems
      - name: c2f
        in: query
        required: false
        schema:
          type: string
          description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only REQUIRED
            when using cookie-based session authentication after a `login` call, where it is issued by
            that login.
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/getJobsSummaryDashboard:
    get:
      tags:
      - Monitoring & Dashboard
      summary: Get the jobs summary shown on the dashboard
      operationId: getJobsSummaryDashboard
      description: 'Request: `GET /WebInterface/function/` with `command=getJobsSummaryDashboard`.'
      security:
      - basicAuth: []
      - adminSession: []
      parameters:
      - name: command
        in: query
        required: true
        schema:
          type: string
          enum:
          - getJobsSummaryDashboard
      - name: c2f
        in: query
        required: false
        schema:
          type: string
          description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only REQUIRED
            when using cookie-based session authentication after a `login` call, where it is issued by
            that login.
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/getLog:
    get:
      tags:
      - Monitoring & Dashboard
      summary: Read a segment of a log file
      operationId: getLog
      description: 'Request: `GET /WebInterface/function/` with `command=getLog`.'
      security:
      - basicAuth: []
      - adminSession: []
      parameters:
      - name: command
        in: query
        required: true
        schema:
          type: string
          enum:
          - getLog
      - name: segment_start
        in: query
        required: false
        schema:
          type: string
          description: Starting offset within the log file.
      - name: segment_len
        in: query
        required: false
        schema:
          type: string
          description: Number of segments/lines to read.
      - name: log_file
        in: query
        required: false
        schema:
          type: string
          description: Path of the log file to read.
      - name: c2f
        in: query
        required: false
        schema:
          type: string
          description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only REQUIRED
            when using cookie-based session authentication after a `login` call, where it is issued by
            that login.
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/getSessionList:
    get:
      tags:
      - Monitoring & Dashboard
      summary: List active or recent user sessions
      operationId: getSessionList
      description: 'Request: `GET /WebInterface/function/` with `command=getSessionList`.'
      security:
      - basicAuth: []
      - adminSession: []
      parameters:
      - name: command
        in: query
        required: true
        schema:
          type: string
          enum:
          - getSessionList
      - name: session_list
        in: query
        required: false
        schema:
          type: string
          enum:
          - user_list
          - recent_user_list
      - name: c2f
        in: query
        required: false
        schema:
          type: string
          description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only REQUIRED
            when using cookie-based session authentication after a `login` call, where it is issued by
            that login.
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/getStatHistory:
    get:
      tags:
      - Monitoring & Dashboard
      summary: Get historical server statistics
      operationId: getStatHistory
      description: 'Request: `GET /WebInterface/function/` with `command=getStatHistory`.'
      security:
      - basicAuth: []
      - adminSession: []
      parameters:
      - name: command
        in: query
        required: true
        schema:
          type: string
          enum:
          - getStatHistory
      - name: params
        in: query
        required: false
        schema:
          type: string
      - name: priorIntervals
        in: query
        required: false
        schema:
          type: string
      - name: c2f
        in: query
        required: false
        schema:
          type: string
          description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only REQUIRED
            when using cookie-based session authentication after a `login` call, where it is issued by
            that login.
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/addPGP:
    post:
      tags:
      - PGP
      summary: Generate or add a PGP key
      operationId: addPGP
      description: 'Request: `POST /WebInterface/function/` with `command=addPGP`.'
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - addPGP
                pgpCommonNameGenerate:
                  type: string
                pgpKeyDaysGenerate:
                  type: string
                pgpKeySizeGenerate:
                  type: string
                encryption_cypher:
                  type: string
                fingerprint:
                  type: string
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/changePGPPassword:
    post:
      tags:
      - PGP
      summary: Change the PGP keystore password
      operationId: changePGPPassword
      description: 'Request: `POST /WebInterface/function/` with `command=changePGPPassword`.'
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - changePGPPassword
                pgp_keystore_pass:
                  type: string
                pgp_keystore_url:
                  type: string
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/exportPGP:
    post:
      tags:
      - PGP
      summary: Export a PGP key
      operationId: exportPGP
      description: 'Request: `POST /WebInterface/function/` with `command=exportPGP`.'
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - exportPGP
                id:
                  type: string
                  description: Item identifier.
                random:
                  type: string
                  description: Cache-busting random value (any number).
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
                private:
                  type: string
                key_password:
                  type: string
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/getPGP:
    post:
      tags:
      - PGP
      summary: List PGP keys
      operationId: getPGP
      description: 'Request: `POST /WebInterface/function/` with `command=getPGP`.'
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - getPGP
                random:
                  type: string
                  description: Cache-busting random value (any number).
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/removePGP:
    post:
      tags:
      - PGP
      summary: Remove a PGP key
      operationId: removePGP
      description: 'Request: `POST /WebInterface/function/` with `command=removePGP`.'
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - removePGP
                id:
                  type: string
                  description: Item identifier.
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/renamePGP:
    post:
      tags:
      - PGP
      summary: Rename a PGP key
      operationId: renamePGP
      description: 'Request: `POST /WebInterface/function/` with `command=renamePGP`.'
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - renamePGP
                id:
                  type: string
                  description: Item identifier.
                new_name:
                  type: string
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/letsencrypt:
    post:
      tags:
      - Plugins & Integrations
      summary: Run a Let's Encrypt plugin action
      operationId: letsencrypt
      description: 'Request: `POST /WebInterface/function/` with `command=letsencrypt`.'
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - letsencrypt
                action:
                  type: string
                  enum:
                  - fetch_certs
                pluginsList:
                  type: string
                acme_host:
                  type: string
                acme_staging_host:
                  type: string
                plugin_instance:
                  type: string
                request_version:
                  type: string
                challenge_type:
                  type: string
                tls_alpn_https_port:
                  type: string
                challenge_http_port:
                  type: string
                run_plugin_dns_challenge:
                  type: string
                plugin_notes:
                  type: string
                domains:
                  type: string
                keystore_path:
                  type: string
                  description: Path to the Java keystore file.
                keystore_pass:
                  type: string
                  description: Keystore password.
                key_pass:
                  type: string
                  description: Private key password.
                commonName:
                  type: string
                organisationUnit:
                  type: string
                locality:
                  type: string
                state:
                  type: string
                countryCode:
                  type: string
                email:
                  type: string
                auto_update_run_before_days:
                  type: string
                auto_update_run_check_days:
                  type: string
                run_plugin_after_renew:
                  type: string
                enabled:
                  type: string
                debug:
                  type: string
                ignore_not_crushftp:
                  type: string
                ignore_all_checks:
                  type: string
                replicate:
                  type: string
                auto_update:
                  type: string
                staging:
                  type: string
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/pluginMethodCall:
    post:
      tags:
      - Plugins & Integrations
      summary: Invoke a method on a server plugin
      operationId: pluginMethodCall
      description: 'Request: `POST /WebInterface/function/` with `command=pluginMethodCall`.'
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - pluginMethodCall
                method:
                  type: string
                pluginName:
                  type: string
                pluginSubItem:
                  type: string
                username:
                  type: string
                  description: Target user login name.
                password:
                  type: string
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/testDB:
    post:
      tags:
      - Plugins & Integrations
      summary: Test a database connection
      operationId: testDB
      description: 'Request: `POST /WebInterface/function/` with `command=testDB`.'
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - testDB
                db_driver_file:
                  type: string
                db_driver:
                  type: string
                db_url:
                  type: string
                db_user:
                  type: string
                db_pass:
                  type: string
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/testSMTP:
    post:
      tags:
      - Plugins & Integrations
      summary: Send a test email to verify SMTP settings
      operationId: testSMTP
      description: 'Request: `POST /WebInterface/function/` with `command=testSMTP`.'
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - testSMTP
                to:
                  type: string
                  description: Recipient email address.
                cc:
                  type: string
                  description: Carbon-copy recipients.
                bcc:
                  type: string
                  description: Blind carbon-copy recipients.
                from:
                  type: string
                  description: Sender email address.
                subject:
                  type: string
                  description: Email subject.
                body:
                  type: string
                  description: Email body.
                server:
                  type: string
                  description: SMTP server host.
                user:
                  type: string
                  description: User definition XML document.
                pass:
                  type: string
                ssl:
                  type: string
                  description: Whether to use SSL/TLS for the SMTP connection.
                html:
                  type: string
                  description: Whether the email body is HTML.
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/getReportAsync:
    get:
      tags:
      - Reports
      summary: Poll for the result of an asynchronous report
      operationId: getReportAsync
      description: 'Request: `GET /WebInterface/function/` with `command=getReportAsync`.'
      security:
      - basicAuth: []
      - adminSession: []
      parameters:
      - name: command
        in: query
        required: true
        schema:
          type: string
          enum:
          - getReportAsync
      - name: id
        in: query
        required: false
        schema:
          type: string
          description: Item identifier.
      - name: c2f
        in: query
        required: false
        schema:
          type: string
          description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only REQUIRED
            when using cookie-based session authentication after a `login` call, where it is issued by
            that login.
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/runReport:
    get:
      tags:
      - Reports
      summary: Run a report
      operationId: runReport
      description: 'Request: `GET /WebInterface/function/` with `command=runReport`.'
      security:
      - basicAuth: []
      - adminSession: []
      parameters:
      - name: command
        in: query
        required: true
        schema:
          type: string
          enum:
          - runReport
      - name: report_async
        in: query
        required: false
        schema:
          type: string
      - name: reportName
        in: query
        required: false
        schema:
          type: string
      - name: export
        in: query
        required: false
        schema:
          type: string
      - name: startDate
        in: query
        required: false
        schema:
          type: string
      - name: endDate
        in: query
        required: false
        schema:
          type: string
      - name: usernames
        in: query
        required: false
        schema:
          type: string
          description: Semicolon-separated list of usernames, e.g. user1;user2.
      - name: reverseDNS
        in: query
        required: false
        schema:
          type: string
      - name: c2f
        in: query
        required: false
        schema:
          type: string
          description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only REQUIRED
            when using cookie-based session authentication after a `login` call, where it is issued by
            that login.
      - name: downloadCount
        in: query
        required: false
        schema:
          type: string
      - name: uploadCount
        in: query
        required: false
        schema:
          type: string
      - name: showPaths
        in: query
        required: false
        schema:
          type: string
      - name: showURLs
        in: query
        required: false
        schema:
          type: string
      - name: showFormInfo
        in: query
        required: false
        schema:
          type: string
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/generateCSR:
    post:
      tags:
      - SSL & Certificates
      summary: Generate a certificate signing request (CSR)
      operationId: generateCSR
      description: 'Request: `POST /WebInterface/function/` with `command=generateCSR`.'
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - generateCSR
                keystore_path:
                  type: string
                  description: Path to the Java keystore file.
                key_pass:
                  type: string
                  description: Private key password.
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/generateSsl:
    post:
      tags:
      - SSL & Certificates
      summary: Generate a self-signed SSL key pair / certificate
      operationId: generateSsl
      description: 'Request: `POST /WebInterface/function/` with `command=generateSsl`.'
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - generateSsl
                key_alg:
                  type: string
                key_size:
                  type: string
                sig_alg:
                  type: string
                days:
                  type: string
                cn:
                  type: string
                sans:
                  type: string
                ou:
                  type: string
                o:
                  type: string
                l:
                  type: string
                st:
                  type: string
                c:
                  type: string
                e:
                  type: string
                key_pass:
                  type: string
                  description: Private key password.
                keystore_path:
                  type: string
                  description: Path to the Java keystore file.
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/importReply:
    post:
      tags:
      - SSL & Certificates
      summary: Import a CA reply into a keystore
      operationId: importReply
      description: 'Request: `POST /WebInterface/function/` with `command=importReply`.'
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - importReply
                keystore_path:
                  type: string
                  description: Path to the Java keystore file.
                key_pass:
                  type: string
                  description: Private key password.
                import_path:
                  type: string
                trusted_paths:
                  type: string
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/listSSL:
    post:
      tags:
      - SSL & Certificates
      summary: List certificates inside a keystore
      operationId: listSSL
      description: 'Request: `POST /WebInterface/function/` with `command=listSSL`.'
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - listSSL
                keystore_path:
                  type: string
                  description: Path to the Java keystore file.
                keystore_pass:
                  type: string
                  description: Keystore password.
                random:
                  type: string
                  description: Cache-busting random value (any number).
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/testKeystore:
    post:
      tags:
      - SSL & Certificates
      summary: Test a keystore's passwords
      operationId: testKeystore
      description: 'Request: `POST /WebInterface/function/` with `command=testKeystore`.'
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - testKeystore
                keystorePath:
                  type: string
                keystorePass:
                  type: string
                keyPass:
                  type: string
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/checkForUpdate:
    post:
      tags:
      - Server Configuration
      summary: Check whether a CrushFTP update is available
      operationId: checkForUpdate
      description: 'Request: `POST /WebInterface/function/` with `command=checkForUpdate`.'
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - checkForUpdate
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/encryptPassword:
    post:
      tags:
      - Server Configuration
      summary: Encrypt a password using a server cipher
      operationId: encryptPassword
      description: |-
        Request: `POST /WebInterface/function/` with `command=encryptPassword`.

        Encrypts a password using the cipher selected by `encrypt_type`.
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - encryptPassword
                encrypt_type:
                  type: string
                  enum:
                  - DES
                password:
                  type: string
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/getCustomForm:
    post:
      tags:
      - Server Configuration
      summary: Retrieve a custom form definition
      operationId: getCustomForm
      description: 'Request: `POST /WebInterface/function/` with `command=getCustomForm`.'
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - getCustomForm
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
                form:
                  type: string
                random:
                  type: string
                  description: Cache-busting random value (any number).
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/getServerInfoItems:
    post:
      tags:
      - Server Configuration
      summary: Read multiple server info values by key
      operationId: getServerInfoItems
      description: 'Request: `POST /WebInterface/function/` with `command=getServerInfoItems`.'
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - getServerInfoItems
                keys:
                  type: string
                  description: Comma-separated list of keys to read.
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/getServerItem:
    post:
      tags:
      - Server Configuration
      summary: Read a server configuration item by key path
      operationId: getServerItem
      description: 'Request: `POST /WebInterface/function/` with `command=getServerItem`.'
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - getServerItem
                key:
                  type: string
                  description: Configuration key path (e.g. server_settings/server_prefs/).
                random:
                  type: string
                  description: Cache-busting random value (any number).
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
                defaults:
                  type: string
                  enum:
                  - 'true'
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/getServerRoots:
    post:
      tags:
      - Server Configuration
      summary: Get the server's root paths
      operationId: getServerRoots
      description: 'Request: `POST /WebInterface/function/` with `command=getServerRoots`.'
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - getServerRoots
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/getServerSettingItems:
    post:
      tags:
      - Server Configuration
      summary: Read multiple server setting values by key
      operationId: getServerSettingItems
      description: 'Request: `POST /WebInterface/function/` with `command=getServerSettingItems`.'
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - getServerSettingItems
                keys:
                  type: string
                  description: Comma-separated list of keys to read.
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/restartProcess:
    post:
      tags:
      - Server Configuration
      summary: Restart the CrushFTP server process
      operationId: restartProcess
      description: |-
        Request: `POST /WebInterface/function/` with `command=restartProcess`.

        Restarts the CrushFTP server process; active connections are dropped.
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - restartProcess
                random:
                  type: string
                  description: Cache-busting random value (any number).
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/setServerItem:
    post:
      tags:
      - Server Configuration
      summary: Write a server configuration item by key path
      operationId: setServerItem
      description: 'Request: `POST /WebInterface/function/` with `command=setServerItem`.'
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - setServerItem
                key:
                  type: string
                  description: Configuration key path (e.g. server_settings/server_prefs/).
                data_type:
                  type: string
                  enum:
                  - properties
                  - vector
                  description: Type of the data document being written.
                data_action:
                  type: string
                  enum:
                  - update
                  - reset
                  description: Operation to perform.
                data:
                  type: string
                  description: Payload document (XML) to store.
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/updateNow:
    post:
      tags:
      - Server Configuration
      summary: Trigger a CrushFTP software update
      operationId: updateNow
      description: 'Request: `POST /WebInterface/function/` with `command=updateNow`.'
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - updateNow
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/updateNowProgress:
    post:
      tags:
      - Server Configuration
      summary: Poll the progress of an in-flight software update
      operationId: updateNowProgress
      description: 'Request: `POST /WebInterface/function/` with `command=updateNowProgress`.'
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - updateNowProgress
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/getBlockedUsernames:
    get:
      tags:
      - Sessions & Access Control
      summary: List currently blocked usernames
      operationId: getBlockedUsernames
      description: 'Request: `GET /WebInterface/function/` with `command=getBlockedUsernames`.'
      security:
      - basicAuth: []
      - adminSession: []
      parameters:
      - name: command
        in: query
        required: true
        schema:
          type: string
          enum:
          - getBlockedUsernames
      - name: c2f
        in: query
        required: false
        schema:
          type: string
          description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only REQUIRED
            when using cookie-based session authentication after a `login` call, where it is issued by
            that login.
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/unblockUsername:
    post:
      tags:
      - Sessions & Access Control
      summary: Unblock a blocked username
      operationId: unblockUsername
      description: 'Request: `POST /WebInterface/function/` with `command=unblockUsername`.'
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - unblockUsername
                username:
                  type: string
                  description: Target user login name.
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/convertXMLSQLUsers:
    post:
      tags:
      - User & Group Management
      summary: Convert the user store between XML and SQL modes
      operationId: convertXMLSQLUsers
      description: 'Request: `POST /WebInterface/function/` with `command=convertXMLSQLUsers`.'
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - convertXMLSQLUsers
                serverGroup:
                  type: string
                  description: User connection group (on-disk users folder), e.g. MainUsers.
                fromMode:
                  type: string
                  enum:
                  - XML
                  - SQL
                toMode:
                  type: string
                  enum:
                  - XML
                  - SQL
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/getAdminXMLListing:
    post:
      tags:
      - User & Group Management
      summary: List VFS items for admin server/user browsing
      operationId: getAdminXMLListing
      description: 'Request: `POST /WebInterface/function/` with `command=getAdminXMLListing`.'
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - getAdminXMLListing
                format:
                  type: string
                  enum:
                  - JSON
                  description: Requested response format.
                file_mode:
                  type: string
                  enum:
                  - server
                  - user
                path:
                  type: string
                  description: Virtual or server file-system path.
                random:
                  type: string
                  description: Cache-busting random value (any number).
                serverGroup:
                  type: string
                  description: User connection group (on-disk users folder), e.g. MainUsers.
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/getTempAccounts:
    post:
      tags:
      - User & Group Management
      summary: List temporary accounts
      operationId: getTempAccounts
      description: 'Request: `POST /WebInterface/function/` with `command=getTempAccounts`.'
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - getTempAccounts
                random:
                  type: string
                  description: Cache-busting random value (any number).
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/getUser:
    post:
      tags:
      - User & Group Management
      summary: Get a user account definition
      operationId: getUser
      description: 'Request: `POST /WebInterface/function/` with `command=getUser`.'
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - getUser
                serverGroup:
                  type: string
                  description: User connection group (on-disk users folder), e.g. MainUsers.
                username:
                  type: string
                  description: Target user login name.
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/getUserInfo:
    post:
      tags:
      - User & Group Management
      summary: Get info about the current logged-in user
      operationId: getUserInfo
      description: |-
        Request: `POST /WebInterface/function/` with `command=getUserInfo`.

        Called by the end-user WebInterface to learn about the currently logged-in user. It returns information for the UI to display, including applicable rules and session timeouts. This is not an administrative management call.
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - getUserInfo
                path:
                  type: string
                  description: Virtual or server file-system path.
                random:
                  type: string
                  description: Cache-busting random value (any number).
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/getUserList:
    post:
      tags:
      - User & Group Management
      summary: List usernames within a user group
      operationId: getUserList
      description: 'Request: `POST /WebInterface/function/` with `command=getUserList`.'
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - getUserList
                serverGroup:
                  type: string
                  description: User connection group (on-disk users folder), e.g. MainUsers.
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/getUserVersions:
    post:
      tags:
      - User & Group Management
      summary: Get file version history for a user
      operationId: getUserVersions
      description: 'Request: `POST /WebInterface/function/` with `command=getUserVersions`.'
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - getUserVersions
                username:
                  type: string
                  description: Target user login name.
                serverGroup:
                  type: string
                  description: User connection group (on-disk users folder), e.g. MainUsers.
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/getUserXML:
    post:
      tags:
      - User & Group Management
      summary: Get group or inheritance XML for a user group
      operationId: getUserXML
      description: 'Request: `POST /WebInterface/function/` with `command=getUserXML`.'
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - getUserXML
                serverGroup:
                  type: string
                  description: User connection group (on-disk users folder), e.g. MainUsers.
                xmlItem:
                  type: string
                  enum:
                  - group
                  - inheritance
                  description: The kind of item being addressed.
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/getUserXMLListing:
    post:
      tags:
      - User & Group Management
      summary: List VFS items for a specific user
      operationId: getUserXMLListing
      description: 'Request: `POST /WebInterface/function/` with `command=getUserXMLListing`.'
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - getUserXMLListing
                format:
                  type: string
                  enum:
                  - JSON
                  description: Requested response format.
                file_mode:
                  type: string
                  enum:
                  - user
                path:
                  type: string
                  description: Virtual or server file-system path.
                random:
                  type: string
                  description: Cache-busting random value (any number).
                serverGroup:
                  type: string
                  description: User connection group (on-disk users folder), e.g. MainUsers.
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
                username:
                  type: string
                  description: Target user login name.
                permissions:
                  type: string
                  description: Permissions XML document.
                vfs_items:
                  type: string
                  description: VFS items XML document.
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /WebInterface/function/setUserItem:
    post:
      tags:
      - User & Group Management
      summary: Create, update, replace, or delete a user, group, or inheritance item
      operationId: setUserItem
      description: |-
        Request: `POST /WebInterface/function/` with `command=setUserItem`.

        Behavior is selected by `xmlItem` (`user`, `groups`, `inheritance`) and `data_action` (`new`, `replace`, `update`, `delete`). For `xmlItem=user`, `replace` sends the full `user`, `vfs_items`, and `permissions` documents; `update` sends only changed fields; `delete` removes the user. For `xmlItem=groups`/`inheritance`, `usernames` lists the members to add or remove.
      security:
      - basicAuth: []
      - adminSession: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - command
              properties:
                command:
                  type: string
                  enum:
                  - setUserItem
                data_action:
                  type: string
                  enum:
                  - new
                  - replace
                  - update
                  - delete
                  description: Operation to perform.
                serverGroup:
                  type: string
                  description: User connection group (on-disk users folder), e.g. MainUsers.
                username:
                  type: string
                  description: Target user login name.
                user:
                  type: string
                  description: User definition XML document.
                xmlItem:
                  type: string
                  enum:
                  - user
                  - groups
                  - inheritance
                  description: The kind of item being addressed.
                vfs_items:
                  type: string
                  description: VFS items XML document.
                permissions:
                  type: string
                  description: Permissions XML document.
                c2f:
                  type: string
                  description: Anti-CSRF token. OPTIONAL when authenticating with HTTP Basic auth. Only
                    REQUIRED when using cookie-based session authentication after a `login` call, where
                    it is issued by that login.
                groups:
                  type: string
                inheritance:
                  type: string
                usernames:
                  type: string
                  description: Semicolon-separated list of usernames, e.g. user1;user2.
      responses:
        '200':
          $ref: '#/components/responses/CommandResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
