Restricting a Group's Protocol Privileges
You can specify exactly which data transmission protocols a group's members are allowed to use to connect to Files.com. Controlling protocol access at the group level helps you meet security compliance regulations that apply to your business or industry.
Use the Protocol Access setting, within the group's Privileges settings, to allow or disallow the selected group's access to FTP (including FTPS and FTPES), SFTP, WebDAV, the S3-Compatible Endpoint, Web Portal, Desktop App, and the Files.com API. Site Administrators manage these settings across the site. Workspace Administrators manage them for groups in their own Workspace.
| Protocol Setting | API Attribute | Description |
|---|---|---|
| FTP | ftp_permission | Specifies whether members of the group are allowed to connect using the FTP, FTPS or FTPES protocol. |
| SFTP | sftp_permission | Specifies whether members of the group are allowed to connect using SFTP protocol. |
| WebDAV | dav_permission | Specifies whether members of the group are allowed to connect using WebDAV or WebDAVS protocol. |
| S3-Compatible Endpoint | s3_compatible_endpoint_permission | Specifies whether members of the group are allowed to connect using the S3-Compatible Endpoint. Defaults to disallowed for new groups. |
| Web, Desktop App, and API | restapi_permission | Specifies whether members of the group are allowed to connect using the Files.com web portal, the Desktop App, or via the REST APIs using the HTTPS protocol. |
To grant S3 access through a group, set S3-Compatible Endpoint to Allowed on the group's details page. This permission is independent of Web, Desktop App, and API, so the group can grant S3 access without granting those other connection methods. Members still need S3-compatible credentials and folder permissions.
Site Administrators retain access to the Web Portal, Desktop App, and Files.com API because they need these interfaces to administer the site. FTP (including FTPS and FTPES), SFTP, WebDAV, and the S3-Compatible Endpoint remain subject to protocol permissions. See Restricting a User's Protocol Privileges for how this exception affects account access.
This setting works in conjunction with the IP Whitelist setting and the Access Control by Country setting.
Group protocol permissions do not restrict another Files.com site's native Files.com Remote Server connection using a member's API key. This remains true when protocol access is managed through groups only. Applicable folder permissions and the key's scope still limit the connection.
Group Protocol Access vs User Protocol Access
By default, your site assigns protocol access through either users or groups. A user can connect with a protocol if it is enabled for their user account or if they belong to a group with the protocol enabled.
Disallowing S3 on one group removes that group's grant. Members can still connect if their user account or another group grants S3 access.
You can configure your site to manage all protocol access through groups. When you enable this setting, only users who are members of groups with a protocol enabled can use that protocol to connect. Protocol access for individual users is ignored, and only the group settings take effect.