Each user can be restricted to a specific set of data transmission protocols for connecting to Files.com. Controlling which protocols a user account can use helps you meet the security compliance regulations that apply to your business or industry.

Use the Protocol Access setting on the user account's Connections tab to allow or disallow access to FTP (including FTPS and FTPES), SFTP, WebDAV, the S3-Compatible Endpoint, Web Portal, Desktop App, and the Files.com API. Site Administrators manage protocol access across the site. Workspace Administrators manage it for users in their own Workspace, under the site's protocol assignment policy.

Protocol Setting	API Attribute	Description
FTP	`ftp_permission`	Specifies whether the user account is allowed to connect using the FTP, FTPS or FTPES protocol.
SFTP	`sftp_permission`	Specifies whether the user account is allowed to connect using SFTP protocol.
WebDAV	`dav_permission`	Specifies whether the user account is allowed to connect using WebDAV or WebDAVS protocol.
S3-Compatible Endpoint	`s3_compatible_endpoint_permission`	Specifies whether the user account is allowed to connect using the S3-Compatible Endpoint. Defaults to allowed for new users.
Web, Desktop App, and API	`restapi_permission`	Specifies whether the user account is allowed to connect using the Files.com web portal, the Desktop App, or via the REST APIs using the HTTPS protocol.

S3 access is independent of the combined Web, Desktop App, and API permission. An S3-only service account can have S3 allowed while other protocols are disallowed. Disabling Web, Desktop App, and API access does not block S3 connections, and changing S3 access does not change the other protocol permissions. S3 connections still require an S3-compatible API key and appropriate folder permissions.

When individual protocol grants are allowed, Site Administrators and Workspace Administrators can select the connection methods above when creating or cloning a user, as well as change them later. Workspace Administrators are limited to users in their own Workspace. Allowing all supported protocols includes S3.

Cloning supplies the source user's individual protocol selections as a starting point. Review them against the new account's work and Group membership: an employee using the web interface and a service account exchanging files over SFTP may need different connection methods.

Site Administrator authority includes access to the Web Portal and API used to administer the site. The combined Web, Desktop App, and API permission therefore cannot be disabled for Site Administrators through user or group protocol settings.

Use a non-administrator account when access must be limited to explicitly allowed protocols. FTP (including FTPS and FTPES), SFTP, WebDAV, and the S3-Compatible Endpoint can still be disallowed for Site Administrators.

This setting works in conjunction with the user's IP Whitelist setting and the user's Access Control by Country setting.

User and group protocol permissions do not apply when another Files.com site uses the user's API key for a native Files.com Remote Server. Disallowing Web, Desktop App, and API does not stop that connection. Revoke its key, disable the owning user, or disable native Remote Server access on the site to end that access.

Group Protocol Access vs User Protocol Access

By default, protocol access can be assigned either through users or through groups. A user can connect with a protocol if it has been enabled for their user account, or if they are a member of a group with that protocol enabled.

Disallowing a protocol on the user does not override a Group's grant. To remove the user's access to that protocol, remove every applicable grant, including access inherited from Groups.

Site Administrators can require that all protocol access be managed through Groups. This site-wide policy keeps access consistent through Group membership instead of individual exceptions. It applies to every Workspace. Workspace Administrators can read which policy applies but cannot change it.

With the Groups-only policy enabled, access comes only from Groups with the protocol enabled. Individual protocol settings are ignored for new, cloned, and existing users. Select Group membership for the access the account needs, and manage changes through the Groups' protocol grants or the user's membership.

For example, a new SFTP service account needs membership in a Group that allows SFTP. An individual SFTP grant on the account, including one copied from a cloned user, does not give it SFTP access on a Groups-only site.