Accounts

Accounts in UDMG represent the login and authentication credentials that enable your partners (such as customers, vendors, organizations, departments, internal/external users, or automated systems) to exchange files with you and your business ecosystem. As the primary participants in data exchange, Accounts serve as the bridge between your external business relationships and your internal file transfer infrastructure.

info

Accounts are not to be confused with Users, who are administrative individuals who access your UDMG Admin UI to configure, monitor, and manage data file transfers.

When UDMG acts as the server, Accounts provide the authentication credentials that external clients use to connect to UDMG (Local Protocol Server Endpoints). Each Account within a Domain contains the necessary authentication information for one or more of the supported server protocols listed below. External clients, such as FileZilla, OpenAS2, or other FTP/SFTP/AS2 client software, use these Account credentials to establish secure connections to UDMG.

When an Account is associated with a Pipeline via an Account Group, it can exchange data with UDMG according to that Pipeline's configured permissions and routing rules.

Supported Server Protocols:

1. Local SFTP Server Endpoint - Clients connect using SFTP client software
2. Local FTP Server Endpoint - Clients connect using FTP/FTPS client software
3. Local AS2 Server Endpoint - Clients connect using AS2 client software
4. Local HTTPS Server (WTC) Endpoint - Users connect via web browser through the Web Transfer Client interface

info

Accounts are not required for file transfers when UDMG acts as the client. All connection and authentication details are stored in the Endpoint and Pipeline.

Generally speaking, UDMG's flexible Account framework enables the following capabilities:

• Secure Authentication: Partner credentials are protected using modern, one-way hashing algorithms, ensuring they cannot be reversed or exposed.
• Group Assignment: Accounts are associated with Account Groups, representing collections of Accounts with similar traits or permissions.
• Individualized Tracking: Account access is logged, producing a secure audit trail, ensuring complete accountability for all file transfer activities.
• Comprehensive Administration: UDMG offers robust tools for the complete Account lifecycle: creation, configuration, monitoring, and deactivation.
• Directory Integration: Support for external authentication sources like LDAP and Single Sign-On enables centralized identity management across your organization.

Before You Begin

Domain Scope

Accounts are created and managed within individual Domains and cannot be shared across Domains. If access is required in multiple Domains, a separate Account must be created for each one.

Account Groups and Pipeline Access

To participate in UDMG file transfers, Accounts must be associated with at least one Account Group, which holds a collection of Pipelines.

• The Pipeline's Source-Destination pairing determines the type of file transfers and permissions the Account can participate in.
• An Account Group association is not required on Account creation. Accounts can be associated with Account Group(s) after saving.
• LDAP-provisioned Accounts are created with at least one Account Group associated due to LDAP Sync requirements, but can be updated after creation.
• SSO-provisioned Accounts are created with at least one Account Group associated.

To ensure configuration integrity, UDMG performs validation checks whenever an Account Group association is added to an Account. These checks prevent conflicts that could impact file transfers.

1. Analyze all Pipelines within the Account Groups currently associated with the Account.
2. Compare each Pipeline in the newly added Account Group against the existing collection.
3. Verify that each Pipeline combination of Source Endpoint ID and Virtual Path is unique.
   info

   Each Source Endpoint ID and Virtual Path combination must be unique within an Account Group and across all Pipelines associated with an Account.

4. Display a detailed error message if a conflict is detected.

Account Credentials

Accounts may require associated Credentials to authenticate with UDMG. The required Credentials depend on the transfer type and the Authentication Method of the Endpoint.

• SFTP: For Accounts participating in SFTP file transfers when UDMG is the SFTP server, an associated Public Key may be required to authenticate with UDMG. Your partner maintains their own SSH key pair, with their Public Key shared with you and used to authenticate their SFTP client. Password or key authentication is supported, with key-only authentication used for automated or scripted transfers. This is referred to as passwordless authentication.

info

When an Account connects to a Local SFTP Server Endpoint, a Public Key is required if the Local SFTP Server's Authentication Method is Public Key, Password or Public Key, or Password and Public Key.

• AS2: For Accounts participating in Local AS2 file transfers when UDMG is the Receiver, an associated X.509 Certificate may be required.

Multiple Credentials can be associated with an Account (e.g., multiple SSH public keys).

Login Methods

UDMG supports three Account creation and login methods, providing flexibility and scalability options.

• Standard Authentication: The default method uses a manually set username and password.
• LDAP Authentication: This method automatically creates and authenticates Accounts against users in an LDAP server.
• Single Sign-On (SSO) Authentication: This method automatically creates and authenticates Accounts through an external Identity Provider (IdP).

info

Two-Factor Authentication (2FA) can be enabled as an additional security layer for both Standard and LDAP authentication methods.

Quotas

Quotas let you enforce per-Account limits on the number of bytes transferred during a defined time period. When a quota is reached, UDMG blocks or aborts the transfer and returns a protocol-appropriate error to the client.

Two common reasons to configure quotas are:

• operational protection, preventing one partner from monopolizing shared server resources, and
• commercial governance, enforcing contractual storage or bandwidth allocations as part of a partner agreement.

General Considerations

• Each Account supports one quota policy at a time.
• If an Account is already at its quota limit when a new transfer begins, UDMG blocks the transfer before any bytes are written.
• Bytes from failed or aborted transfers count toward the quota. Transfers aborted due to quota enforcement are an exception: those bytes are not charged.
• Partial files are not deleted automatically.
• Quotas track bytes transferred (uploaded, downloaded, or both) rather than bytes stored on disk, hence, deleting a file does not reduce the counter unless the optional subtract-on-delete behavior is enabled via the UDMG REST API.
• Current quota usage is visible in the Account Details (Utilization field).
• If multiple transfers run simultaneously for the same Account, their combined byte usage is tracked. A brief race near the quota boundary is possible: both transfers may pass the pre-transfer check before either is blocked. Without in-flight checks enabled, the overage can be as large as the full size of the second transfer; with in-flight checks enabled, the overage is bounded by transfer.quota_check_interval_bytes.
• If UDMG restarts while a transfer is in progress, bytes accumulated since the last database write may not be recorded against the quota. The quota counter is written to the database approximately every 5 seconds; after a restart, it reflects the last saved value rather than the exact bytes in flight at the time of restart.

Direction and Reset Period

The Direction field controls which transfer direction counts against the quota:

• Uploads (Write): Counts bytes uploaded to UDMG by the Account.
• Downloads (Read): Counts bytes downloaded from UDMG by the Account.
• Uploads and Downloads: Counts both directions against a single shared limit.

The Reset Period field controls how frequently the counter resets. The reset occurs at midnight (00:00 server local time) on the first day of each period:

• Daily: Resets every day.
• Weekly: Resets every Monday.
• Monthly: Resets on the first day of each month.
• Quarterly: Resets on the first day of each quarter (January 1, April 1, July 1, October 1).
• Yearly: Resets on January 1.

Disabling and Re-enabling Quotas

Disabling the Enable Quotas toggle pauses quota tracking. While disabled, bytes transferred do not count toward the quota, and the existing counter is retained.

When quotas are re-enabled, the behavior depends on the current period:

• If re-enabled within the same period, the counter resumes from the value it had when quotas were disabled.
• If re-enabled in a new period, the counter resets to zero as part of the normal period rollover.

Subtract-On-Delete

The subtract-on-delete option reduces the quota counter when files are deleted. When enabled, deleting a file decrements the Account's bytes-transferred counter for the current quota period. This option is not available in the UDMG Admin UI and must be configured via the UDMG REST API, by sending a PUT request to the Account's quota endpoint with subtractQuotaDeletions set to true.

Enable this option only for Accounts where the partner exclusively manages their own files. Avoid enabling it for shared Accounts or where precise accounting is required, as deletions from shared folders, prior quota periods, or partial transfers can produce counter values that are difficult to interpret.

API Endpoint

PUT /api/v1/domains/{domainName}/accounts/{accountName}/quota

Authentication

This endpoint requires authentication using a valid UDMG User username and password.

Permissions

The authenticated User must have one of the following Roles:

• System Administrator (only for Primary Domain)
• Domain Administrator
• Pipeline Management

Path Parameters

Parameter	Description
domainName	The name of the Domain that owns the Account.
accountName	The name of the Account to update.

Request Body

This endpoint creates or replaces the entire quota configuration for the Account. Before sending this request, retrieve the current configuration to avoid overwriting existing settings:

GET /api/v1/domains/{domainName}/accounts/{accountName}/quota

If quotas have never been configured for the Account, the GET returns 404. In that case, include all required fields in the PUT request body.

If the GET returns 200, the quota record exists, and you must include all returned values alongside subtractQuotaDeletions.

Property	Description	Type	Required	Default
enabled	When true, quota enforcement is active.	boolean	Yes	n/a
quotaSize	Maximum bytes allowed per reset period, in bytes. Must be greater than 0.	integer	Yes	n/a
quotaDirection	Transfer direction the quota applies to. Options: "write" "read" "both"	string	Yes	n/a
resetPeriod	How often the byte counter resets. Options: "daily" "weekly" "monthly" "quarterly" "yearly"	string	Yes	n/a
subtractQuotaDeletions	When true, deleting a file decrements the Account's bytes-transferred counter. See Subtract-On-Delete for usage considerations.	boolean	No	false

Example

Linux

$

curl -X PUT \
"https://<udmg-host>:<port>/api/v1/domains/<domain-name>/accounts/<account-name>/quota" \
-u "<username>:<password>" \
-d '{
  "enabled": true,
  "quotaSize": 1073741824,
  "quotaDirection": "write",
  "resetPeriod": "monthly",
  "subtractQuotaDeletions": true
}'

Windows (CMD)

C:\>

curl -X PUT "https://<udmg-host>:<port>/api/v1/domains/<domain-name>/accounts/<account-name>/quota" -u "<username>:<password>" -d "{\"enabled\":true,\"quotaSize\":1073741824,\"quotaDirection\":\"write\",\"resetPeriod\":\"monthly\",\"subtractQuotaDeletions\":true}"

Response

On success, the endpoint returns 200 OK with the full updated quota object.

Example

JSON

{
  "uuid": "ae6a4294-5151-4ed5-8945-4b51699fa24c",
  "createdAt": "2026-08-20T14:58:19.559Z",
  "updatedAt": "2026-08-20T17:48:48.184Z",
  "version": 2,
  "enabled": true,
  "quotaSize": 1073741824,
  "quotaDirection": "write",
  "resetPeriod": "monthly",
  "bytesUsed": 0,
  "periodStart": "2026-08-01T00:00:00Z",
  "subtractQuotaDeletions": true,
  "utilization": {
    "bytesUsed": 0,
    "bytesLimit": 1073741824,
    "percentUsed": 0,
    "periodStart": "2026-08-01T00:00:00Z",
    "periodEnd": "2026-08-31T23:59:59.999999999Z"
  }
}

Enforcement Behavior

When an Account's quota is reached, UDMG rejects or aborts the transfer and returns a protocol-appropriate error to the client:

Protocol	Error
FTP / FTPS	552 Quota exceeded
SFTP	SSH_FX_QUOTA_EXCEEDED (status code 17)
HTTPS / WTC	507 Insufficient Storage
AS2	MDN with disposition failed/quota-exceeded

In the UDMG Admin UI, quota-blocked transfers appear with a Failed status and a Failure Reason of quota exceeded.

In-Flight Enforcement

By default, quota enforcement only runs before a transfer begins. Mid-transfer in-flight checks can be enabled by setting the transfer.quota_check_interval_bytes configuration parameter to a positive value.

When enabled, a small number of bytes beyond the quota limit may be transferred before enforcement runs, so administrators setting strict limits should build in a tolerance margin.

Protocol-Specific Behavior

Protocol	Behavior
FTP / SFTP	File size is not known before the transfer begins. If the Account is already at its quota limit, the transfer is blocked immediately. If in-flight checks are enabled and the Account crosses its limit mid-file, the transfer is aborted, the partial file is deleted, and the bytes written up to that point are not charged to the quota.
WTC (multi-file upload)	Each file in a batch is an independent transfer. Files uploaded before the quota limit is reached complete successfully. The file that exceeds the quota limit fails. Subsequent files in the batch do not produce transfer records in the UDMG Admin UI, but the Web Transfer Client reports them as failed.
WTC (standard upload)	File size is not known before the upload begins. If the Account is already at its limit, the upload is blocked immediately. If in-flight checks are enabled and the Account crosses its limit mid-file, the upload is aborted, the partial file is deleted, and the bytes written up to that point are not charged to the quota.

High-Availability Deployments

In multi-node deployments, the committed byte counter is shared across all nodes. Bytes currently in transit on other nodes may not be reflected in the counter until those transfers complete. In HA environments, configure quotas conservatively (for example, 10-20% below the true hard limit) to account for this cross-node window.

Adding an Account

There are three ways to add Accounts:

• New Accounts with Standard Authentication can be added manually from the Accounts page.
• New LDAP-provisioned Accounts are automatically generated during an LDAP Sync after LDAP authentication is configured.
• New SSO Accounts are automatically generated upon login after SSO authentication is configured.

To add an Account manually, follow these steps:

1. From the Sidebar, click Configuration > Accounts.
2. Click the Add Account button above the Accounts list.
3. Complete the details for the new Account using the Field Descriptions table as a guide.
4. Click Add.

warning

Within the Account form, the Account Group combinations with Pipeline conflicts are not identified in the dropdown field. If there are conflicts between the Account Group - Pipeline combinations selected, then an error is displayed after saving.

Field Descriptions

The following table describes the fields that are configured for the Account:

Name	Description	Specifications	Required
Account Name	The name of the Account. The name of the Account. The Account Name (not the same as the Username used for logging in) is used only for administration and association purposes.	Must be unique, across all Login Methods. Must follow the Account Name Pattern.	Yes
Description	The description of the Account.		No
Business Service	Assigning a Business Service to this Account restricts updating, deleting, and other actions so only Users with the same Business Service can perform them (role permissions still apply). For details, see Business Services.	Only Users with the System Administrator, Domain Administrator, or Pipeline Management role can assign Business Services to Accounts. Select an existing Business Service. To select it, your User must have that Business Service already assigned.	No
Username	Account's login name used to authenticate the Account.	Must be unique. Must follow the Username Pattern.	Yes
Password	Account's password used to log in.	Must follow the Password Policy.	Yes
Confirm Password	Re-entered password.	Must match the Password field.	Yes
Account Groups	Account Groups associated with the Account, chosen from a list of all Account Groups created on the Account Groups page. An Account must be associated with at least one Account Group to send or receive files.	This multi-select field references existing Account Group(s).	No
Credentials	The Credentials used by this Account for authentication with an Endpoint. For Local SFTP file transfers, select a Public Key if authentication requires it. For Local AS2 file transfers, select an X.509 Certificate.	This multi-select field references existing Credentials.	No
Require Two-Factor Authentication (TOTP)	Requires Accounts to log in with 2FA.	Must have a Login Method equal to Standard or LDAP.	No
Partner Identifier	A unique identifier for your remote AS2 partner, used for routing, authentication, and partner-specific configuration.	May be reused across other protocols for consistency. Must match the AS2-From header in received messages.	Yes, when using AS2 protocol.
Enable Quotas	A toggle switch to enable or disable transfer quotas for this Account. When disabled, transfers are not tracked and no limits are enforced. For more information, see Quotas.	Default value: Disabled.	No
Quota (MB)	The maximum number of megabytes that can be transferred during the configured reset period. Enter the limit in megabytes; UDMG stores and evaluates the value internally in bytes.	Must be at least 1.	Yes, if Enable Quotas is Enabled.
Direction	Determines which transfer direction counts against the quota limit. Options: Uploads (Write) Downloads (Read) Uploads and Downloads	Default value: Uploads (Write).	Yes, if Enable Quotas is Enabled.
Reset Period	Determines how frequently the quota counter resets. Options: Daily Weekly Monthly Quarterly Yearly		Yes, if Enable Quotas is Enabled.
Utilization	Displays the current transfer usage for the active quota period, shown as megabytes consumed and percentage of the quota limit. Read-only; only visible when editing an Account that has quotas enabled.		No

Editing an Account

warning

Disabling the Enable Quotas toggle resets the quota counter to zero.

To edit an Account, follow these steps:

1. From the Sidebar, select Configuration > Accounts.
2. Click the Name of the Account you want to edit.
3. Click the Edit button above the Account details.
4. Edit details for the Account using the Field Descriptions table as a guide.
5. Click Save.

info

Certain fields for LDAP-provisioned and SSO-provisioned Accounts cannot be edited in UDMG and must be managed in the LDAP or SSO system. For more information, see:

• Editing LDAP-Provisioned Accounts
• Editing SSO-Provisioned Accounts

Managing an Account

Account management includes viewing metadata, verifying associated Account Group - Pipeline combinations, and controlling the Account's enabled status.

Viewing Account Details

To view the details of an Account, follow these steps:

1. From the Sidebar, click Configuration > Accounts.
2. Click the Name of the Account you want to view.
3. Review the Account details.
   • To view the associated Credentials, click the Credentials tab.
   • To view the associated Account Groups, click the Account Groups tab.

Account Metadata

Account details include all parameters given in the Field Descriptions table above, plus the following read-only metadata:

Name	Description
UUID	The universally unique identifier of this Account.
Version	Version number of the configuration. Every change increases the number.
Source	The LDAP server URL from which the Account was provisioned. This read-only field is available only for LDAP-provisioned Accounts.
Login Method	The method the Account uses to log in and authenticate to UDMG as Server Pipelines. Options include Standard, LDAP, and SSO. If a different Login Method is needed, a new Account must be created.
Created	Date and time this Account was created.
Updated	Date and time this Account was last updated.

Viewing Version History

To view the change history of this Account and compare any prior version to the current configuration, click Versions in the header. See Version History.

Enabling and Disabling Accounts

Accounts can be Enabled or Disabled to control their active status and ability to participate in file transfers. The status is defaulted to Enabled and can be changed after creation.

• Enabled (default): The Account is active and can participate in file transfers.
• Disabled: The Account is inactive and cannot participate in file transfers.

To enable or disable an Account, follow these steps:

1. From the Sidebar, click Configuration > Accounts.
2. Click the Name of the Account you want to enable or disable.
3. Click the Enable or Disable button above the Account details, depending on the current status.

info

Changes to the Account's Enabled/Disabled status are not active until the Account reconnects. Disabling an Account is a good alternative to deleting an Account.

Deleting an Account

To delete an Account, follow these steps:

1. From the Sidebar, click Configuration > Accounts.
2. Click the Name of the Account you want to delete.
3. Click the Delete button above the Account details.
4. You will be asked to confirm the deletion. Click Continue.

danger

Deletion cannot be undone. Deleting an LDAP Account should be done with caution, as UDMG does not automatically resynchronize with the LDAP directory. To avoid inconsistencies, ensure the Account is also removed from the LDAP system.

Troubleshooting

If an Account is experiencing connection issues, verify the following:

1. Authentication details: Ensure the Account's Username, Password, and any associated Credentials (e.g., SSH keys) are correct and valid.

2. Pipeline and Endpoint status: Confirm that the Pipelines and Endpoints associated with the Account's Account Groups are enabled and properly configured.