Create FTP user for a web hosting package

A new FTP user for one web hosting package - the user name is given by manitu.

WWriteNot idempotentbetaNeeds service_webhosting

Tool

manitu_webhosting_web_ftpuser_createon https://mcp.manitu.de/mcp

POST

/v1/webhosting/web/ftpuser/createon https://api.manitu.de

Try it

Changes the account. Agents say what will happen and wait for an explicit yes before calling it.

Annotations as tools/list sends them

readOnlyHint falsedestructiveHint falseidempotentHint falseopenWorldHint false

Description for the model

Creates an FTP user for a web hosting package of the manitu customer account this connection works in, by its site_id from manitu_webhosting_list. manitu gives the user name (ftp<number>); the answer has it and how to connect. For the same password as an existing FTP user of the package give password_same_as with its username; else password_hash (bcrypt, "$2b$"/"$2y$"). NEVER ask for or pass a plaintext password: password is refused over this connection, a password in a chat is no longer secret; without either, the customer creates the FTP user in the customer panel. home_dir limits it to a directory (default "/", the whole package). Refused with a conflict when the package allows no more FTP users (limit_reached), its disk space is almost full (quota_almost_exceeded) or it cannot be changed now (not_configurable). Ask the customer for an explicit yes first: it opens access to the files of the package.

Provide at least one of: password, password_hash, password_same_as.

Arguments

site_idinteger | stringrequired

The site_id from manitu_webhosting_list - never guess one.

pattern ^[1-9][0-9]*$min 1

quota_mbinteger | null

Disk space in MB the files it owns may take, at most the package's; null or 0: no limit of its own.

min 0

statusstring

active, or inactive to switch it off without deleting it. Default when created: active.

One of active inactive

expires_atstring | null

When the FTP user expires - it works up to the next midnight (Europe/Berlin) at or after the moment given, which the answer shows. Not in the past. From this moment on it can no longer be used (the moment itself is excluded); null: without end.

Format date-time

descriptionstring | null

The customer's description, for his own overview - e.g. who uses it. Left out: unchanged (set) or none (create); null or empty: none.

max length 1024

passwordstringwrite-only

The password of the FTP user - customer panel and REST only, refused over MCP: never ask for a password in a chat. Kept as a hash only, never shown again. Only one of password, password_hash, password_same_as. 12 to 72 printable ASCII characters, no space at the start or the end, not listed as leaked (pwnedpasswords.com).

min length 12max length 72pattern ^[\x20-\x7E]+$

password_hashstringwrite-only

The password as a hash made by the customer - instead of password. A hash can be attacked offline: only for a strong password. Taken: bcrypt ("$2b$" or "$2y$", cost 10 or more).

max length 128pattern ^\$

password_same_asstring

The user name of the FTP user (ftp<number>) from manitu_webhosting_web_ftpuser_list - never guess one.

max length 32pattern ^ftp[0-9]+$

home_dirstring

The directory it starts in and cannot leave, relative to the package - "/" for the whole package, e.g. "/web/shop". It must exist. Default when created: "/".

min length 1max length 1024

The tool list carries this simplified form: a rule at the root of a schema does not reach every client, so it is said in the description instead.

Result structuredContent, checked against the schema

usernamestringrequired

The user name to log in with (ftp<number>) - what the other FTP user tools take.

descriptionstring | nullrequired

What the customer wrote about it (his description), null if nothing - not its name or user name.

statusstringrequired

active, or inactive (switched off by the customer, kept for later).

One of active inactive

is_usable_nowbooleanrequired

It can log in right now: active and not expired.

expires_atstring | nullrequired

When the FTP user expires. From this moment on it can no longer be used (the moment itself is excluded); null: without end.

Format date-time

home_dirstring | nullrequired

The directory it starts in and cannot leave, relative to the package (/ = the whole package).

quota_mbinteger | nullrequired

Disk space in MB the files it owns may take; null: no limit of its own (the package's applies).

password_change_recommendedbooleanrequired

The password is kept in an outdated form - the customer should set a new one.

created_atstring | nullrequired

When it was created.

Format date-time

last_login_atstring | nullrequired

Its last login, null if never.

Format date-time

connectionobjectrequired

connection.hoststring | nullrequired

The host to connect to - the web server of the package.

connection.usernamestringrequired

The user name to log in with.

connection.method_listarray of objectrequired

The ways to connect, the one to prefer first. SFTP is on port 23, NOT 22; implicit FTPS is not offered; plain FTP (unencrypted) only if nothing else works.

connection.method_list[].protocolstringrequired

sftp (SSH file transfer), ftps_explicit (FTP with explicit TLS, AUTH TLS), ftp (unencrypted).

One of sftp ftps_explicit ftp

connection.method_list[].portintegerrequired

connection.method_list[].is_encryptedbooleanrequired

connection.method_list[].is_recommendedbooleanrequired

connection.web_ftp_urlstringrequired

FTP in the browser, with the same user name and password.

Authentication

One of X-API-Key, Authorization: Bearer … - never more than one in a request. More

Request body JSON; unknown fields are refused

Provide at least one of: password, password_hash, password_same_as.

site_idinteger | stringrequired

The site_id from manitu_webhosting_list - never guess one.

pattern ^[1-9][0-9]*$min 1

quota_mbinteger | null

Disk space in MB the files it owns may take, at most the package's; null or 0: no limit of its own.

min 0

statusstring

active, or inactive to switch it off without deleting it. Default when created: active.

One of active inactive

expires_atstring | null

Format date-time

descriptionstring | null

The customer's description, for his own overview - e.g. who uses it. Left out: unchanged (set) or none (create); null or empty: none.

max length 1024

passwordstringwrite-only

min length 12max length 72pattern ^[\x20-\x7E]+$

password_hashstringwrite-only

The password as a hash made by the customer - instead of password. A hash can be attacked offline: only for a strong password. Taken: bcrypt ("$2b$" or "$2y$", cost 10 or more).

max length 128pattern ^\$

password_same_asstring

The user name of the FTP user (ftp<number>) from manitu_webhosting_web_ftpuser_list - never guess one.

max length 32pattern ^ftp[0-9]+$

home_dirstring

The directory it starts in and cannot leave, relative to the package - "/" for the whole package, e.g. "/web/shop". It must exist. Default when created: "/".

min length 1max length 1024

Response in `data`; the rest of the body as on every call

usernamestringrequired

The user name to log in with (ftp<number>) - what the other FTP user tools take.

descriptionstring | nullrequired

What the customer wrote about it (his description), null if nothing - not its name or user name.

statusstringrequired

active, or inactive (switched off by the customer, kept for later).

One of active inactive

is_usable_nowbooleanrequired

It can log in right now: active and not expired.

expires_atstring | nullrequired

When the FTP user expires. From this moment on it can no longer be used (the moment itself is excluded); null: without end.

Format date-time

home_dirstring | nullrequired

The directory it starts in and cannot leave, relative to the package (/ = the whole package).

quota_mbinteger | nullrequired

Disk space in MB the files it owns may take; null: no limit of its own (the package's applies).

password_change_recommendedbooleanrequired

The password is kept in an outdated form - the customer should set a new one.

created_atstring | nullrequired

When it was created.

Format date-time

last_login_atstring | nullrequired

Its last login, null if never.

Format date-time

connectionobjectrequired

connection.hoststring | nullrequired

The host to connect to - the web server of the package.

connection.usernamestringrequired

The user name to log in with.

connection.method_listarray of objectrequired

The ways to connect, the one to prefer first. SFTP is on port 23, NOT 22; implicit FTPS is not offered; plain FTP (unencrypted) only if nothing else works.

connection.method_list[].protocolstringrequired

sftp (SSH file transfer), ftps_explicit (FTP with explicit TLS, AUTH TLS), ftp (unencrypted).

One of sftp ftps_explicit ftp

connection.method_list[].portintegerrequired

connection.method_list[].is_encryptedbooleanrequired

connection.method_list[].is_recommendedbooleanrequired

connection.web_ftp_urlstringrequired

FTP in the browser, with the same user name and password.

Statuses

200Success.400The request does not match the declared input schema.401No credential was presented, or it was not recognised.403The credential is not permitted to use this operation.500The server failed. Nothing about the request was wrong. Whether a change took effect is not known - check before trying it again.503The channel this operation forwards through is unavailable.

MCPtools/call

Request

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "manitu_webhosting_web_ftpuser_create",
    "arguments": {
      "site_id": 12345,
      "password": "correct-horse-battery"
    }
  }
}

Result

{
  "structuredContent": {
    "username": "string",
    "description": "Example",
    "status": "active",
    "is_usable_now": true,
    "expires_at": "2026-10-23T12:00:00+02:00",
    "home_dir": "/web",
    "quota_mb": 1,
    "password_change_recommended": true,
    "created_at": "2026-10-23T12:00:00+02:00",
    "last_login_at": "2026-10-23T12:00:00+02:00",
    "connection": {
      "host": "string",
      "username": "string",
      "method_list": [
        {
          "protocol": "sftp",
          "port": 1,
          "is_encrypted": true,
          "is_recommended": true
        }
      ],
      "web_ftp_url": "https://www.example.com/"
    }
  },
  "content": [
    {
      "type": "text",
      "text": "… the same answer as text …"
    }
  ],
  "isError": false
}

POST/v1/webhosting/web/ftpuser/create

Request

curl -X POST 'https://api.manitu.de/v1/webhosting/web/ftpuser/create' \
  -H 'X-API-Key: $API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{
    "site_id": 12345,
    "password": "correct-horse-battery"
  }'

const response = await fetch('https://api.manitu.de/v1/webhosting/web/ftpuser/create', {
  method: 'POST',
  headers: {
    'X-API-Key': process.env.API_KEY,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "site_id": 12345,
    "password": "correct-horse-battery"
  }),
});
const answer = await response.json();

<?php

$curl = curl_init('https://api.manitu.de/v1/webhosting/web/ftpuser/create');

curl_setopt_array($curl, [
    CURLOPT_CUSTOMREQUEST  => 'POST',
    CURLOPT_HTTPHEADER     => [
        'X-API-Key: ' . getenv('API_KEY'),
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS     => '{"site_id":12345,"password":"correct-horse-battery"}',
    CURLOPT_RETURNTRANSFER => true,
]);

$answer = json_decode(curl_exec($curl), true);

import os

import requests

response = requests.request(
    "POST",
    "https://api.manitu.de/v1/webhosting/web/ftpuser/create",
    headers={"X-API-Key": os.environ["API_KEY"]},
    json={
        "site_id": 12345,
        "password": "correct-horse-battery",
    },
)
answer = response.json()

Response 200

{
  "status": {
    "type": "success",
    "code": 200
  },
  "meta": {},
  "data": {
    "username": "string",
    "description": "Example",
    "status": "active",
    "is_usable_now": true,
    "expires_at": "2026-10-23T12:00:00+02:00",
    "home_dir": "/web",
    "quota_mb": 1,
    "password_change_recommended": true,
    "created_at": "2026-10-23T12:00:00+02:00",
    "last_login_at": "2026-10-23T12:00:00+02:00",
    "connection": {
      "host": "string",
      "username": "string",
      "method_list": [
        {
          "protocol": "sftp",
          "port": 1,
          "is_encrypted": true,
          "is_recommended": true
        }
      ],
      "web_ftp_url": "https://www.example.com/"
    }
  }
}

Create FTP user for a web hosting package

Annotations as tools/list sends them

Description for the model

Arguments

Result structuredContent, checked against the schema

Authentication

Request body JSON; unknown fields are refused

Response in data; the rest of the body as on every call

Statuses

Response in `data`; the rest of the body as on every call