# Change FTP user of a web hosting package

> Change password, directory, disk space, status, end or name of one FTP user.

- Effect: Write - Changes the account. Agents ask first.
- Idempotent: yes
- Stability: beta
- MCP tool: `manitu_webhosting_web_ftpuser_set` on https://mcp.manitu.de/mcp
- REST: `POST https://api.manitu.de/v1/webhosting/web/ftpuser/set`
- Needs: `service_webhosting`
- Page: /reference/webhosting/web/ftpuser/set/

**Changes the account. Agents say what will happen and wait for an explicit yes before calling it.**

## MCP tool

`manitu_webhosting_web_ftpuser_set`

### Description for the model

Changes an FTP user of a web hosting package of the manitu customer account this connection works in, by site_id and username from manitu_webhosting_web_ftpuser_list. Only the fields given change. A new password only as password_same_as (the password of another FTP user of the package) or password_hash (bcrypt) - NEVER ask for or pass a plaintext password, it is refused over this connection; otherwise the customer sets it in the customer panel. status inactive switches it off without deleting it; expires_at null removes the end. A new password or inactive ends its open sessions. Refused with a conflict when the package cannot be changed now (not_configurable). Tell the customer what will change and ask for an explicit yes first.

### Arguments

- `site_id` (integer | string, required) - The site_id from manitu_webhosting_list - never guess one. (pattern `"^[1-9][0-9]*$"`; minimum `1`)
- `username` (string, required) - The user name of the FTP user (ftp<number>) from manitu_webhosting_web_ftpuser_list - never guess one. (maxLength `32`; pattern `"^ftp[0-9]+$"`)
- `quota_mb` (integer | null) - Disk space in MB the files it owns may take, at most the package's; null or 0: no limit of its own. (minimum `0`)
- `status` (string) - active, or inactive to switch it off without deleting it. Default when created: active. (one of `"active"`, `"inactive"`)
- `expires_at` (string | null) - When the FTP user expires - it works up to the next midnight (Europe/Berlin) at or after the moment given, which the answer shows. Not in the past. From this moment on it can no longer be used (the moment itself is excluded); null: without end. (format `date-time`)
- `description` (string | null) - The customer's description, for his own overview - e.g. who uses it. Left out: unchanged (set) or none (create); null or empty: none. (maxLength `1024`)
- `password` (string, write-only) - The password of the FTP user - customer panel and REST only, refused over MCP: never ask for a password in a chat. Kept as a hash only, never shown again. Only one of password, password_hash, password_same_as. 12 to 72 printable ASCII characters, no space at the start or the end, not listed as leaked (pwnedpasswords.com). (minLength `12`; maxLength `72`; pattern `"^[\\x20-\\x7E]+$"`)
- `password_hash` (string, write-only) - The password as a hash made by the customer - instead of password. A hash can be attacked offline: only for a strong password. Taken: bcrypt ("$2b$" or "$2y$", cost 10 or more). (maxLength `128`; pattern `"^\\$"`)
- `password_same_as` (string) - The user name of the FTP user (ftp<number>) from manitu_webhosting_web_ftpuser_list - never guess one. (maxLength `32`; pattern `"^ftp[0-9]+$"`)
- `home_dir` (string) - The directory it starts in and cannot leave, relative to the package - "/" for the whole package, e.g. "/web/shop". It must exist. Default when created: "/". (minLength `1`; maxLength `1024`)

### Example

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "manitu_webhosting_web_ftpuser_set",
    "arguments": {
      "site_id": 12345,
      "username": "string"
    }
  }
}
```

## REST

`POST https://api.manitu.de/v1/webhosting/web/ftpuser/set`

### Authentication

One of `X-API-Key`, `Authorization: Bearer …` - never more than one in a request.

### Request body

JSON; unknown fields are refused.

- `site_id` (integer | string, required) - The site_id from manitu_webhosting_list - never guess one. (pattern `"^[1-9][0-9]*$"`; minimum `1`)
- `username` (string, required) - The user name of the FTP user (ftp<number>) from manitu_webhosting_web_ftpuser_list - never guess one. (maxLength `32`; pattern `"^ftp[0-9]+$"`)
- `quota_mb` (integer | null) - Disk space in MB the files it owns may take, at most the package's; null or 0: no limit of its own. (minimum `0`)
- `status` (string) - active, or inactive to switch it off without deleting it. Default when created: active. (one of `"active"`, `"inactive"`)
- `expires_at` (string | null) - When the FTP user expires - it works up to the next midnight (Europe/Berlin) at or after the moment given, which the answer shows. Not in the past. From this moment on it can no longer be used (the moment itself is excluded); null: without end. (format `date-time`)
- `description` (string | null) - The customer's description, for his own overview - e.g. who uses it. Left out: unchanged (set) or none (create); null or empty: none. (maxLength `1024`)
- `password` (string, write-only) - The password of the FTP user - customer panel and REST only, refused over MCP: never ask for a password in a chat. Kept as a hash only, never shown again. Only one of password, password_hash, password_same_as. 12 to 72 printable ASCII characters, no space at the start or the end, not listed as leaked (pwnedpasswords.com). (minLength `12`; maxLength `72`; pattern `"^[\\x20-\\x7E]+$"`)
- `password_hash` (string, write-only) - The password as a hash made by the customer - instead of password. A hash can be attacked offline: only for a strong password. Taken: bcrypt ("$2b$" or "$2y$", cost 10 or more). (maxLength `128`; pattern `"^\\$"`)
- `password_same_as` (string) - The user name of the FTP user (ftp<number>) from manitu_webhosting_web_ftpuser_list - never guess one. (maxLength `32`; pattern `"^ftp[0-9]+$"`)
- `home_dir` (string) - The directory it starts in and cannot leave, relative to the package - "/" for the whole package, e.g. "/web/shop". It must exist. Default when created: "/". (minLength `1`; maxLength `1024`)

### Response

In `data`; the rest of the body as on every call.

- `username` (string, required) - The user name to log in with (ftp<number>) - what the other FTP user tools take.
- `description` (string | null, required) - What the customer wrote about it (his description), null if nothing - not its name or user name.
- `status` (string, required) - active, or inactive (switched off by the customer, kept for later). (one of `"active"`, `"inactive"`)
- `is_usable_now` (boolean, required) - It can log in right now: active and not expired.
- `expires_at` (string | null, required) - When the FTP user expires. From this moment on it can no longer be used (the moment itself is excluded); null: without end. (format `date-time`)
- `home_dir` (string | null, required) - The directory it starts in and cannot leave, relative to the package (/ = the whole package).
- `quota_mb` (integer | null, required) - Disk space in MB the files it owns may take; null: no limit of its own (the package's applies).
- `password_change_recommended` (boolean, required) - The password is kept in an outdated form - the customer should set a new one.
- `created_at` (string | null, required) - When it was created. (format `date-time`)
- `last_login_at` (string | null, required) - Its last login, null if never. (format `date-time`)
- `connection` (object, required)
  - `connection.host` (string | null, required) - The host to connect to - the web server of the package.
  - `connection.username` (string, required) - The user name to log in with.
  - `connection.method_list` (array of object, required) - The ways to connect, the one to prefer first. SFTP is on port 23, NOT 22; implicit FTPS is not offered; plain FTP (unencrypted) only if nothing else works.
    - `connection.method_list[].protocol` (string, required) - sftp (SSH file transfer), ftps_explicit (FTP with explicit TLS, AUTH TLS), ftp (unencrypted). (one of `"sftp"`, `"ftps_explicit"`, `"ftp"`)
    - `connection.method_list[].port` (integer, required)
    - `connection.method_list[].is_encrypted` (boolean, required)
    - `connection.method_list[].is_recommended` (boolean, required)
  - `connection.web_ftp_url` (string, required) - FTP in the browser, with the same user name and password.

### Statuses

- `200` Success.
- `400` The request does not match the declared input schema.
- `401` No credential was presented, or it was not recognised.
- `403` The credential is not permitted to use this operation.
- `500` The server failed. Nothing about the request was wrong. Whether a change took effect is not known - check before trying it again.
- `503` The channel this operation forwards through is unavailable.

### Example

```sh
curl -X POST 'https://api.manitu.de/v1/webhosting/web/ftpuser/set' \
  -H 'X-API-Key: $API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{"site_id":12345,"username":"string"}'
```

## Example result

```json
{
  "username": "string",
  "description": "Example",
  "status": "active",
  "is_usable_now": true,
  "expires_at": "2026-10-23T12:00:00+02:00",
  "home_dir": "/web",
  "quota_mb": 1,
  "password_change_recommended": true,
  "created_at": "2026-10-23T12:00:00+02:00",
  "last_login_at": "2026-10-23T12:00:00+02:00",
  "connection": {
    "host": "string",
    "username": "string",
    "method_list": [
      {
        "protocol": "sftp",
        "port": 1,
        "is_encrypted": true,
        "is_recommended": true
      }
    ],
    "web_ftp_url": "https://www.example.com/"
  }
}
```