Group edits and deletions are performed via the Web Admin Console or the Swing
admin. Every group mutation emits an audit event
(GROUP_UPDATED, GROUP_DELETED).
Identity — Memberships
Command
Syntax
Description
user-join-group
admin user-join-group <username> <org>/<group>
Add user to a group (rolls back on mount conflict)
user-leave-group
admin user-leave-group <username> <org>/<group>
Remove user from a group
user-memberships
admin user-memberships <username>
List every group the user belongs to
user-folders
admin user-folders <username>
List every folder the user can reach (home + virtual folders, with permissions)
Rename or repoint a virtual folder (rolls back on mount conflict)
folder-delete
admin folder-delete <folder-id>
Remove a virtual folder + all grants
folder-health
admin folder-health
Report folder reconciler status (missing folders)
Folder paths are auto-normalized: a missing leading slash is prepended
automatically (shared → /shared). Only the root
(/) and single-segment paths (/shared/) are allowed;
nested paths (/a/b/c/) are rejected with a clear error.
Set a provider config property (hot-reloads the registry)
Providers themselves (rows in sftp_authentication_providers) are
created via the Web Admin or Swing surfaces or seeded on first boot from the
legacy <ldap> / <jdbc-user-manager> XML
blocks. The CLI edits provider properties; adding or removing whole
providers is a UI-only operation today.
Signing (Enterprise)
Command
Syntax
Description
signing-status
admin signing-status
Show the current signing key's fingerprint, key ID, algorithm
Show edition, customer ID, expiry, source, SHA-256 fingerprint
license-update
admin license-update <path-to-activation.key>
Install or renew a license key. The previous key is archived to ${data}/backup_activation_keys/.
license-clear
admin license-clear [--confirm]
Remove activation.key (server falls back to Free Edition on next restart)
B. Event Types Reference
The following event types are recorded in the audit trail. Each event is categorized
as a success or failure event, which affects notification rules and UI highlighting.
Event Type
Description
Success
AUTH_SUCCESS
User authenticated successfully
Yes
AUTH_FAILURE
Authentication attempt failed
No
AUTH_ACCOUNT_LOCKED
Account locked after threshold failures
No
SESSION_CONNECT
Client TCP connection established
Yes
SESSION_CLOSED
Client disconnected
Yes
UPLOAD_COMPLETE
File upload committed to filesystem
Yes
UPLOAD_ABORTED
Upload cancelled by client before completion
No
UPLOAD_REJECTED
Upload denied (quota, read-only, path error)
No
DOWNLOAD_COMPLETE
File download completed
Yes
DIR_LIST
Directory listing requested
Yes
LICENSE_REJECTED
Activation key missing, expired, or invalid
No
MFA_SUCCESS
TOTP verification succeeded
Yes
MFA_FAILURE
TOTP verification failed
No
MFA_ENROLLED
MFA enrollment confirmed for user
Yes
MFA_DISABLED
MFA disabled for user
Yes
MFA_RECOVERY_USED
Recovery code used instead of TOTP
Yes
QUOTA_EXCEEDED
Upload rejected due to quota limit
No
Admin mutations — users, orgs, groups, folders
USER_CREATED
SFTP user created via admin surface
Yes
USER_UPDATED
User property changed (home path, quota, read-only, enabled, email, password)
Login rejected because the user's effective mount table would be inconsistent
No
AUTH_MOUNT_CONFLICT_SUPPRESSED
LDAP post-auth refresh skipped a group addition because it would introduce a mount conflict
No
License administration
LICENSE_UPDATE
Activation key installed or renewed via admin surface
Yes
LICENSE_CLEAR
Activation key removed via admin surface (server falls back to Free)
Yes
Update check
UPDATE_AVAILABLE
The update check found a newer published version than last
observed (fires once per new version, never on steady-state
checks)
No
UPDATE_CHECK_RUN
An administrator ran a manual update check ("Check Now" /
admin check-update)
Yes
The sftp_audit table also carries an executed_by
column populated for events that originate from an admin surface (Web, Swing,
CLI). Protocol-triggered events (uploads, downloads, session events) leave
it null. All timestamps are stored as UTC and displayed in the operator's
local timezone.
Every audit event can be tagged with one or more organizations via the
sftp_audit_to_organization link table. This lets the Audit view
filter events by tenant. Old rows (pre-identity-model) have no links and
surface in unfiltered queries only.
C. Configuration Quick Reference
The following table lists commonly used configuration settings, the file they belong
to, the XML element path, and the default value.
Listener Settings
Setting
File
Element
Default
SFTP port
sftp-server.xml
listeners/listener[@type=sftp]/port
22
FTP port
sftp-server.xml
listeners/listener[@type=ftp]/port
21
Bind address
sftp-server.xml
listeners/listener/bind-address
0.0.0.0
Idle timeout
sftp-server.xml
listeners/listener/idle-timeout-seconds
600
Auth timeout
sftp-server.xml
listeners/listener/auth-timeout-seconds
30
Threading
Setting
File
Element
Default
IO threads
sftp-server.xml
threading/io-threads
0 (auto)
Worker threads
sftp-server.xml
threading/worker-threads
0 (auto)
Authentication & Security
Setting
File
Element
Default
Auth provider
sftp-server.xml
user-manager/provider
xml
Lockout threshold
sftp-server.xml
password-policy/lockout-threshold
0 (disabled)
Lockout duration
sftp-server.xml
password-policy/lockout-duration-minutes
30
Filesystem & Uploads
Setting
File
Element
Default
Home root
filesystem-config.xml
home-root
${STYLUS_SFTPSERVER_HOME}/homes/${username}
Default access
filesystem-config.xml
default-access
read-write
Rename pattern
filesystem-config.xml
upload/rename-pattern
${basename}
On duplicate
filesystem-config.xml
upload/on-duplicate
timestamp-suffix
Orphan max age
filesystem-config.xml
upload/orphan-max-age
PT2H
Quota limit
filesystem-config.xml
quota/default-limit-bytes
1073741824 (1 GiB)
Quota enforcement
filesystem-config.xml
quota/enforcement
hard
Administration
Setting
File
Element
Default
Admin port
admin-console.xml
port
9980
Admin bind
admin-console.xml
bind-address
127.0.0.1
Portal enabled
admin-console.xml
file-portal/enabled
false
Portal max upload
admin-console.xml
file-portal/max-upload-bytes
1073741824 (1 GiB)
SFTP mount routing
sftp-server.xml
sftp-mount-routing/enabled
false (auto-enabled on first VD grant)
FTP mount routing
sftp-server.xml
ftp-mount-routing/enabled
false
Portal mount routing
admin-console.xml
file-portal/portal-mount-routing/enabled
false
D. Web Admin REST API Endpoints
The web admin console exposes the following REST API endpoints. All endpoints
require authentication via the /api/login endpoint unless otherwise
noted.
Authentication
Method
Endpoint
Description
POST
/api/login
Admin authentication
POST
/api/logout
End admin session
GET
/api/session/check
Check auth status
User Management
Method
Endpoint
Description
GET
/api/users
List users
POST
/api/users
Create user
DELETE
/api/users/{user}
Delete user
POST
/api/users/{user}/enable
Enable user
POST
/api/users/{user}/disable
Disable user
POST
/api/users/{user}/reset-password
Change password
POST
/api/users/{user}/unlock
Unlock account
GET
/api/users/{user}/quota
Get quota
POST
/api/users/{user}/quota
Set quota
DELETE
/api/users/{user}/quota
Clear quota
Audit & Sessions
Method
Endpoint
Description
GET
/api/audit
Query audit trail
GET
/api/sessions
List active sessions
POST
/api/sessions/{id}/kill
Kill session
Server Control
Method
Endpoint
Description
GET
/api/server/status
Server status
POST
/api/server/start
Start server
POST
/api/server/stop
Stop server
Configuration
Method
Endpoint
Description
GET
/api/config/listeners
Listener config
POST
/api/config/listeners
Update listeners
GET
/api/config/security
Security config
POST
/api/config/security
Update security
GET
/api/config/filesystem
Filesystem config
POST
/api/config/filesystem
Update filesystem
GET
/api/config/timeouts
Timeout config
POST
/api/config/timeouts
Update timeouts
GET
/api/config/notifications
Notification config
POST
/api/config/notifications
Update notifications
GET
/api/config/syslog
Syslog config
POST
/api/config/syslog
Update syslog
GET
/api/config/webhooks
Webhook config
Certificates
Method
Endpoint
Description
GET
/api/certs
List certificates
POST
/api/certs/import-pem
Import PEM
POST
/api/certs/import-p12
Import PKCS12
POST
/api/certs/generate
Generate self-signed
Identity Model
The identity endpoints operate on organizations, groups, virtual folders, and
the grants between them. All identity endpoints are gated by the
Standard edition or above.
Method
Endpoint
Description
GET
/api/orgs
List organizations
POST
/api/orgs
Create org
GET
/api/orgs/{id}
Get one org
PUT
/api/orgs/{id}
Update org
DELETE
/api/orgs/{id}
Delete org
GET
/api/orgs/{id}/groups
List groups in org
POST
/api/orgs/{id}/groups
Create group in org
GET
/api/groups
List all groups (across orgs)
GET
/api/groups/{id}
Get one group
PUT
/api/groups/{id}
Update group
DELETE
/api/groups/{id}
Delete group
GET
/api/groups/{id}/users
List members
POST
/api/groups/{id}/users
Add user to group
DELETE
/api/groups/{id}/users/{userId}
Remove user from group
GET
/api/users/{user}/memberships
List every group the user belongs to
GET
/api/users/{user}/folders
List every folder the user can reach
GET
/api/users/{user}/mount-conflicts
Diagnostic: mount conflicts for the user
GET
/api/folders
List virtual folders
POST
/api/folders
Register virtual folder
GET
/api/folders/{id}
Get one folder
PUT
/api/folders/{id}
Rename or repoint folder (409 on mount conflict)
DELETE
/api/folders/{id}
Remove folder + attached grants
GET
/api/folder-permissions
List grants
POST
/api/folder-permissions
Grant folder to group
PUT
/api/folder-permissions/{id}
Change grant permission
DELETE
/api/folder-permissions/{id}
Revoke grant
GET
/api/folder-health
Folder reconciler status
GET
/api/config/mount-routing
Read mount-routing toggles
PUT
/api/config/mount-routing
Change mount-routing toggles (hot-reload)
GET
/api/providers
List auth providers
GET
/api/providers/{id}/properties
List provider config properties
PUT
/api/providers/{id}/properties/{key}
Set provider config property (hot-reloads registry)
License
Method
Endpoint
Description
GET
/api/license
Show current activation.key summary
POST
/api/license
Install / renew activation.key (body: raw key text or base64)
DELETE
/api/license?confirm=true
Remove activation.key (falls back to Free on next restart)
Signing (Enterprise)
Method
Endpoint
Description
GET
/api/signing
Show signing key status (fingerprint, key ID, algorithm)
POST
/api/signing/generate
Generate a new signing keypair
POST
/api/signing/import
Import an armored PGP key
DELETE
/api/signing
Delete the signing key
Branding (Enterprise)
Method
Endpoint
Description
GET
/api/branding
Read Portal white-label configuration
PUT
/api/branding
Update Portal branding fields
POST
/api/branding/logo
Upload Portal logo image
POST
/api/branding/favicon
Upload Portal favicon
Public (Unauthenticated)
The following endpoints are served without authentication so download
recipients can verify signed releases with no Portal account.
Method
Endpoint
Description
GET
/KEYS
Operator's PGP public key (armored)
GET
/portal/KEYS
Alias for /KEYS
GET
/portal/tools/verify.jar
Verifier tool (shaded JAR)
GET
/portal/tools/verify-portable.zip
Verifier tool (portable bundle with jlink JRE + launchers)
Miscellaneous
Method
Endpoint
Description
POST
/api/test-email
Send test email
GET
/api/version
Server build number and edition
GET
/api/update-status
Update-check state + changes since the running version
POST
/api/update-check
Run an update check now (audited)
E. Supported SSH Algorithms
Stylus SFTP Server supports the following SSH algorithms. Default algorithms are
enabled out of the box; legacy algorithms can be enabled via the
security section of sftp-server.xml.
Ciphers
Algorithm
Status
chacha20-poly1305@openssh.com
Default
aes256-gcm@openssh.com
Default
aes128-gcm@openssh.com
Default
aes256-ctr
Default
aes192-ctr
Default
aes128-ctr
Default
aes128-cbc
Legacy (disabled)
aes192-cbc
Legacy (disabled)
aes256-cbc
Legacy (disabled)
MACs
Algorithm
Status
hmac-sha2-256-etm@openssh.com
Default
hmac-sha2-512-etm@openssh.com
Default
hmac-sha2-256
Default
hmac-sha2-512
Default
hmac-sha1
Legacy (disabled)
hmac-sha1-etm@openssh.com
Legacy (disabled)
Key Exchange
Algorithm
Status
mlkem768x25519-sha256
Default
curve25519-sha256
Default
curve25519-sha256@libssh.org
Default
ecdh-sha2-nistp256
Default
ecdh-sha2-nistp384
Default
ecdh-sha2-nistp521
Default
diffie-hellman-group-exchange-sha256
Default
diffie-hellman-group18-sha512
Default
diffie-hellman-group16-sha512
Default
diffie-hellman-group14-sha256
Default
Host Key Types
Type
Notes
RSA
Traditional; widely supported
ECDSA (P-256)
Elliptic curve; faster than RSA
Ed25519
Modern; compact keys; recommended
F. License Information
Stylus SFTP Server uses the following runtime dependencies. All are compatible
with commercial redistribution.
Library
License
SSH / SFTP Engine (built-in)
Apache 2.0
Apache FtpServer 1.2.0
Apache 2.0
H2 Database
MPL-2.0 / EPL-1.0
HikariCP
Apache 2.0
Caffeine
Apache 2.0
Bouncy Castle
MIT
Apache Commons Daemon
Apache 2.0
Eclipse Angus Mail
EPL-2.0 + GPLv2/CE
SLF4J
MIT
Log4j 2
Apache 2.0
Note
MySQL Connector/J (GPL-2.0) and PostgreSQL JDBC (BSD-2-Clause) are downloaded
at configuration time and are not bundled with the distribution.
