Account resources are used to manage BMC local accounts, role privileges, and password policies.
Authentication and Privileges
The APIs on this page support HTTP Basic Auth and session tokens. The token is carried in the X-Xsrf-Token request header. To query or manage other accounts, the current user typically needs the ConfigureUsers privilege.
The current implementation uses the account's Role field to distinguish roles, and queries or configures specific privileges through the /Privileges resource.
Roles Resource Currently Unavailable
The /redfish/v1/AccountService response contains links to /redfish/v1/AccountService/Roles and /redfish/v1/AccountService/PrivilegeMap, but the backend currently does not register these two sets of routes. Requests to a live device return 404 page not found; clients should not follow these two links.
Query the configurable privilege parameters for the Administrator and CommonUser roles. The administrator role returns functional privileges, and the common user role returns the accessible board core IDs.
Item Content Method GETPath /redfish/v1/AccountService/Privileges/HelpAuthentication HTTP Basic Auth or X-Xsrf-Token Request body None Success status code 200 OK
Query privileges available for roles curl --user '<username>:<password>' \ --header 'Accept: application/json' \ '<protocol>://<device-ip>:<port>/redfish/v1/AccountService/Privileges/Help'
{ "Parameters" : { "Administrator" : [ "Login" , "ConfigureComponents" , "ConfigureSelf" , "ConfigureUsers" , "OemConfigureRemote" , "OemConfigureNetwork" , "OemConfigureFirewall" , "OemPowerControl" , "OemUpgrade" , "OemDebug" , "OemConfigureNtp" ], "CommonUser" : [ "<core-id>" ] } } Field Type Description Parametersobject Available privileges grouped by role. Parameters.Administratorarray List of functional privilege strings configurable for the administrator. Parameters.CommonUserarray List of board core IDs on the current device that can be assigned to common users.
Item Content Method GETPath /redfish/v1/AccountService/PrivilegesSuccess status code 200 OK
Query the account privilege collection using a token curl --header 'X-Xsrf-Token: <token>' \ --header 'Accept: application/json' \ '<protocol>://<device-ip>:<port>/redfish/v1/AccountService/Privileges' { "@odata.context" : "/redfish/v1/$metadata#ManagerPrivilegeCollection.ManagerPrivilegeCollection" , "@odata.id" : "/redfish/v1/AccountService/Privileges" , "@odata.type" : "#ManagerPrivilegeCollection.ManagerPrivilegeCollection" , "Members" : [ { "@odata.id" : "/redfish/v1/AccountService/Privileges/admin" } ], "Members@odata.count" : 1 , "Name" : "Privilege Collection" } Field Type Description @odata.contextstring OData metadata context of the privilege collection. @odata.idstring Path of the privilege collection. @odata.typestring Type of the privilege collection. Membersarray List of account privilege resource links. Members[].@odata.idstring Privilege resource path of the specified account. Members@odata.countinteger Number of privilege resources. Namestring Name of the privilege collection.
Item Content Method GETPath /redfish/v1/AccountService/Privileges/{account-id}Path parameter account-id, the account nameSuccess status code 200 OK
Query privileges of a specified account using a token curl --header 'X-Xsrf-Token: <token>' \ --header 'Accept: application/json' \ '<protocol>://<device-ip>:<port>/redfish/v1/AccountService/Privileges/<account-id>' { "@odata.context" : "/redfish/v1/$metadata#ManagerPrivilege.ManagerPrivilege" , "@odata.id" : "/redfish/v1/AccountService/Privileges/<account-id>" , "@odata.type" : "#ManagerPrivilege.v1_0_0.ManagerPrivilege" , "AssignedPrivileges" : [ "Login" , "ConfigureSelf" , "ConfigureUsers" ], "Description" : "Privilege" , "Name" : "Privilege" , "Oem" : { "Firefly" : { "Role" : "Administrator" , "UserName" : "<account-id>" } } } Field Type Description @odata.contextstring OData context of the account privilege resource. @odata.idstring Path of the current account privilege resource. @odata.typestring Type of the account privilege resource. AssignedPrivilegesarray | null Assigned privileges. Administrator returns functional privileges, CommonUser returns board core IDs, and it can be null when nothing is assigned. Descriptionstring Resource description. Namestring Resource name. Oemobject OEM extension information. Oem.Fireflyobject Firefly account privilege information. Oem.Firefly.Rolestring Account role. Oem.Firefly.UserNamestring Account name.
For an Administrator account, pass a list of functional privileges; for a CommonUser account, pass a list of board core IDs. Call 1.1 first to obtain the currently available values.
Item Content Method PATCHPath /redfish/v1/AccountService/Privileges/{account-id}Request body JSON array of strings Success status code 200 OK
Configure boards accessible to a common user using a token curl --request PATCH \ --header 'X-Xsrf-Token: <token>' \ --header 'Content-Type: application/json' \ --data '["<core-id>"]' \ '<protocol>://<device-ip>:<port>/redfish/v1/AccountService/Privileges/<account-id>' Field Type Required Description Request body array Yes List of privilege strings. Array elements must come from the corresponding role list returned by 1.1.
{ "@odata.type" : "#Message.v1_1_1.Message" , "Timestamp" : "1785836138" , "MessageId" : "Base.1.11.0.Success" , "Message" : "The request completed successfully." , "MessageArgs" : [], "MessageSeverity" : "OK" , "Severity" : "" , "Oem" : null , "RelatedProperties" : null , "Resolution" : "None" } Field Type Description @odata.typestring Redfish Message type. Timestampstring Timestamp string generated by the server when the message was produced. MessageIdstring Message identifier; Base.1.11.0.Success on success. Messagestring Description of the operation result. MessageArgsarray Message formatting arguments; an empty array on success. MessageSeveritystring Message severity; OK on success. Severitystring Compatibility severity field. Oemobject | null OEM extension information. RelatedPropertiesarray | null Resource properties related to the message. Resolutionstring Suggested follow-up action.
Item Content Method GETPath /redfish/v1/AccountService/AccountsSuccess status code 200 OK
Query the account collection curl --user '<username>:<password>' \ --header 'Accept: application/json' \ '<protocol>://<device-ip>:<port>/redfish/v1/AccountService/Accounts'
{ "@odata.context" : "/redfish/v1/$metadata#ManagerAccountCollection.ManagerAccountCollection" , "@odata.id" : "/redfish/v1/AccountService/Accounts" , "@odata.type" : "#ManagerAccountCollection.ManagerAccountCollection" , "Members" : [ { "@odata.id" : "/redfish/v1/AccountService/Accounts/admin" } ], "Members@odata.count" : 1 , "Name" : "Accounts Collection" } Field Type Description @odata.contextstring OData context of the account collection. @odata.idstring Path of the account collection. @odata.typestring Type of the account collection. Membersarray List of account resource links. Members[].@odata.idstring Resource path of the specified account. Members@odata.countinteger Number of accounts. Namestring Name of the account collection.
Item Content Method GETPath /redfish/v1/AccountService/Accounts/{account-id}Success status code 200 OK
Query a specified account using a token curl --header 'X-Xsrf-Token: <token>' \ --header 'Accept: application/json' \ '<protocol>://<device-ip>:<port>/redfish/v1/AccountService/Accounts/<account-id>' 200 OK·Live device structure { "@odata.context" : "/redfish/v1/$metadata#ManagerAccount.ManagerAccount" , "@odata.id" : "/redfish/v1/AccountService/Accounts/<account-id>" , "@odata.type" : "#ManagerAccount.v1_10_0.ManagerAccount" , "CreateTime" : "2026-08-05T13:20:59.197+08:00" , "Description" : "User Account" , "Email" : "user@example.com" , "Enabled" : true , "Locked" : false , "Name" : "User Account" , "Password" : "" , "RoleId" : "CommonUser" , "UpdateTime" : "2026-08-05T13:20:59.197+08:00" , "UserName" : "<account-id>" } Field Type Description @odata.contextstring OData context of the account resource. @odata.idstring Path of the current account resource. @odata.typestring Type of the account resource. CreateTimestring Account creation time. Descriptionstring Account resource description. Emailstring Account email address. Enabledboolean Whether the account is enabled. Lockedboolean Whether the account is locked. Namestring Account resource name. Passwordstring Password field. Queries always return an empty string; the password or its hash is never returned. RoleIdstring Account role, for example Administrator or CommonUser. UpdateTimestring Last update time of the account. UserNamestring Account name.
Item Content Method POSTPath /redfish/v1/AccountService/AccountsSuccess status code 200 OK
curl --request POST \ --user '<username>:<password>' \ --header 'Content-Type: application/json' \ --data '{ "UserName": "api-user", "Password": "<new-password>", "Role": "CommonUser", "Email": "user@example.com", "Locked": false, "Enabled": true }' \ '<protocol>://<device-ip>:<port>/redfish/v1/AccountService/Accounts'
Field Type Required Description UserNamestring Yes New account name; must not duplicate an existing account. Passwordstring Yes New account password; must satisfy the current account service length and complexity policies. Rolestring Yes Account role. The current creation parameters support Administrator and CommonUser. Emailstring Yes Account email address. Lockedboolean Yes Whether the account is initially locked. Enabledboolean Yes Whether the account is initially enabled.
{ "@odata.type" : "#Message.v1_1_1.Message" , "Timestamp" : "1785836138" , "MessageId" : "Base.1.11.0.Success" , "Message" : "The request completed successfully." , "MessageArgs" : [], "MessageSeverity" : "OK" , "Severity" : "" , "Oem" : null , "RelatedProperties" : null , "Resolution" : "None" } Field Type Description @odata.typestring Redfish Message type. Timestampstring Timestamp string generated by the server when the message was produced. MessageIdstring Message identifier; Base.1.11.0.Success on success. Messagestring Description of the operation result. MessageArgsarray Message formatting arguments; an empty array on success. MessageSeveritystring Message severity; OK on success. Severitystring Compatibility severity field. Oemobject | null OEM extension information. RelatedPropertiesarray | null Resource properties related to the message. Resolutionstring Suggested follow-up action.
The account's password, role, email address, enabled state, and locked state can be modified. The API does not allow modifying the username.
Item Content Method PATCHPath /redfish/v1/AccountService/Accounts/{account-id}Success status code 200 OK
Modify an account using a token curl --request PATCH \ --header 'X-Xsrf-Token: <token>' \ --header 'Content-Type: application/json' \ --data '{ "Email": "updated@example.com", "Enabled": true, "Locked": false }' \ '<protocol>://<device-ip>:<port>/redfish/v1/AccountService/Accounts/<account-id>' Field Type Required Description Passwordstring No New password. After modification, the account's existing sessions are revoked. Rolestring No New role. When the role changes, old privileges that do not apply to the new role are cleaned up. Emailstring No New email address. The current implementation does not clear the email address with an empty string. Lockedboolean No Whether to lock the account. Enabledboolean No Whether to enable the account. UserNamestring Forbidden The username is determined by account-id in the URL; a non-empty UserName must not be passed in the request body.
Limitations When Modifying Your Own Account
When the current account modifies itself, only the password or email address can be changed; modifying its own role, Enabled, or Locked is not allowed.
{ "@odata.type" : "#Message.v1_1_1.Message" , "Timestamp" : "1785836138" , "MessageId" : "Base.1.11.0.Success" , "Message" : "The request completed successfully." , "MessageArgs" : [], "MessageSeverity" : "OK" , "Severity" : "" , "Oem" : null , "RelatedProperties" : null , "Resolution" : "None" } Field Type Description @odata.typestring Redfish Message type. Timestampstring Timestamp string generated by the server when the message was produced. MessageIdstring Message identifier; Base.1.11.0.Success on success. Messagestring Description of the operation result. MessageArgsarray Message formatting arguments; an empty array on success. MessageSeveritystring Message severity; OK on success. Severitystring Compatibility severity field. Oemobject | null OEM extension information. RelatedPropertiesarray | null Resource properties related to the message. Resolutionstring Suggested follow-up action.
Item Content Method DELETEPath /redfish/v1/AccountService/Accounts/{account-id}Request body None Success status code 200 OK
Delete an account using a token curl --request DELETE \ --header 'X-Xsrf-Token: <token>' \ '<protocol>://<device-ip>:<port>/redfish/v1/AccountService/Accounts/<account-id>'
Built-in Accounts Cannot Be Deleted
The backend rejects deletion of reserved built-in accounts. After an account is deleted, its existing sessions also become invalid.
{ "@odata.type" : "#Message.v1_1_1.Message" , "Timestamp" : "1785836138" , "MessageId" : "Base.1.11.0.Success" , "Message" : "The request completed successfully." , "MessageArgs" : [], "MessageSeverity" : "OK" , "Severity" : "" , "Oem" : null , "RelatedProperties" : null , "Resolution" : "None" } Field Type Description @odata.typestring Redfish Message type. Timestampstring Timestamp string generated by the server when the message was produced. MessageIdstring Message identifier; Base.1.11.0.Success on success. Messagestring Description of the operation result. MessageArgsarray Message formatting arguments; an empty array on success. MessageSeveritystring Message severity; OK on success. Severitystring Compatibility severity field. Oemobject | null OEM extension information. RelatedPropertiesarray | null Resource properties related to the message. Resolutionstring Suggested follow-up action.
Query the account parameter help information generated by the backend.
Item Content Method GETPath /redfish/v1/AccountService/Accounts/HelpSuccess status code 200 OK
Query account request parameters using a token curl --header 'X-Xsrf-Token: <token>' \ --header 'Accept: application/json' \ '<protocol>://<device-ip>:<port>/redfish/v1/AccountService/Accounts/Help' 200 OK·Current implementation { "Parameters" : [ { "DisallowedInput" : false , "AllowablePattern" : "" , "DataType" : "String" , "Name" : "Enabled" , "Required" : true }, { "DisallowedInput" : false , "AllowablePattern" : "" , "DataType" : "String" , "Name" : "Enabled" , "Required" : true }, { "DisallowedInput" : false , "AllowablePattern" : "" , "AllowableValues" : [ "Administrator" , "CommonUser" ], "DataType" : "String" , "Name" : "Role" , "Required" : true }, { "DisallowedInput" : false , "AllowablePattern" : "" , "DataType" : "String" , "Name" : "Email" , "Required" : true }, { "DisallowedInput" : false , "AllowablePattern" : "" , "DataType" : "Boolean" , "Name" : "Locked" , "Required" : true }, { "DisallowedInput" : false , "AllowablePattern" : "" , "DataType" : "Boolean" , "Name" : "Enabled" , "Required" : true } ] } Field Type Description Parametersarray List of account request parameter metadata. Parameters[].DisallowedInputboolean Whether input of this parameter is disallowed. Parameters[].AllowablePatternstring Matching pattern for allowed values. Parameters[].AllowableValuesarray List of selectable values; returned only for some parameters. Parameters[].DataTypestring Data type of the parameter. Parameters[].Namestring Parameter name. Parameters[].Requiredboolean Whether the parameter is required.
Known Issue in the Help Response
In the current Help response, the first two string parameters are incorrectly labeled as Enabled; the actual account creation request fields are UserName and Password. When calling the API, refer to the request fields table in 2.3.
Item Content Method GETPath /redfish/v1/AccountServiceSuccess status code 200 OK
Query the account service configuration curl --user '<username>:<password>' \ --header 'Accept: application/json' \ '<protocol>://<device-ip>:<port>/redfish/v1/AccountService'
200 OK·Live device response { "@odata.context" : "/redfish/v1/$metadata#AccountService" , "@odata.id" : "/redfish/v1/AccountService" , "@odata.type" : "#AccountService.v1_12_0.AccountService" , "AccountLockoutDuration" : 5 , "AccountLockoutThreshold" : 5 , "Accounts" : { "@odata.id" : "/redfish/v1/AccountService/Accounts" }, "Id" : "AccountService" , "MaxPasswordLength" : 20 , "MinPasswordLength" : 5 , "Name" : "Account Service" , "Oem" : { "PasswordComplexityCheckEnabled" : false , "PasswordComplexitynumber" : false , "PasswordHistoryRecords" : true , "PasswordLowercaseletters" : false , "PasswordSpecialcharacters" : false , "PasswordUppercaseletters" : false }, "PrivilegeMap" : { "@odata.id" : "/redfish/v1/AccountService/PrivilegeMap" }, "Roles" : { "@odata.id" : "/redfish/v1/AccountService/Roles" } } Field Type Description @odata.contextstring OData context of AccountService. @odata.idstring Account service resource path. @odata.typestring AccountService resource type. AccountLockoutDurationinteger Lockout duration after the lockout threshold is reached. AccountLockoutThresholdinteger Number of failed attempts that triggers an account lockout. Accountsobject Account collection resource link. Accounts.@odata.idstring Account collection path. Idstring Resource identifier. MaxPasswordLengthinteger Maximum password length. MinPasswordLengthinteger Minimum password length. Namestring Resource name. Oemobject Firefly password policy extensions. Oem.PasswordComplexityCheckEnabledboolean Whether password complexity checking is enabled. Oem.PasswordComplexitynumberboolean Whether the password must contain a digit. Oem.PasswordHistoryRecordsboolean Whether the password history policy is enabled. Oem.PasswordLowercaselettersboolean Whether the password must contain a lowercase letter. Oem.PasswordSpecialcharactersboolean Whether the password must contain a special character. Oem.PasswordUppercaselettersboolean Whether the password must contain an uppercase letter. PrivilegeMapobject Privilege mapping resource link; the link target is currently not registered. PrivilegeMap.@odata.idstring Privilege mapping resource path. Rolesobject Role collection resource link; the link target is currently not registered. Roles.@odata.idstring Role collection resource path.
Modify password length, account lockout, and password complexity policies. This API supports partial updates; only the fields to be modified need to be passed.
Item Content Method PATCHPath /redfish/v1/AccountServiceSuccess status code 200 OK
Configure the account service using a token curl --request PATCH \ --header 'X-Xsrf-Token: <token>' \ --header 'Content-Type: application/json' \ --data '{ "MinPasswordLength": 8, "MaxPasswordLength": 20, "AccountLockoutThreshold": 5, "AccountLockoutDuration": 5, "Oem": { "PasswordHistoryRecords": true, "PasswordComplexityCheckEnabled": true, "PasswordUppercaseletters": true, "PasswordLowercaseletters": true, "PasswordComplexitynumber": true, "PasswordSpecialcharacters": true } }' \ '<protocol>://<device-ip>:<port>/redfish/v1/AccountService' Field Type Required Description MinPasswordLengthinteger No Minimum password length. MaxPasswordLengthinteger No Maximum password length. AccountLockoutThresholdinteger No Number of failed attempts that triggers an account lockout. AccountLockoutDurationinteger No Account lockout duration. Oemobject No Firefly password policy extensions. Oem.PasswordHistoryRecordsboolean No Whether to enable password history records. Oem.PasswordComplexityCheckEnabledboolean No Whether to enable password complexity checking. Oem.PasswordUppercaselettersboolean No Whether uppercase letters are required. Oem.PasswordLowercaselettersboolean No Whether lowercase letters are required. Oem.PasswordComplexitynumberboolean No Whether digits are required. Oem.PasswordSpecialcharactersboolean No Whether special characters are required.
On successful configuration, a generic Message is not returned; instead, the complete updated AccountService resource is returned.
200 OK·Live device response { "@odata.context" : "/redfish/v1/$metadata#AccountService" , "@odata.id" : "/redfish/v1/AccountService" , "@odata.type" : "#AccountService.v1_12_0.AccountService" , "AccountLockoutDuration" : 5 , "AccountLockoutThreshold" : 5 , "Accounts" : { "@odata.id" : "/redfish/v1/AccountService/Accounts" }, "Id" : "AccountService" , "MaxPasswordLength" : 20 , "MinPasswordLength" : 5 , "Name" : "Account Service" , "Oem" : { "PasswordComplexityCheckEnabled" : false , "PasswordComplexitynumber" : false , "PasswordHistoryRecords" : true , "PasswordLowercaseletters" : false , "PasswordSpecialcharacters" : false , "PasswordUppercaseletters" : false }, "PrivilegeMap" : { "@odata.id" : "/redfish/v1/AccountService/PrivilegeMap" }, "Roles" : { "@odata.id" : "/redfish/v1/AccountService/Roles" } } The response fields are the same as the "Response Fields" in 3.1, with each policy field showing the updated value.
How Password Complexity Takes Effect
Only when PasswordComplexityCheckEnabled is true does the backend check new passwords against the other password policy fields. Before creating an account or changing a password, it is recommended to query the current account service configuration first.
