Managed SFTP

SFTP is still how most counterparties in investment operations deliver files: fund administrators push NAV packs, custodians push holdings and transactions, market data vendors push end-of-day extracts. Managed SFTP gives your workspace an SFTP server that SPARK hosts. Each counterparty signs in with its own account and SSH key, drops files into its folder, and SPARK picks them up.

SPARK only receives. A counterparty pushes files to SPARK; SPARK does not pull files from someone else's server. For files that arrive by email, see the Mailbox.

Open the Managed SFTP page

1. In the left sidebar, open the Settings tab.
2. Under Extensions, select SFTP.

The page is titled Managed SFTP: Receive files directly in your workspace over SFTP, from accounts that sign in with SSH keys. It is also one click away from the Files page, whose SFTP button opens it. Old links to the page under Workspace, or to Integrations, land here.

Everyone in the workspace can open the page and see its users. Activating it, creating users and adding keys need the Editor or Administrator role; deleting a user or a key needs Administrator.

Set up SFTP

Setting up a counterparty takes three steps: switch Managed SFTP on once, create an SFTP user for the counterparty, and add the SSH key it signs in with.

Turn it on

While Managed SFTP is off, the page shows Managed SFTP is off for this workspace and an Activate button. Click Activate. The page then lists the workspace's SFTP users, with New and a ⋯ menu in its header; while there are none, it says No SFTP users yet and offers New user. Where your deployment offers no SFTP, the page shows the line without the button; ask NGT's support team.

To turn it off again, open the header's ⋯ and choose Deactivate, then confirm in Deactivate Managed SFTP?. Its users and their SSH keys are kept, and show again once it is activated.

Create an SFTP user

Give each counterparty its own user, so each has its own folder and its own keys, and you can remove one without touching the others.

1. Click New. The New SFTP user dialog opens: The username prefix is fixed; you choose only the suffix.
2. Type a Username suffix, for example reports or custodian-a. The workspace's prefix stands fixed in front of it, and Username preview shows the full username as you type.
3. Click Create user.

The suffix takes lowercase letters, digits, dashes and underscores, and must start and end with a letter or digit. The full username, prefix included, is limited to 32 characters, which leaves 15 for the suffix. Two users in a workspace cannot share a suffix.

As soon as the user exists, its SSH keys dialog opens on Instructions, since a user cannot sign in until it has a key.

Add an SSH key

Managed SFTP signs in with SSH keys only, never passwords. SPARK stores only the public key; the private key stays with whoever connects. Never paste a private key into SPARK, a thread or a workflow.

The SSH keys dialog walks through it on its Instructions tab:

1. Generate a key. Pick your system, macOS, Windows or Linux (the dialog opens on the one you are using), and copy the command with its copy button. Run it in a terminal, or in PowerShell on Windows. It creates an ed25519 key saved under the SFTP username, for example ~/.ssh/sftp_..._reports, so the keys for several users stay apart. On macOS and Windows it also copies the public key to your clipboard; on Linux it prints it.
2. Add a key. Paste the public key into the box. It must start with a key type such as ssh-ed25519 or ssh-rsa. Click Add key.

Once the key is added, the dialog moves to Active keys and opens Connect and upload over it.

When the key is for a counterparty, send them the username and ask for their public key instead: they generate the key on their side, and you paste only its public half under Add a key.

Connect and upload

Connect and upload shows how to sign in as the user and send a file:

• Connect: the command sftp -i ~/.ssh/<username> <username>@<host>, with its copy button. Run it where the key was generated. It opens the sftp> prompt in the user's upload folder.
• Upload a file: at the sftp> prompt, put report.csv sends a file from the folder you started in.

Supported files are .csv, .txt, .pdf, .xlsx and .xls. Any other file never reaches Files.

Manage a user's keys

Click a user's row, or choose Manage keys from its ⋯, to open its SSH keys dialog. It opens on Active keys, which counts the user's keys and lists each by its name, or by the comment at the end of the key, which ssh-keygen sets to the person and machine that made it. A user can hold several keys at once. Each key's row has Connect and upload and Delete key.

• To rotate a key, add the new one, confirm it connects, then delete the old one with Delete key. SPARK keeps no expiry date on a key, so record the next rotation somewhere, for example as a task with a due date.
• Deleting a key cuts off anyone still connecting with it.

The user's ⋯ also offers Copy username and Delete user. Deleting a user removes it, its SSH keys and its files on the SFTP server, and cannot be undone.

What happens to an uploaded file

When a counterparty uploads a file to its folder:

1. SPARK picks the file up, stores it on the Files page under the name it was uploaded with, and removes it from the SFTP folder.
2. The file carries two labels: Uploaded with SFTP, and the user's suffix, such as fabrikam-nav, so Files shows how it came and from whom.
3. The file starts every active workflow whose File Received trigger matches its name. See File-triggered workflows.

SPARK keeps each file it receives, a repeated one included, so the original is always there as the record of what was delivered.

Where to go next

• File-triggered workflows
• Organize files
• Receive files by email: Mailbox
• Let agents search the web: Web Search
• Teams & roles