Disable user

POST

/api/v1/users/{id}/disable

curl --request POST \
  --url http://localhost:3000/api/v1/users/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/disable \
  --header 'Content-Type: application/json' \
  --header 'X-API-Key: <X-API-Key>' \
  --data '{ "reason": "example" }'

• Development
• Production

Disables a user account. Requires Super Admin privileges. Cannot disable yourself or other superusers unless you are a superuser.

Authorizations

• api-key
• bearer

Parameters

Path Parameters

id

required

string format: uuid

User UUID

Request Body^required

Media typeapplication/json

object

reason

Reason for disabling the user

string

Example^generated

{
  "reason": "example"
}

Responses

200

User disabled successfully

Media typeapplication/json

object

id

required

Unique user identifier

string format: uuid

email

required

User email address

string format: email

name

User display name

string

active

required

Whether the user account is active

boolean

emailVerified

required

Whether the user email has been verified

boolean

isSuperAdmin

required

Whether the user is a super admin with platform-wide privileges

boolean

createdAt

required

When the user was created

string format: date-time

updatedAt

required

When the user was last updated

string format: date-time

lastLoginAt

When the user last logged in

string format: date-time

identityProvider

FM-1069: the Keycloak identity-provider alias the user last authenticated through (e.g. the Entra broker alias), or null for a local realm login.

string

isFederated

required

FM-1069: whether the user authenticates through an external identity provider (federated). The UI hides the password-reset action when true, since federated users have no local password to reset.

boolean

pendingEmailVerification

required

True when this account cannot sign in to its organizations because its e-mail address is unverified AND it is not yet bound to a Keycloak identity. Both conditions matter: an unverified address only blocks the e-mail-keyed binding (FM-837), which is never attempted for an account that is already bound. An already-bound account with an unverified address signs in perfectly well, so flagging it would be a false alarm.

boolean

Example

{
  "id": "550e8400-e29b-41d4-a716-446655440000",
  "email": "john.doe@example.com",
  "name": "John Doe",
  "active": true,
  "emailVerified": true,
  "isSuperAdmin": false,
  "createdAt": "2024-01-15T10:30:00Z",
  "updatedAt": "2024-06-20T14:45:00Z",
  "lastLoginAt": "2024-12-20T09:15:00Z",
  "identityProvider": "entra",
  "isFederated": false,
  "pendingEmailVerification": false
}

400

User is already disabled

401

Unauthorized

403

Forbidden - Cannot disable yourself or superusers

404

User not found