Disable user

Request description

Endpoint: /users/:id/disable
Method: PATCH

The following parameter must be passed through the URL:

• id: specifies the unique user identifier. Get it from Users list
  

No request body is required.

Header

{
  "Content-Type": "application/json",
  "Authorization": "Bearer <accessToken>"
}

Note: the <accessToken> is obtained as a result of the authentication. This endpoint only accepts the access token of a platform user with the Organization Owner or Organization Admin role.

Behaviour

• A disabled user cannot sign in to the platform. The user and their data are kept, and they can be enabled again with Enable user.
• The user must belong only to your organization. A user who also belongs to other organizations cannot be disabled through this API.
• An Organization Admin cannot disable an Organization Owner. Only an Organization Owner can.
• You cannot disable yourself.
• The request is idempotent: disabling a user who is already disabled returns 200.
• The administrators of your organization receive a notification.

Responses

Correct response

{
  // empty response
}

Wrong responses

{
  "message": "Unauthorized"
}

Description: this error occurs when endpoint authorizers fail to validate the token sent in the request header.

{
  "errorType": "InvalidParameters",
  "errorMessage": "User not found",
  "message": "User not found",
  "details": [
    /* validation detail */
  ]
}

Description: there is no user with the identifier sent in the URL.

type DisableUserResponseType = {
  errorType: DISABLE_USER_ERROR_TYPE;
  errorMessage?: string;
  message?: string;
  details?: object[];  // Present on validation errors
};

enum DISABLE_USER_ERROR_TYPE {
  INVALID_REQUEST_FORMAT = "invalidRequestFormat",
  UNAUTHORIZED_RESOURCE = "unauthorizedResource",
  ERROR_LOCKING_USER = "ERROR_LOCKING_USER",
}

{
  "errorType": "notAllowedResource",
  "errorMessage": "Unauthorized",
  "message": "Unauthorized"
}

{
  "errorType": "notAllowedResource",
  "errorMessage": "User does not have permission to enable or disable themselves",
  "message": "User does not have permission to enable or disable themselves"
}

{
  "errorType": "notAllowedResource",
  "errorMessage": "The user belongs to other organizations and cannot be enabled or disabled",
  "message": "The user belongs to other organizations and cannot be enabled or disabled"
}

{
  "message": "Error locking user"
}

Description: the user could not be disabled, or the change could not be confirmed. The user may still be able to sign in. You can retry the request: it is idempotent.