Skip to main content
POST
Apply an action to many users
πŸ”’ Admin only. Requires administrator privileges β€” the authenticated principal (API key, embed JWT, or any bearer token) must belong to a user with the admin role. Apply one action to up to 100 users in a single request. Request body:
  • action β€” DEACTIVATE (revoke access and end the users’ sessions), ACTIVATE (restore access to deactivated users), or DELETE (remove the users outright).
  • userIds β€” the users to act on. Repeated ids are collapsed, so the response holds exactly one entry per distinct user requested.
This endpoint is partially successful. It returns 200 whenever the request itself is well formed, and reports each user’s outcome separately:
  • succeeded β€” ids of the users the action was applied to.
  • failed β€” the users it was not applied to, each with an error carrying the status and message the single-user endpoint would have returned (404 for an unknown id, 403 when a guard refuses the change).
An empty failed array means the whole batch applied. Users are processed one at a time in the order given, each in its own transaction, so earlier changes are not rolled back when a later user fails β€” the response is the record of what was applied. Every guard of the single-user endpoints still applies, per user:
  • The caller’s own id fails rather than the request: DEACTIVATE on self is 403, DELETE on self is 400.
  • A tenant must always keep at least one active, direct admin, so the action that would remove the last one fails with 403 while the rest of the batch still applies.
Reapplying an action a user is already in (deactivating a deactivated user) succeeds as a no-op.

Authorizations

Authorization
string
header
required

Token authentication. Send Authorization: Bearer <YOUR_TOKEN>.

Body

application/json

BulkUserActionInput

action
enum<string>
required
Available options:
DEACTIVATE,
ACTIVATE,
DELETE
userIds
integer[]
required
Required array length: 1 - 100 elements

Response

200 - application/json
action
enum<string>
required
Available options:
DEACTIVATE,
ACTIVATE,
DELETE
failed
object[]
required
succeeded
integer[]
required