> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cube.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Apply an action to many users

**🔒 Admin only.** Requires administrator privileges — the authenticated principal (API key, embed JWT, or any bearer token) must belong to a user with the admin role.

Apply one action to up to 100 users in a single request.

Request body:

* `action` — `DEACTIVATE` (revoke access and end the users' sessions), `ACTIVATE` (restore access to deactivated users), or `DELETE` (remove the users outright).
* `userIds` — the users to act on. Repeated ids are collapsed, so the response holds exactly one entry per distinct user requested.

**This endpoint is partially successful.** It returns `200` whenever the request itself is well formed, and reports each user's outcome separately:

* `succeeded` — ids of the users the action was applied to.
* `failed` — the users it was not applied to, each with an `error` carrying the `status` and `message` the single-user endpoint would have returned (`404` for an unknown id, `403` when a guard refuses the change).

An empty `failed` array means the whole batch applied. Users are processed one at a time in the order given, each in its own transaction, so earlier changes are **not** rolled back when a later user fails — the response is the record of what was applied.

Every guard of the single-user endpoints still applies, per user:

* The caller's own id fails rather than the request: `DEACTIVATE` on self is `403`, `DELETE` on self is `400`.
* A tenant must always keep at least one active, direct admin, so the action that would remove the last one fails with `403` while the rest of the batch still applies.

Reapplying an action a user is already in (deactivating a deactivated user) succeeds as a no-op.


## OpenAPI

````yaml /api-reference/api.yaml post /api/v1/users/bulk
openapi: 3.1.0
info:
  title: Cube Platform API
  version: 1.0.0
  description: >-
    Programmatically manage Cube: deployments and everything scoped to them

    (environments, folders, reports, workbooks, notifications, workspace, and
    agents),

    plus account-level users, groups, policies, embedding, and AI settings.
    Data-model

    authoring, dev mode, branches, and uploads live under /build/api/v1 — same
    host and

    token, routed to the build pods.
servers:
  - url: https://{tenant}.cubecloud.dev
    description: Your tenant host. Replace the whole host if you use a custom domain.
    variables:
      tenant:
        default: your-tenant
        description: Your Cube tenant subdomain
security:
  - bearerAuth: []
tags:
  - name: Deployments
  - name: Deployment Creation
  - name: Environments
  - name: Env Variables
  - name: Regions
  - name: Data Model
  - name: Data Model Uploads
  - name: GitHub
  - name: GitHub Connection
  - name: dbt Sync
  - name: Folders
  - name: Reports
  - name: Workbooks
  - name: Notifications
  - name: Workspace
  - name: Users Admin
  - name: User Attributes
  - name: User Attribute Values
  - name: Tenant Settings
  - name: OAuth Integrations
  - name: User OAuth Tokens
  - name: OIDC Token Configs
  - name: App Theme
  - name: Embed
  - name: Embed Tenants
  - name: Dashboard Embed Access
paths:
  /api/v1/users/bulk:
    post:
      tags:
        - Users Admin
      summary: Apply an action to many users
      operationId: bulkUserAction
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/BulkUserActionInput'
        description: BulkUserActionInput
        required: false
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BulkUserActionPayload'
          description: ''
components:
  schemas:
    BulkUserActionInput:
      properties:
        action:
          $ref: '#/components/schemas/BulkUserActionInputAction'
        userIds:
          items:
            type: integer
          maxItems: 100
          minItems: 1
          type: array
      required:
        - action
        - userIds
      type: object
    BulkUserActionPayload:
      properties:
        action:
          $ref: '#/components/schemas/BulkUserActionResponseAction'
        failed:
          items:
            $ref: '#/components/schemas/BulkUserActionFailure'
          type: array
        succeeded:
          items:
            type: integer
          type: array
      required:
        - action
        - succeeded
        - failed
      type: object
    BulkUserActionInputAction:
      enum:
        - DEACTIVATE
        - ACTIVATE
        - DELETE
      type: string
    BulkUserActionResponseAction:
      enum:
        - DEACTIVATE
        - ACTIVATE
        - DELETE
      type: string
    BulkUserActionFailure:
      properties:
        error:
          $ref: '#/components/schemas/BulkActionError'
        userId:
          type: integer
      required:
        - userId
        - error
      type: object
    BulkActionError:
      properties:
        message:
          type: string
        status:
          type: integer
      required:
        - status
        - message
      type: object
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: 'Token authentication. Send `Authorization: Bearer <YOUR_TOKEN>`.'

````