Revoke superuser role

POST

/api/v1/users/{id}/revoke-superuser

const url = 'http://localhost:3000/api/v1/users/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/revoke-superuser';
const options = {method: 'POST', headers: {'X-API-Key': '<X-API-Key>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request POST \
  --url http://localhost:3000/api/v1/users/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/revoke-superuser \
  --header 'X-API-Key: <X-API-Key>'

Revokes superuser (system admin) role from a user. Requires Super Admin privileges.

Authorizations

api-key
bearer

Parameters

Path Parameters

required

string format: uuid

User UUID

Header Parameters

x-organization-id

string format: uuid

UUID of the organization (tenant) the request acts in. It selects the tenant and grants nothing: the server checks membership or an open tenant switch. Not needed for global operations. A malformed value returns 400. API keys are fixed to their own organization; another organization returns 403. The x-organization-source header grants nothing.

Responses

200

Superuser role revoked successfully

application/json

object

required

Unique user identifier

string format: uuid

email

required

User email address

string format: email

name

User display name

string

active

required

Whether the user account is active

boolean

emailVerified

required

Whether the user email has been verified

boolean

isSuperAdmin

required

Whether the user is a super admin with platform-wide privileges

boolean

createdAt

required

When the user was created

string format: date-time

updatedAt

required

When the user was last updated

string format: date-time

lastLoginAt

When the user last logged in

string format: date-time

identityProvider

FM-1069: the Keycloak identity-provider alias the user last authenticated through (e.g. the Entra broker alias), or null for a local realm login.

string

isFederated

required

FM-1069: whether the user authenticates through an external identity provider (federated). The UI hides the password-reset action when true, since federated users have no local password to reset.

boolean

pendingEmailVerification

required

True when this account cannot sign in to its organizations because its e-mail address is unverified AND it is not yet bound to a Keycloak identity. Both conditions matter: an unverified address only blocks the e-mail-keyed binding (FM-837), which is never attempted for an account that is already bound. An already-bound account with an unverified address signs in perfectly well, so flagging it would be a false alarm.

boolean

hasKeycloakLink

required

FM-1286: whether this account is bound to a Keycloak identity (users.keycloakId is set). A Super Admin can clear the binding when the Keycloak account was re-created, so the account re-links on its next sign-in with memberships intact. The Keycloak id itself is not exposed.

boolean

Example

{
  "id": "550e8400-e29b-41d4-a716-446655440000",
  "email": "john.doe@example.com",
  "name": "John Doe",
  "active": true,
  "emailVerified": true,
  "isSuperAdmin": false,
  "createdAt": "2024-01-15T10:30:00Z",
  "updatedAt": "2024-06-20T14:45:00Z",
  "lastLoginAt": "2024-12-20T09:15:00Z",
  "identityProvider": "entra",
  "isFederated": false,
  "pendingEmailVerification": false,
  "hasKeycloakLink": true
}

400

User does not have superuser role

401

Unauthorized

403

Forbidden - Super Admin required

404

User not found