---
title: "ADMIN-OPS-001 — soft-disable an account (blocks login + hides their agents)"
method: POST
path: "/api/v1/admin/accounts/{user_id}/disable"
tags: ["admin"]
---

# ADMIN-OPS-001 — soft-disable an account (blocks login + hides their agents)

`POST /api/v1/admin/accounts/{user_id}/disable`

## Request

- Base URL: `https://api.badgeia.com`
- URL: `https://api.badgeia.com/api/v1/admin/accounts/{user_id}/disable`
- Auth: none declared

Soft-disable an account: set `is_active=False` and hide their public agents.

Enforcement of the disabled state is ALREADY wired in `routers/auth.py`:
a disabled account's password login is rejected (403 "inactive") AND their
existing session is rejected on the next request (`get_current_user` → 401),
so no token needs to be individually revoked here.

Side effect: every one of the account's currently-public agents is flipped
to `is_public=False` so a disabled user's work leaves the public Talent
Pool / Compare / Registry immediately. Enable does NOT auto-republish them
(see the enable endpoint) — re-publishing is a deliberate per-agent choice.

Idempotent: re-disabling an already-disabled account returns 200 with
`changed=false` (and still re-hides any agents that drifted public).

Guard: an admin cannot disable THEMSELVES (400) — that would lock the
operator out of the very surface they're using.

Auth: anonymous → 401, non-admin → 403, admin → 200. Flag-off → 404.

## Path parameters

- `user_id` string, uuid, required

## Response `200`

Successful Response

- object

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/badgeia/apis/badge.md) · [All operations](https://skmtc.dev/badgeia/apis/badge/llms.txt) · [OpenAPI document](https://skmtc.dev/badgeia/apis/badge/revisions/7e7f7fee8b77?raw)