---
title: "Deprovision an app user"
method: DELETE
path: "/api/apps/{app_id}/users/provisions"
---

# Deprovision an app user

`DELETE /api/apps/{app_id}/users/provisions`

## Request

- Base URL: `https://app.base44.com`
- URL: `https://app.base44.com/api/apps/{app_id}/users/provisions`
- Auth: one of:
  - HTTP bearer
  - API key in header `api_key`
  - HTTP bearer

<Info>This API is in beta. Endpoints, fields, and behavior may still change, so avoid depending on it in production.</Info>

Removes a person's access to this app, including their app user if they've already signed in. Call it with a personal access token whose owner can edit the app, or with a workspace API key that has the **Provision app users** permission. Limited to 120 requests a minute per app, shared with provisioning. Higher plans get a higher limit.

## Path parameters

- `app_id` string, required: ID of the app.

## Request body

- DeprovisionUserPayload: Payload for server-to-server app-user deprovisioning (embedded platforms). The email travels in the body, not the path: a URL reaches access logs, proxies and traces, and an address is personal data.
  - `email` string, email, required: The app user's email

## Response `200`

Successful Response

- DeprovisionUserResponse: The app user whose access was removed.
  - `status` 'deleted', required: Always `deleted`.
  - `email` string, required: The email, lowercased.

## Other responses

- `401`: Missing or invalid credentials.
- `403`: The email belongs to the app's owner or to someone with platform-level access: error.code privileged_user.
- `404`: The email isn't provisioned for this app: error.code unknown_user.
- `422`: Validation Error
- `429`: The app went over its per-minute limit for provision and deprovision requests combined.

## Changes

- **2026-10-20** `bbcd7d7e2e72`: 1 info
  - the endpoint scheme security `WorkspaceApiKeyBearerAuth` was added to the API
- **2026-10-11** `80287813ab84`: 2 info
  - the security scope `app_users:provision` was added to the endpoint's security scheme `WorkspaceApiKeyAuth`
  - the security scope `full_access` was added to the endpoint's security scheme `PersonalAccessTokenAuth`
- **2026-10-01** `e58d4ff7b1f8`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/base44/apis/base44-app-management-api/changes/api/apps/:app_id/users/provisions/delete.md)

---

[API](https://skmtc.dev/base44/apis/base44-app-management-api.md) - [All operations](https://skmtc.dev/base44/apis/base44-app-management-api/llms.txt) - [OpenAPI document](https://skmtc.dev/base44/apis/base44-app-management-api/revisions/c534f09cf314?raw)