Stats

Ban a user and take down what they own

Admin-only (ADR 0048). In one transaction: marks the user banned, clears their sign-in link, revokes every API and MCP/OAuth token they created and, when asked, adds a block rule for their email domain. Their sessions and tokens stop working on the next request. Then, best-effort, across the accounts they own: suspends live and inactive sites, discards live previews and cancels the Stripe subscription immediately. The response counts each step and lists any that failed. Records user.banned.

post/stats/users/{id}/ban

Request

  • Base URL: https://api.nippy.host
  • URL: https://api.nippy.host/stats/users/{id}/ban
  • Auth: bearer (a scheme the document does not define)

Path parameters

idstring required

User UUID

Request body

reasonstring required

Why the user is banned. Stored on the user, shown on the admin drill-down and recorded in the activity feed.

blockEmailDomainboolean

Also add a block rule for the user’s email domain. Refused (400) for major mailbox providers. Skipped when a rule for the domain already exists.

Response

userIdstring required

User id (UUID).

bannedAtstring required

Ban time (ISO 8601).

tokensRevokednumber required

API and MCP/OAuth tokens revoked.

sitesSuspendednumber required

Sites suspended across the accounts the user owns.

previewsDiscardednumber required

Live previews discarded.

subscriptionsCancelednumber required

Stripe subscriptions cancelled immediately.

domainBlockedstring nullable required

The domain a new block rule was added for, or null when none was added.

failuresstring[] required

Human-readable descriptions of takedown steps that failed.

Changes

No recorded changes to this operation across all 1 revision of this API.