---
title: "Ban a user and take down what they own"
method: POST
path: "/stats/users/{id}/ban"
tags: ["Stats"]
---

# Ban a user and take down what they own

`POST /stats/users/{id}/ban`

## Request

- Base URL: `https://api.nippy.host`
- URL: `https://api.nippy.host/stats/users/{id}/ban`
- Auth: `bearer` (a scheme the document does not define)

Admin-only (ADR 0048). In one transaction: marks the user banned, clears their sign-in link, revokes every API and MCP/OAuth token they created and, when asked, adds a `block` rule for their email domain. Their sessions and tokens stop working on the next request. Then, best-effort, across the accounts they own: suspends live and inactive sites, discards live previews and cancels the Stripe subscription immediately. The response counts each step and lists any that failed. Records `user.banned`.

## Path parameters

- `id` string, required

## Request body

- BanUserDto
  - `reason` string, required: Why the user is banned. Stored on the user, shown on the admin drill-down and recorded in the activity feed.
  - `blockEmailDomain` boolean: Also add a `block` rule for the user’s email domain. Refused (400) for major mailbox providers. Skipped when a rule for the domain already exists.

## Response `200`

- APIAdminBanResult
  - `userId` string, required: User id (UUID).
  - `bannedAt` string, required: Ban time (ISO 8601).
  - `tokensRevoked` number, required: API and MCP/OAuth tokens revoked.
  - `sitesSuspended` number, required: Sites suspended across the accounts the user owns.
  - `previewsDiscarded` number, required: Live previews discarded.
  - `subscriptionsCanceled` number, required: Stripe subscriptions cancelled immediately.
  - `domainBlocked` string, nullable, required: The domain a new `block` rule was added for, or null when none was added.
  - `failures` string[], required: Human-readable descriptions of takedown steps that failed.

## Other responses

- `400`: Self-ban, an admin target, or a domain that cannot be blocked
- `403`: Admin access required
- `404`: User not found
- `409`: The user is already banned

---

[API](https://skmtc.dev/nippy/apis/nippy-backend-api.md) · [All operations](https://skmtc.dev/nippy/apis/nippy-backend-api/llms.txt) · [OpenAPI document](https://skmtc.dev/nippy/apis/nippy-backend-api/revisions/7ab23f040a55?raw)