---
title: "Deactivate a user."
method: POST
path: "/api/users/{username}/deactivate"
tags: ["Users"]
---

# Deactivate a user.

`POST /api/users/{username}/deactivate`

## Request

- Base URL: `/` (relative, and the document was published on a file host, not at the API’s origin)
- URL: `/api/users/{username}/deactivate`
- Auth: HTTP bearer

Deactivates a user: the user's API keys stop working, and the user and all of its data are retained so it can be reactivated. The last active administrator, and the calling administrator, cannot be deactivated. Requires an administrator as well as the scope. Recorded as a user_deactivated audit event naming the calling administrator as the principal and the calling API key in the details. Requires the `users:write` scope.

## Path parameters

- `username` string, required

## Headers

- `Authorization` string, required

## Response `200`

The user was deactivated.

- UserResponse
  - `email` string
  - `active` boolean
  - `created` string, date-time
  - `deactivatedAt` string, date-time
  - `id` string: The user's id, which audit events and other records refer to the user by.
  - `mfaEnabled` boolean: Whether the user is enrolled in TOTP multi-factor authentication. The secret is never returned.
  - `mfaLocked` boolean: Whether the user's MFA is locked after repeated bad codes, until an administrator unlocks it.
  - `passwordChangeRequired` boolean: Whether the user must change their password at next sign-in, because an administrator set it.
  - `passwordSet` boolean: Whether the user has a password. A user without one can only use API keys.
  - `role` string
  - `username` string

## Other responses

- `400`: Bad Request
- `401`: The Authorization header is absent or the API key is not recognized.
- `403`: The key does not hold users:write, or the caller is not an administrator.
- `404`: There is no user with that username.
- `406`: No representation matches Accept.
- `409`: The user is already deactivated, is the caller, or is the last active administrator, or, with MongoDB storage, another change to the administrators is in progress (reason admin_change_in_progress; Retry-After gives the seconds to wait).
- `413`: Content Too Large
- `415`: Unsupported Media Type
- `500`: Internal Server Error
- `503`: Service Unavailable

## Changes

- **2026-10-10** `c4f85daa9208`: 16 info
  - added the optional property `field` to the response with the `400` status
  - added the optional property `field` to the response with the `401` status
  - added the optional property `field` to the response with the `403` status
  - added the optional property `field` to the response with the `409` status
  - …12 more
- **2026-10-10** `99428fb4cd2d`: 1 info
  - added the optional property `id` to the response with the `200` status
- **2026-10-05** `4082c17721d8`: 6 breaking, 6 info
  - removed the media type `*/*` for the response with the status `400`
  - removed the media type `*/*` for the response with the status `401`
  - removed the media type `*/*` for the response with the status `413`
  - removed the media type `*/*` for the response with the status `415`
  - …8 more
- **2026-10-05** `2cd7275cfcb5`: 2 info
  - added the optional property `mfaEnabled` to the response with the `200` status
  - added the optional property `mfaLocked` to the response with the `200` status
- **2026-10-05** `4fa43795fff9`: 2 info
  - added the optional property `passwordChangeRequired` to the response with the `200` status
  - added the optional property `passwordSet` to the response with the `200` status

[Operation history](https://skmtc.dev/philterd/apis/philter-api/changes/api/users/:username/deactivate/post.md)

---

[API](https://skmtc.dev/philterd/apis/philter-api.md) - [All operations](https://skmtc.dev/philterd/apis/philter-api/llms.txt) - [OpenAPI document](https://skmtc.dev/philterd/apis/philter-api/revisions/aa3d7ad1aab4?raw)