---
title: "Reactivate a user."
method: POST
path: "/api/users/{username}/reactivate"
tags: ["Users"]
---

# Reactivate a user.

`POST /api/users/{username}/reactivate`

## Request

- Base URL: `/` (relative, and the document was published on a file host, not at the API’s origin)
- URL: `/api/users/{username}/reactivate`
- Auth: HTTP bearer

Reactivates a deactivated user, restoring its API keys. Requires an administrator as well as the scope. Recorded as a user_reactivated audit event naming the calling administrator as the principal and the calling API key in the details. Requires the `users:write` scope.

## Path parameters

- `username` string, required

## Headers

- `Authorization` string, required

## Response `200`

The user was reactivated.

- UserResponse
  - `email` string
  - `active` boolean
  - `created` string, date-time
  - `deactivatedAt` string, date-time
  - `id` string: The user's id, which audit events and other records refer to the user by.
  - `mfaEnabled` boolean: Whether the user is enrolled in TOTP multi-factor authentication. The secret is never returned.
  - `mfaLocked` boolean: Whether the user's MFA is locked after repeated bad codes, until an administrator unlocks it.
  - `passwordChangeRequired` boolean: Whether the user must change their password at next sign-in, because an administrator set it.
  - `passwordSet` boolean: Whether the user has a password. A user without one can only use API keys.
  - `role` string
  - `username` string

## Other responses

- `400`: Bad Request
- `401`: The Authorization header is absent or the API key is not recognized.
- `403`: The key does not hold users:write, or the caller is not an administrator.
- `404`: There is no user with that username.
- `406`: No representation matches Accept.
- `409`: The user is already active.
- `413`: Content Too Large
- `415`: Unsupported Media Type
- `500`: Internal Server Error
- `503`: Service Unavailable

## Changes

- **2026-10-10** `c4f85daa9208`: 16 info
  - added the optional property `field` to the response with the `400` status
  - added the optional property `field` to the response with the `401` status
  - added the optional property `field` to the response with the `403` status
  - added the optional property `field` to the response with the `409` status
  - …12 more
- **2026-10-10** `99428fb4cd2d`: 1 info
  - added the optional property `id` to the response with the `200` status
- **2026-10-05** `4082c17721d8`: 6 breaking, 6 info
  - removed the media type `*/*` for the response with the status `400`
  - removed the media type `*/*` for the response with the status `401`
  - removed the media type `*/*` for the response with the status `413`
  - removed the media type `*/*` for the response with the status `415`
  - …8 more
- **2026-10-05** `2cd7275cfcb5`: 2 info
  - added the optional property `mfaEnabled` to the response with the `200` status
  - added the optional property `mfaLocked` to the response with the `200` status
- **2026-10-05** `4fa43795fff9`: 2 info
  - added the optional property `passwordChangeRequired` to the response with the `200` status
  - added the optional property `passwordSet` to the response with the `200` status

[Operation history](https://skmtc.dev/philterd/apis/philter-api/changes/api/users/:username/reactivate/post.md)

---

[API](https://skmtc.dev/philterd/apis/philter-api.md) - [All operations](https://skmtc.dev/philterd/apis/philter-api/llms.txt) - [OpenAPI document](https://skmtc.dev/philterd/apis/philter-api/revisions/aa3d7ad1aab4?raw)