---
title: "Clear a user's sign-in lock."
method: POST
path: "/api/users/{username}/sign-in/unlock"
tags: ["Users"]
---

# Clear a user's sign-in lock.

`POST /api/users/{username}/sign-in/unlock`

## Request

- Base URL: `/` (relative, and the document was published on a file host, not at the API’s origin)
- URL: `/api/users/{username}/sign-in/unlock`
- Auth: HTTP bearer

Clears the lock on a user's password sign-in after repeated failed sign-ins, before SIGN_IN_LOCKOUT_MINUTES ends, and resets the count of failures. The lock returns if sign-in keeps failing, so restrict who can reach sign-in when someone is locking a user out deliberately. Requires an administrator as well as the scope. Recorded as a sign_in_unlocked audit event naming the calling administrator and API key. Requires the `users:write` scope.

## Path parameters

- `username` string, required

## Headers

- `Authorization` string, required

## Response `204`

The user's sign-in was unlocked.

## Other responses

- `400`: Bad Request
- `401`: The Authorization header is absent or the API key is not recognized.
- `403`: The key does not hold users:write, or the caller is not an administrator.
- `404`: There is no user with that username.
- `406`: No representation matches Accept.
- `409`: The user's sign-in is not locked.
- `413`: Content Too Large
- `415`: Unsupported Media Type
- `500`: Internal Server Error
- `503`: Service Unavailable

## Changes

- **2026-10-17** `c7c4e081c38e`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/philterd/apis/philter-api/changes/api/users/:username/sign-in/unlock/post.md)

---

[API](https://skmtc.dev/philterd/apis/philter-api.md) - [All operations](https://skmtc.dev/philterd/apis/philter-api/llms.txt) - [OpenAPI document](https://skmtc.dev/philterd/apis/philter-api/revisions/aa3d7ad1aab4?raw)