---
title: "Revoke system administrator privileges from a user"
method: POST
path: "/system/admin/revoke"
tags: ["System Admin"]
---

# Revoke system administrator privileges from a user

`POST /system/admin/revoke`

Remove system administrator privileges from a user (SystemAdmin only).
Two safety guards: the caller cannot revoke their own privileges,
and revoking the last remaining system admin is rejected — both
prevent a SystemAdmin from accidentally locking the platform out
of system-level administration. Idempotent on already-non-admin users.

## Request body

- InternalHandlerRevokeSystemAdminRequest
  - `user_id` string, required

## Response `200`

Privileges revoked successfully

- GithubComTencentWeKnoraInternalTypesUserInfo
  - `avatar` string
  - `can_access_all_tenants` boolean
  - `created_at` string
  - `email` string
  - `id` string
  - `is_active` boolean
  - `is_system_admin` boolean
  - `preferences` GithubComTencentWeKnoraInternalTypesUserPreferences
    - `last_active_tenant_id` integer — LastActiveTenantID remembers the last workspace the user actively switched into, so a fresh login (new device, cleared browser, new refresh token) lands them back in that workspace instead of always bouncing to their home workspace. Written by the SPA's preferences PUT and by service-level SwitchTenant (including when switching home, which stores the home ID). Login / RefreshToken validate that the workspace still exists and the user still has an active membership (or CanAccessAllTenants) before honouring this preference; an invalid pointer is best-effort cleared and the user falls back to home. Refresh JWT claims have no tenant_id, so RefreshToken re-resolves from this field. nil = no preference (use user.TenantID, i.e. home) *0 = "clear preference" sentinel for the partial-update endpoint (UpdateUserPreferences turns this into nil). Otherwise treat a stored *0 the same as nil. *N = preferred workspace id.
    - `oidc_only_login` boolean — OidcOnlyLogin is set server-side when an account is auto-provisioned via OIDC with a random password the user never received. The profile UI hides self-service password rotation until the user sets a known password via ChangePassword (which clears this flag).
  - `tenant_id` integer
  - `updated_at` string
  - `username` string

## Other responses

- `400` — Bad request / would remove last admin / self-revoke
- `403` — Forbidden: not a system admin
- `404` — User not found

## Changes

- **2026-06-05** `e7c0c953963b` — 1 info
  - endpoint added
- **2025-12-16** `edf61e68559d` — 1 breaking
  - api path removed without deprecation

[Change history](https://skmtc.dev/tencentblueking/apis/weknora-api/changes/system/admin/revoke/post.md)

---

[API](https://skmtc.dev/tencentblueking/apis/weknora-api.md) · [All operations](https://skmtc.dev/tencentblueking/apis/weknora-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/tencentblueking/weknora-api/revisions/8bcae298fb2f/schema)