Skip to main content
Retire a service account: revoke its credentials, drop its memberships, and mark it retired. A human user can never be deleted through this endpoint.

​
DELETE /users/:user_id

​
Path Parameters

​
Response

Returns {"status": "success"} — no body beyond the status.

​
What Retirement Does

  1. Deletes every API key the account holds.
  2. Deletes every credential stored at target=user/{user_id} — the third-party provider secrets held on the account itself.
  3. Removes every membership the account holds.
  4. Sets the account’s status to retired.
Step 2 is scoped to the account and nothing else. A credential at target=org/{org_id} or target=blob/{blob_id} belongs to that Organization or Blob and survives — it outlives every account that ever read it, and retiring a reader never removes it. The account record itself survives, so historical authorship — an author_id on a Revision, a user_id on a thread item — still resolves to a name instead of a dangling ID. Retirement is terminal: there is no reactivation, matching Lifecycle.

​
Errors

See Permissions below for who can call this endpoint at all.

​
Example

​
Permissions

Retiring an account is a human act: the request fails with 403 whenever there is no human behind it at all, which is what makes the last row unconditional rather than role-dependent — a service account’s key can never satisfy it, no matter what role that key carries. An acting token satisfies it because it names the human who minted it, which is why it appears one row above — see The Access Perimeter for the rule across all ten operations it governs.