Disable an account and end its sessions

Disables a person's Ownrecord account (spec §6.2) and ends their access everywhere at once: every console session, every OAuth grant they gave an app or MCP client (with its access and refresh tokens), and their OAuth sign-in sessions. The person can't sign in again until a platform admin enables the account; their memberships, the organizations' data and the audit log stay as they are. Use it for a compromised or abusive account (docs/runbooks/fraud.md). API keys belong to organizations, not people: revoke those in the organization.

Platform admins only, after signing in within the last 15 minutes, with a reason (kept in the audit log). You can't disable your own account, nor the last platform admin.

At a glance

REST: POST /api/v1/platform/users/{userId}/disable
MCP tool: platform_users_disable
Operation ID: platform.users.disable
Scope: Platform
Permission: platform:admin
Risk tier: security
Dry run: Supported (send Ownrecord-Dry-Run: true)
Idempotency: Idempotency-Key required
Modes: Test and live
Authentication: API key with the platform:admin scope
Fresh sign-in: In the console, a sign-in within the last 15 minutes
Since: M13

Request

Path parameters

Field	Type	Description
`userId`	`usr_…` ID

Body

A JSON object (Content-Type: application/json):

Field	Type	Required	Description
`reason`	string	Yes	Why (kept in the audit log). Never paste personal data or secrets here.

Response

200 OK with a JSON object:

Field	Type	Description
`object`	`"platform_user"`
`id`	`usr_…` ID
`email`	string
`name`	string or null
`platformRole`	one of `platform_admin`, `platform_tax_admin`, `platform_support` or null
`createdAt`	date-time
`lastLoginAt`	date-time or null
`disabled`	boolean
`disabledAt`	date-time or null
`sessions`	integer	Console sessions that exist now.
`oauthGrants`	integer	OAuth clients (apps, MCP clients) the person granted access.
`organizations`	integer	Organizations the person is a member of (counted, never listed).
`ended`	object
`ended.sessions`	integer
`ended.oauthGrants`	integer
`ended.oauthTokens`	integer	Access and refresh tokens and authorization codes deleted.
`ended.oauthSessions`	integer

Examples

Cut off a compromised account

HTTP

POST /api/v1/platform/users/usr_01m5wvkry1e6w94sjxgme33fsc/disable
Authorization: Bearer or_test_…
Idempotency-Key: 3f1c9a52-7d0e-4b8f-9a61-0c2d5e8b7f14
Content-Type: application/json

{
  "reason": "Account takeover reported by the owner (ticket 4711)."
}

Response (200):

JSON

{
  "object": "platform_user",
  "id": "usr_01m5wvkry1e6w94sjxgme33fsc",
  "email": "ana@example.com",
  "name": "Ana Horvat",
  "platformRole": null,
  "createdAt": "2026-09-14T10:02:11.000Z",
  "lastLoginAt": "2026-11-02T18:40:05.000Z",
  "disabled": true,
  "disabledAt": "2026-11-03T09:00:00.000Z",
  "sessions": 0,
  "oauthGrants": 0,
  "organizations": 1,
  "ended": {
    "sessions": 2,
    "oauthGrants": 1,
    "oauthTokens": 3,
    "oauthSessions": 1
  }
}

Errors

Code	HTTP status	When	What to do
`user_already_disabled`	409	The account is disabled already.	Reload the account: its sessions and OAuth access already ended when it was disabled.
`platform_user_self`	400	You tried to disable your own account.	Ask another platform admin to do it.
`platform_last_admin`	409	The account is the last active platform admin.	Make someone else a platform admin first, then change this person's role.
`resource_not_found`	404	No account has this ID.	Check the ID and that your credentials are scoped to the right organization, entity, brand and mode.
`version_conflict`	409	The account changed at the same time; retry.	Fetch the object again and retry the change.
`validation_failed`	400	The reason is missing or too long.	Fix the fields listed in `details.issues` and send the request again.
`fresh_auth_required`	403	You last signed in more than 15 minutes ago.	Sign in again, then repeat the action within 15 minutes.
`permission_denied`	403	You aren't a platform admin.	Ask an organization owner or admin for a role or scope that allows this action.

It can also return these common errors: api_version_unsupported, invalid_json, unsupported_media_type, authentication_required, api_key_invalid, idempotency_key_required, idempotency_key_reused, idempotency_in_progress, rate_limited, internal_error.

At a glance#

Request#

Path parameters#

Body#

Response#

Examples#

Cut off a compromised account#

Errors#