# Disable an account and end its sessions

> The platform.users.disable operation: POST /api/v1/platform/users/{userId}/disable in the REST API and the platform_users_disable tool in the MCP server.

Disables a person's Ownrecord account (spec §6.2) and ends their access everywhere at once: every console
session, every OAuth grant they gave an app or MCP client (with its access and refresh tokens), and their OAuth
sign-in sessions. The person can't sign in again until a platform admin enables the account; their
memberships, the organizations' data and the audit log stay as they are. Use it for a compromised or abusive
account (docs/runbooks/fraud.md). API keys belong to organizations, not people: revoke those in the
organization.

Platform admins only, after signing in within the last 15 minutes, with a reason (kept in the audit log). You
can't disable your own account, nor the last platform admin.

## At a glance

- **REST:** `POST /api/v1/platform/users/{userId}/disable`
- **MCP tool:** `platform_users_disable`
- **Operation ID:** `platform.users.disable`
- **Scope:** Platform
- **Permission:** `platform:admin`
- **Risk tier:** `security`
- **Dry run:** Supported (send `Ownrecord-Dry-Run: true`)
- **Idempotency:** `Idempotency-Key` required
- **Modes:** Test and live
- **Authentication:** API key with the `platform:admin` scope
- **Fresh sign-in:** In the console, a sign-in within the last 15 minutes
- **Since:** M13

## Request

### Path parameters

| Field    | Type       | Description |
| -------- | ---------- | ----------- |
| `userId` | `usr_…` ID |             |

### Body

A JSON object (`Content-Type: application/json`):

| Field    | Type   | Required | Description                                                             |
| -------- | ------ | -------- | ----------------------------------------------------------------------- |
| `reason` | string | Yes      | Why (kept in the audit log). Never paste personal data or secrets here. |

## Response

`200 OK` with a JSON object:

| Field                 | Type                                                                      | Description                                                      |
| --------------------- | ------------------------------------------------------------------------- | ---------------------------------------------------------------- |
| `object`              | `"platform_user"`                                                         |                                                                  |
| `id`                  | `usr_…` ID                                                                |                                                                  |
| `email`               | string                                                                    |                                                                  |
| `name`                | string or null                                                            |                                                                  |
| `platformRole`        | one of `platform_admin`, `platform_tax_admin`, `platform_support` or null |                                                                  |
| `createdAt`           | date-time                                                                 |                                                                  |
| `lastLoginAt`         | date-time or null                                                         |                                                                  |
| `disabled`            | boolean                                                                   |                                                                  |
| `disabledAt`          | date-time or null                                                         |                                                                  |
| `sessions`            | integer                                                                   | Console sessions that exist now.                                 |
| `oauthGrants`         | integer                                                                   | OAuth clients (apps, MCP clients) the person granted access.     |
| `organizations`       | integer                                                                   | Organizations the person is a member of (counted, never listed). |
| `ended`               | object                                                                    |                                                                  |
| `ended.sessions`      | integer                                                                   |                                                                  |
| `ended.oauthGrants`   | integer                                                                   |                                                                  |
| `ended.oauthTokens`   | integer                                                                   | Access and refresh tokens and authorization codes deleted.       |
| `ended.oauthSessions` | integer                                                                   |                                                                  |

## Examples

### Cut off a compromised account

```http
POST /api/v1/platform/users/usr_01m5wvkry1e6w94sjxgme33fsc/disable
Authorization: Bearer or_test_…
Idempotency-Key: 3f1c9a52-7d0e-4b8f-9a61-0c2d5e8b7f14
Content-Type: application/json

{
  "reason": "Account takeover reported by the owner (ticket 4711)."
}
```

Response (`200`):

```json
{
  "object": "platform_user",
  "id": "usr_01m5wvkry1e6w94sjxgme33fsc",
  "email": "ana@example.com",
  "name": "Ana Horvat",
  "platformRole": null,
  "createdAt": "2026-09-14T10:02:11.000Z",
  "lastLoginAt": "2026-11-02T18:40:05.000Z",
  "disabled": true,
  "disabledAt": "2026-11-03T09:00:00.000Z",
  "sessions": 0,
  "oauthGrants": 0,
  "organizations": 1,
  "ended": {
    "sessions": 2,
    "oauthGrants": 1,
    "oauthTokens": 3,
    "oauthSessions": 1
  }
}
```

## Errors

| Code                                                                                           | HTTP status | When                                           | What to do                                                                                           |
| ---------------------------------------------------------------------------------------------- | ----------- | ---------------------------------------------- | ---------------------------------------------------------------------------------------------------- |
| [`user_already_disabled`](https://ownrecord.io/docs/reference/errors.md#user_already_disabled) | 409         | The account is disabled already.               | Reload the account: its sessions and OAuth access already ended when it was disabled.                |
| [`platform_user_self`](https://ownrecord.io/docs/reference/errors.md#platform_user_self)       | 400         | You tried to disable your own account.         | Ask another platform admin to do it.                                                                 |
| [`platform_last_admin`](https://ownrecord.io/docs/reference/errors.md#platform_last_admin)     | 409         | The account is the last active platform admin. | Make someone else a platform admin first, then change this person's role.                            |
| [`resource_not_found`](https://ownrecord.io/docs/reference/errors.md#resource_not_found)       | 404         | No account has this ID.                        | Check the ID and that your credentials are scoped to the right organization, entity, brand and mode. |
| [`version_conflict`](https://ownrecord.io/docs/reference/errors.md#version_conflict)           | 409         | The account changed at the same time; retry.   | Fetch the object again and retry the change.                                                         |
| [`validation_failed`](https://ownrecord.io/docs/reference/errors.md#validation_failed)         | 400         | The reason is missing or too long.             | Fix the fields listed in `details.issues` and send the request again.                                |
| [`fresh_auth_required`](https://ownrecord.io/docs/reference/errors.md#fresh_auth_required)     | 403         | You last signed in more than 15 minutes ago.   | Sign in again, then repeat the action within 15 minutes.                                             |
| [`permission_denied`](https://ownrecord.io/docs/reference/errors.md#permission_denied)         | 403         | You aren't a platform admin.                   | Ask an organization owner or admin for a role or scope that allows this action.                      |

It can also return these [common errors](https://ownrecord.io/docs/reference.md#common-errors): [`api_version_unsupported`](https://ownrecord.io/docs/reference/errors.md#api_version_unsupported), [`invalid_json`](https://ownrecord.io/docs/reference/errors.md#invalid_json), [`unsupported_media_type`](https://ownrecord.io/docs/reference/errors.md#unsupported_media_type), [`authentication_required`](https://ownrecord.io/docs/reference/errors.md#authentication_required), [`api_key_invalid`](https://ownrecord.io/docs/reference/errors.md#api_key_invalid), [`idempotency_key_required`](https://ownrecord.io/docs/reference/errors.md#idempotency_key_required), [`idempotency_key_reused`](https://ownrecord.io/docs/reference/errors.md#idempotency_key_reused), [`idempotency_in_progress`](https://ownrecord.io/docs/reference/errors.md#idempotency_in_progress), [`rate_limited`](https://ownrecord.io/docs/reference/errors.md#rate_limited), [`internal_error`](https://ownrecord.io/docs/reference/errors.md#internal_error).