Enable a disabled account · Ownrecord docs

Enables an account that platform.users.disable disabled (spec §6.2). Its sessions and OAuth grants don't come back: the person signs in again, and apps and MCP clients ask for consent again. Memberships were never touched, so the person has the same organizations and roles as before.

Platform admins only, after signing in within the last 15 minutes, with a reason (kept in the audit log).

At a glance

REST: POST /api/v1/platform/users/{userId}/enable
MCP tool: platform_users_enable
Operation ID: platform.users.enable
Scope: Platform
Permission: platform:admin
Risk tier: security
Dry run: Supported (send Ownrecord-Dry-Run: true)
Idempotency: Idempotency-Key required
Modes: Test and live
Authentication: API key with the platform:admin scope
Fresh sign-in: In the console, a sign-in within the last 15 minutes
Since: M13

Request

Path parameters

Field	Type	Description
`userId`	`usr_…` ID

Body

A JSON object (Content-Type: application/json):

Field	Type	Required	Description
`reason`	string	Yes	Why (kept in the audit log). Never paste personal data or secrets here.

Response

200 OK with a JSON object:

Field	Type	Description
`object`	`"platform_user"`
`id`	`usr_…` ID
`email`	string
`name`	string or null
`platformRole`	one of `platform_admin`, `platform_tax_admin`, `platform_support` or null
`createdAt`	date-time
`lastLoginAt`	date-time or null
`disabled`	boolean
`disabledAt`	date-time or null
`sessions`	integer	Console sessions that exist now.
`oauthGrants`	integer	OAuth clients (apps, MCP clients) the person granted access.
`organizations`	integer	Organizations the person is a member of (counted, never listed).

Examples

Give the account back after the owner secured it

HTTP

POST /api/v1/platform/users/usr_01m5wvkry1e6w94sjxgme33fsc/enable
Authorization: Bearer or_test_…
Idempotency-Key: 3f1c9a52-7d0e-4b8f-9a61-0c2d5e8b7f14
Content-Type: application/json

{
  "reason": "The owner reset the Google account and turned on MFA (ticket 4711)."
}

Response (200):

JSON

{
  "object": "platform_user",
  "id": "usr_01m5wvkry1e6w94sjxgme33fsc",
  "email": "ana@example.com",
  "name": "Ana Horvat",
  "platformRole": null,
  "createdAt": "2026-09-14T10:02:11.000Z",
  "lastLoginAt": "2026-11-02T18:40:05.000Z",
  "disabled": false,
  "disabledAt": null,
  "sessions": 0,
  "oauthGrants": 0,
  "organizations": 1
}

Errors

Code	HTTP status	When	What to do
`user_not_disabled`	409	The account isn't disabled.	Reload the account: someone may have enabled it already.
`resource_not_found`	404	No account has this ID.	Check the ID and that your credentials are scoped to the right organization, entity, brand and mode.
`version_conflict`	409	The account changed at the same time; retry.	Fetch the object again and retry the change.
`validation_failed`	400	The reason is missing or too long.	Fix the fields listed in `details.issues` and send the request again.
`fresh_auth_required`	403	You last signed in more than 15 minutes ago.	Sign in again, then repeat the action within 15 minutes.
`permission_denied`	403	You aren't a platform admin.	Ask an organization owner or admin for a role or scope that allows this action.

It can also return these common errors: api_version_unsupported, invalid_json, unsupported_media_type, authentication_required, api_key_invalid, idempotency_key_required, idempotency_key_reused, idempotency_in_progress, rate_limited, internal_error.

At a glance#

Request#

Path parameters#

Body#

Response#

Examples#

Give the account back after the owner secured it#

Errors#