# Enable a disabled account

> The platform.users.enable operation: POST /api/v1/platform/users/{userId}/enable in the REST API and the platform_users_enable tool in the MCP server.

Enables an account that `platform.users.disable` disabled (spec §6.2). Its sessions and OAuth grants don't come
back: the person signs in again, and apps and MCP clients ask for consent again. Memberships were never
touched, so the person has the same organizations and roles as before.

Platform admins only, after signing in within the last 15 minutes, with a reason (kept in the audit log).

## At a glance

- **REST:** `POST /api/v1/platform/users/{userId}/enable`
- **MCP tool:** `platform_users_enable`
- **Operation ID:** `platform.users.enable`
- **Scope:** Platform
- **Permission:** `platform:admin`
- **Risk tier:** `security`
- **Dry run:** Supported (send `Ownrecord-Dry-Run: true`)
- **Idempotency:** `Idempotency-Key` required
- **Modes:** Test and live
- **Authentication:** API key with the `platform:admin` scope
- **Fresh sign-in:** In the console, a sign-in within the last 15 minutes
- **Since:** M13

## Request

### Path parameters

| Field    | Type       | Description |
| -------- | ---------- | ----------- |
| `userId` | `usr_…` ID |             |

### Body

A JSON object (`Content-Type: application/json`):

| Field    | Type   | Required | Description                                                             |
| -------- | ------ | -------- | ----------------------------------------------------------------------- |
| `reason` | string | Yes      | Why (kept in the audit log). Never paste personal data or secrets here. |

## Response

`200 OK` with a JSON object:

| Field           | Type                                                                      | Description                                                      |
| --------------- | ------------------------------------------------------------------------- | ---------------------------------------------------------------- |
| `object`        | `"platform_user"`                                                         |                                                                  |
| `id`            | `usr_…` ID                                                                |                                                                  |
| `email`         | string                                                                    |                                                                  |
| `name`          | string or null                                                            |                                                                  |
| `platformRole`  | one of `platform_admin`, `platform_tax_admin`, `platform_support` or null |                                                                  |
| `createdAt`     | date-time                                                                 |                                                                  |
| `lastLoginAt`   | date-time or null                                                         |                                                                  |
| `disabled`      | boolean                                                                   |                                                                  |
| `disabledAt`    | date-time or null                                                         |                                                                  |
| `sessions`      | integer                                                                   | Console sessions that exist now.                                 |
| `oauthGrants`   | integer                                                                   | OAuth clients (apps, MCP clients) the person granted access.     |
| `organizations` | integer                                                                   | Organizations the person is a member of (counted, never listed). |

## Examples

### Give the account back after the owner secured it

```http
POST /api/v1/platform/users/usr_01m5wvkry1e6w94sjxgme33fsc/enable
Authorization: Bearer or_test_…
Idempotency-Key: 3f1c9a52-7d0e-4b8f-9a61-0c2d5e8b7f14
Content-Type: application/json

{
  "reason": "The owner reset the Google account and turned on MFA (ticket 4711)."
}
```

Response (`200`):

```json
{
  "object": "platform_user",
  "id": "usr_01m5wvkry1e6w94sjxgme33fsc",
  "email": "ana@example.com",
  "name": "Ana Horvat",
  "platformRole": null,
  "createdAt": "2026-09-14T10:02:11.000Z",
  "lastLoginAt": "2026-11-02T18:40:05.000Z",
  "disabled": false,
  "disabledAt": null,
  "sessions": 0,
  "oauthGrants": 0,
  "organizations": 1
}
```

## Errors

| Code                                                                                       | HTTP status | When                                         | What to do                                                                                           |
| ------------------------------------------------------------------------------------------ | ----------- | -------------------------------------------- | ---------------------------------------------------------------------------------------------------- |
| [`user_not_disabled`](https://ownrecord.io/docs/reference/errors.md#user_not_disabled)     | 409         | The account isn't disabled.                  | Reload the account: someone may have enabled it already.                                             |
| [`resource_not_found`](https://ownrecord.io/docs/reference/errors.md#resource_not_found)   | 404         | No account has this ID.                      | Check the ID and that your credentials are scoped to the right organization, entity, brand and mode. |
| [`version_conflict`](https://ownrecord.io/docs/reference/errors.md#version_conflict)       | 409         | The account changed at the same time; retry. | Fetch the object again and retry the change.                                                         |
| [`validation_failed`](https://ownrecord.io/docs/reference/errors.md#validation_failed)     | 400         | The reason is missing or too long.           | Fix the fields listed in `details.issues` and send the request again.                                |
| [`fresh_auth_required`](https://ownrecord.io/docs/reference/errors.md#fresh_auth_required) | 403         | You last signed in more than 15 minutes ago. | Sign in again, then repeat the action within 15 minutes.                                             |
| [`permission_denied`](https://ownrecord.io/docs/reference/errors.md#permission_denied)     | 403         | You aren't a platform admin.                 | Ask an organization owner or admin for a role or scope that allows this action.                      |

It can also return these [common errors](https://ownrecord.io/docs/reference.md#common-errors): [`api_version_unsupported`](https://ownrecord.io/docs/reference/errors.md#api_version_unsupported), [`invalid_json`](https://ownrecord.io/docs/reference/errors.md#invalid_json), [`unsupported_media_type`](https://ownrecord.io/docs/reference/errors.md#unsupported_media_type), [`authentication_required`](https://ownrecord.io/docs/reference/errors.md#authentication_required), [`api_key_invalid`](https://ownrecord.io/docs/reference/errors.md#api_key_invalid), [`idempotency_key_required`](https://ownrecord.io/docs/reference/errors.md#idempotency_key_required), [`idempotency_key_reused`](https://ownrecord.io/docs/reference/errors.md#idempotency_key_reused), [`idempotency_in_progress`](https://ownrecord.io/docs/reference/errors.md#idempotency_in_progress), [`rate_limited`](https://ownrecord.io/docs/reference/errors.md#rate_limited), [`internal_error`](https://ownrecord.io/docs/reference/errors.md#internal_error).