Unable to anonymize user via API with SSO enabled

Development

AI-generated summary

FoxCZ is experiencing issues with anonymizing a user via API call when Discourse SSO is enabled. The endpoint is returning a 403 error with “You are not permitted to view the requested resource” despite using a valid API key and username. However, FoxCZ later discovered the issue was due to attempting to anonymize an admin account, which is not permitted. They suggest adding this detail to the API documentation.

1

Hi everyone!

We have decided to use Discourse as our main forum interface with Discourse SSO as login/signup.
The SSO features (details sync, …) are implemented and working (mentioning this just for bit of background).

In order to comply with GDPR I’m trying to implement user anonymization using API call from our backend (as detailed here: Discourse API Docs ).
Unfortunately the endpoint responses with:

{ ...
statusCode: 403,
error: '{"errors":["You are not permitted to view the requested resource."],"error_type":"invalid_access"}',
... }

The API call looks like:

await request.put({
      url: `${discourseApiUrl}/admin/users/${discourseUserId}/anonymize.json`,
      headers: {
          'Api-Key': "API KEY",
         'Api-Username': "system"
      },
});

The discourseUserId is obtained from the admin/users/list/all.json?email=<email> endpoint and that call works without any problems (using the same API key and username).

I’w tried calling the endpoint from Postman as well with the same result (“invalid_access”).

I will greatly appreciate any pointer on what I’m missing or suggestion how to resolve this.

2

I’m going to reply my self as I found out what was wrong with the call.
Seems like the admin and moderators account can not be deleted or anonymized. And this was the case with my test account.
Might be nice to mention this in the API documentation at some point.