# BAD CSRF Response When Trying to Delete User by API

**URL:** <https://meta.discourse.org/t/bad-csrf-response-when-trying-to-delete-user-by-api/87887>\
**Category:** Support\
**Created:** [May 19, 2018, 2:15pm UTC](https://meta.discourse.org/t/bad-csrf-response-when-trying-to-delete-user-by-api/87887 "2018-05-19T14:15:20Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![ATPJD](https://avatars.discourse-cdn.com/v4/letter/a/eb9ed0/32.png) [@ATPJD](https://meta.discourse.org/u/ATPJD)\
**Post date:** [May 19, 2018, 2:15pm UTC](https://meta.discourse.org/t/bad-csrf-response-when-trying-to-delete-user-by-api/87887/1 "2018-05-19T14:15:20Z")

</div>

I am trying to delete a user by API following the [docs](https://docs.discourse.org/#tag/Users%2Fpaths%2F~1admin~1users~1%7Bid%7D.json%2Fdelete).

We use SSO, which seems to make the API require a cookie header coming from SSO authentication. I got past that, and as long as I supply the cookie, other types of actions work fine by GET. But the DELETE results in this “BAD CSRF” error.

Maybe a bug? I don’t even know where to begin troubleshooting this. Any help appreciated.

---

_[View the full topic](https://meta.discourse.org/t/bad-csrf-response-when-trying-to-delete-user-by-api/87887)._