# BAD CSRF Response When Trying to Delete User by API

**URL:** <https://meta.discourse.org/t/bad-csrf-response-when-trying-to-delete-user-by-api/87887>\
**Category:** Support\
**Created:** [May 19, 2018, 2:15pm UTC](https://meta.discourse.org/t/bad-csrf-response-when-trying-to-delete-user-by-api/87887 "2018-05-19T14:15:20Z")\
**Posts on this page:** 1\
**Showing post:** 6

<div class="post-metadata">

**Author:** ![simon](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/simon/32/339122_2.png) [@simon](https://meta.discourse.org/u/simon)\
**Post date:** [August 1, 2018, 6:52pm UTC](https://meta.discourse.org/t/bad-csrf-response-when-trying-to-delete-user-by-api/87887/6 "2018-08-01T18:52:15Z")

</div>

I have tested deleting users through the API on a live hosted site with SSO enabled. I’m using [Postman](https://www.getpostman.com/) to make the API request. It is deleting users for me. The response is `{"deleted": true}`. The all\_users API key and API username need to be included in the body of the request.

One thing I have found is that sending the parameter `"block_email": false` actually causes the email address to be blocked. Sending the parameter `"block_ip": false` also blocked the IP address the first time I made the request. After allowing the IP address through Admin/Logs/Screened IPs, subsequent requests sending the `"block_ip": false` parameter did not block the IP address.

Edit: I just did a quick test with this on my local dev environment. Setting the `block_email` and `block_ip` params to false causes [these two code blocks](https://github.com/discourse/discourse/blob/master/app/services/user_destroyer.rb#L57) to be run. I’ve tested this both with Postman, and making the request with curl. If neither of those params are set, everything works as it should.

---

_[View the full topic](https://meta.discourse.org/t/bad-csrf-response-when-trying-to-delete-user-by-api/87887)._