Delete user avatar by API

Dev
1

Hello!

We have Discourse forum app that is connected to our app via SSO. User avatars are updated right through it. But our photos are moderated, so we need to clear user avatars on Discourse app side.

Can it be done somehow by REST API or by SSO mechanism enhancements? I cannot find this information in docs.

Thank you!

1 Like
2

You should be able to call the sync_sso route to re-sync the user avatar, but you can also make a PUT request to http://localhost:3000/u/<username>/preferences/avatar/pick with an empty upload_id

image

to delete the users current avatar and assign them a letter avatar.

3 Likes
3

@blake Error sending this request. I used post request.
{
“failed”: “FAILED”
}

4

Did you try a PUT as recommended?

1 Like
5

@pfaffman sorry i used put

2020-06-16_16-47-50
2020-06-16_16-47-50705×412 8.91 KB

2 Likes
6

You will have to use the sync_sso endpoint if you have sso overrides avatar enabled.

2 Likes
7

We use SSO endpoint, but it refreshes user avatar only on login. In our case we need to refresh it manually.

1 Like
8

Yea totally fine. You can make a POST request to the sync_sso endpoint manually at any time.

1 Like
9

Could you please attach link to the API doc for that endpoint?

1 Like
10

Here is some ruby code you can use that uses the discourse_api gem so that you can use it as a reference. The sync_sso endpoint is a bit different than other endpoints because you need to send it a signed payload.

client = DiscourseApi::Client.new('host')
client.api_key = 'api_key'
client.api_username = 'api_username'
puts client.sync_sso(
  sso_secret: 'abcdefghij',
  username: '24db27218ed09205a5a0',
  name: '24db27218ed09205a5a0',
  email: '24db27218ed09205a5a076983bf241ab@example.com',
  external_id: '684',
  avatar_url: 'https://d3bpeqsaub0i6y.cloudfront.net/user_avatar/meta.discourse.org/codinghorror/240/110067_2.png',
)
2 Likes
11

Do I get it right, that we can send POST /admin/users/sync_sso?api_key=...&api_username=...&sso=...&sig=... ?
Are ‘sso’ and ‘sig’ parameters similar to the same of SSO authorization flow?

12

I tried to perform request as explained above POST /admin/users/sync_sso?api_key=...&api_username=...&sso=...&sig=... and it responded 200 with my user, but user avatar was not updated without any log events. What am I doing wrong?

13

You should include the api_key and api_username in the http header because using them in the query parameters is deprecated.

I think there must be some protection in the code that prevents accidentally deleting an avatar if the field is left off or is empty. You will most likely need to provide a url to a default avatar to replace the existing avatar.

14

I replaced API credentials with headers.
SSO synchronization didn’t update user avatar with provided one. Although Sidekiq job in that call was completed and there was no error or warning logs.

15

You can turn on verbose sso logs in site settings to see if anything show up there.

Is the avatar_url you are providing public? Your discourse site will need to be able to access it.

1 Like