# Deleting a user via discourse api

**URL:** https://meta.discourse.org/t/deleting-a-user-via-discourse-api/348202
**Category:** Support
**Created:** [January 20, 2025, 1:42pm UTC](https://meta.discourse.org/t/deleting-a-user-via-discourse-api/348202 "2025-01-20T13:42:53Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![gormus](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/gormus/32/428592_2.png) [@gormus](https://meta.discourse.org/u/gormus)
#### Post date: [January 20, 2025, 1:42pm UTC](https://meta.discourse.org/t/deleting-a-user-via-discourse-api/348202/1 "2025-01-20T13:42:53Z")

</div>

User accounts can be deleted via [Discourse API](https://docs.discourse.org/#tag/Admin/operation/deleteUser) as well.

For example;

```http
DELETE /admin/users/{id}.json HTTP/1.1

Content-Type: application/json
Api-Username: system
Api-Key: 1234 *******

{
  "delete_posts": true,
  "block_email": false,
  "block_urls": false,
  "block_ip": false
}

```

\* _The request is simplified for readability._

As you can see the payload options allows deleting the user generated posts in the same requests, as opposed to deleting the posts prior to account deletion when accounts are deleted manually in the admin page.

* * *

However, I’m getting a 403 access denied error for this request, even though the API key has a _global_ scope, and the user is `system`:

```json
{
  "errors": ["You are not permitted to view the requested resource."],
  "error_type": "invalid_access"
}

```

---

<div class="post-metadata">

### Author: ![Canapin](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/canapin/32/119591_2.png) [@Canapin](https://meta.discourse.org/u/Canapin)
#### Post date: [January 20, 2025, 1:58pm UTC](https://meta.discourse.org/t/deleting-a-user-via-discourse-api/348202/2 "2025-01-20T13:58:42Z")

</div>

Does it work if you change the values of the settings mentioned in the guide? The default values might block the user deletion. Not 100% sure.

---

<div class="post-metadata">

### Author: ![selase](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/selase/32/270909_2.png) [@selase](https://meta.discourse.org/u/selase)
#### Post date: [January 21, 2025, 3:22pm UTC](https://meta.discourse.org/t/deleting-a-user-via-discourse-api/348202/3 "2025-01-21T15:22:36Z")

</div>

I’m not sure about the specifics of the user you’re trying to delete, but the error you’re seeing likely stems from one or more of the following checks not being met.

> [@Deleting a user account](https://meta.discourse.org/t/deleting-a-user-account/312021/1):
>
> ### Important settings:
> 
> - **`delete_user_max_posts`** : Determines the maximum number of posts a user can have for their account to be eligible for deletion. For example, if set to 5, users with more than 5 posts cannot be deleted.
> - **`delete_user_max_post_age`** : The number of days since a user’s first post, within which the user can be deleted. For instance, setting this to 30 means users with posts older than 30 days cannot be deleted.
> - **`delete_all_posts_max`** : The maximum number of posts that can be deleted at once using the “Delete All Posts” button. For example, setting this to 100 limits bulk deletions to 100 posts at a time.

> <https://github.com/discourse/discourse/blob/f0d6e9758dda7efd214d054f6755d31a14db3338/lib/guardian/user_guardian.rb#L60-L74>

Most likely, it’s something in the `else` block. And yes, I agree, the error message could definitely be less vague 😬.

---

<div class="post-metadata">

### Author: ![gormus](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/gormus/32/428592_2.png) [@gormus](https://meta.discourse.org/u/gormus)
#### Post date: [January 21, 2025, 5:19pm UTC](https://meta.discourse.org/t/deleting-a-user-via-discourse-api/348202/4 "2025-01-21T17:19:09Z")

</div>

> [@selase](#):
>
> Most likely, it’s something in the `else` block

Spot on @selase! Seems like my user has more posts than `User::MAX_STAFF_DELETE_POST_COUNT` and also some are older than `SiteSetting.delete_user_max_post_age` 🙂

- **`delete_user_max_posts`** : must have been renamed to **`delete_user_self_max_post_count`** since the article posted. It is set to `1` (default)

- **`delete_user_max_post_age`** is set to `60` (default), and the user has posts over `60` days.

- **`delete_all_posts_max`** is set to `15` (default), and my user has `12` posts

Once I eliminated the restrictions, I was able to delete the my user via the API call.

```json
{"deleted":true}

```

> [@selase](#):
>
> And yes, I agree, the error message could definitely be less vague 😬.

😁

And perhaps [API Docs](https://docs.discourse.org/#tag/Users/operation/deleteUser) could use a mention of this requirement too, maybe?

---

<div class="post-metadata">

### Author: ![system](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/system/32/443519_2.png) [@system](https://meta.discourse.org/u/system)
#### Post date: [February 20, 2025, 5:20pm UTC](https://meta.discourse.org/t/deleting-a-user-via-discourse-api/348202/5 "2025-02-20T17:20:08Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.
