# Grant\_Admin / Revoke\_admin through API Needs revision

**URL:** https://meta.discourse.org/t/grant-admin-revoke-admin-through-api-needs-revision/169559
**Category:** Bug
**Created:** [November 8, 2020, 7:45pm UTC](https://meta.discourse.org/t/grant-admin-revoke-admin-through-api-needs-revision/169559 "2020-11-08T19:45:35Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Kimberly\_Boynton](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/kimberly_boynton/32/68166_2.png) [@Kimberly\_Boynton](https://meta.discourse.org/u/Kimberly_Boynton)
#### Post date: [November 8, 2020, 7:45pm UTC](https://meta.discourse.org/t/grant-admin-revoke-admin-through-api-needs-revision/169559/1 "2020-11-08T19:45:35Z")

</div>

There either needs to have a SETTING for turning off confirmation emails or confirmation emails for revoke admin, because I set up something to modify admin through API and CANNOT functionally use it using the system and lost admin on my own account because of this, as well as several others, because it requires an email confirmation, which system didn’t have an email for confirmation somehow? and because revoke absolutely doesn’t need one.

I would most prefer if there was a setting to turn off confirmation on an API basis.

---

<div class="post-metadata">

### Author: ![simon](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/simon/32/339122_2.png) [@simon](https://meta.discourse.org/u/simon)
#### Post date: [November 9, 2020, 10:34pm UTC](https://meta.discourse.org/t/grant-admin-revoke-admin-through-api-needs-revision/169559/2 "2020-11-09T22:34:49Z")

</div>

> [@Kimberly\_Boynton](#):
>
> because revoke absolutely doesn’t need one.

I’ve just tested this out on my own site. Revoking admin status via the API is done by making a `PUT` request to `https://forum.yourdomain.com/admin/users/<user_id>/revoke_admin`. When I try this, admin status is revoked and no email confirmation is required. I’m finding a couple of issues with the response that Discourse sends for this request though.

If the user _does_ have admin status, I’m getting an empty response instead of a success message when I revoke their admin status via the API.

If the user _does not_ have admin status, I get an HTML response if the `PUT` request is made to `https://forum.yourdomain.com/admin/users/<user_id>/revoke_admin` and an `invalid access` error if I make the request to `https://forum.yourdomain.com/admin/users/<user_id>/revoke_admin.json`.

It would be good to get informative success and failure messages for this route.

I’m not sure about allowing admin status to be _granted_ without a confirmation email. The way it currently works is intended to supply an extra layer of security.

---

<div class="post-metadata">

### Author: ![Kimberly\_Boynton](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/kimberly_boynton/32/68166_2.png) [@Kimberly\_Boynton](https://meta.discourse.org/u/Kimberly_Boynton)
#### Post date: [November 10, 2020, 12:04am UTC](https://meta.discourse.org/t/grant-admin-revoke-admin-through-api-needs-revision/169559/5 "2020-11-10T00:04:51Z")

</div>

Exactly the problem with revoke not needing one and giving it does. If you’re not aware of it, then you can revoke ALL admins on accident from your discourse and have 0 recourse to add them…

If you’re going to make one REQUIRED to have something to verify, the other also should have a verify.

There is also no ability to turn off this verification so you can just grant admin through api directly if you have an admin that has all power.