# Suspended, inactive and blocked user with API key can still create topics
**URL:** https://meta.discourse.org/t/suspended-inactive-and-blocked-user-with-api-key-can-still-create-topics/32033
**Category:** Bug
**Tags:** rest-api
**Created:** [August 12, 2015, 6:07pm UTC](https://meta.discourse.org/t/suspended-inactive-and-blocked-user-with-api-key-can-still-create-topics/32033 "2015-08-12T18:07:01Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@gtanczyk](https://meta.discourse.org/u/gtanczyk)
#### Post date: [August 12, 2015, 6:07pm UTC](https://meta.discourse.org/t/suspended-inactive-and-blocked-user-with-api-key-can-still-create-topics/32033/1 "2015-08-12T18:07:01Z")
User is configured like this:
Inactive and suspended, yet I am still able to create topic with following code:
```
@data = {
skip_validations: true,
auto_track: false,
title: "test",
raw: "test"
}
resp = client.create_topic(@data)
```
Is this intended behavior? On the other hand category security settings are respected.
What I am trying to achieve: I have open source project with simple ruby script that downloads latest topics from some particular discourse instance and converts that to a static web site.
I would like to commit this API key for read only user, so everyone can clone this repo and start their work.
Is there any other way to achieve this(read-only user with api access)?
Thanks
Edit: It also doesn’t work when user is blocked
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [August 12, 2015, 9:54pm UTC](https://meta.discourse.org/t/suspended-inactive-and-blocked-user-with-api-key-can-still-create-topics/32033/2 "2015-08-12T21:54:33Z")
> [@gtanczyk](#):
>
> skip\_validations: true
Only API is allowed to do this. We never intended to allow API usage to general public, if you suspend a user you must revoke their keys.
> [@gtanczyk](#):
>
> I would like to commit this API key for read only user, so everyone can clone this repo and start their work.
Hmmm, for read only access you don’t need any API key, all the json endpoints work fine without it.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [August 13, 2015, 1:41am UTC](https://meta.discourse.org/t/suspended-inactive-and-blocked-user-with-api-key-can-still-create-topics/32033/3 "2015-08-13T01:41:17Z")
Probably Ok to add a check here in API for suspended user, but this seems like a super freakish edge case to me…
Perhaps the suspend action could auto revoke any API keys this user holds?
---
### Author:  [@gtanczyk](https://meta.discourse.org/u/gtanczyk)
#### Post date: [August 13, 2015, 12:02pm UTC](https://meta.discourse.org/t/suspended-inactive-and-blocked-user-with-api-key-can-still-create-topics/32033/4 "2015-08-13T12:02:06Z")
Thanks for tip @sam, problem is gone.
Revoking api keys on suspend/block/deactivate would be far more intuitive.
---
### Author:  [@zogstrip](https://meta.discourse.org/u/zogstrip)
#### Post date: [August 23, 2015, 8:34pm UTC](https://meta.discourse.org/t/suspended-inactive-and-blocked-user-with-api-key-can-still-create-topics/32033/5 "2015-08-23T20:34:22Z")
> [@codinghorror](#):
>
> Perhaps the suspend action could auto revoke any API keys this user holds?
That’s now done :rat:
[https://github.com/discourse/discourse/commit/73624e63c52f915c1530d29a965cee9d0ae2de7d](https://github.com/discourse/discourse/commit/73624e63c52f915c1530d29a965cee9d0ae2de7d)
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [August 23, 2015, 9:20pm UTC](https://meta.discourse.org/t/suspended-inactive-and-blocked-user-with-api-key-can-still-create-topics/32033/6 "2015-08-23T21:20:10Z")