# Unable to anonymize user via API with SSO enabled

**URL:** https://meta.discourse.org/t/unable-to-anonymize-user-via-api-with-sso-enabled/229610
**Category:** Development
**Tags:** rest-api
**Created:** [June 10, 2022, 1:16pm UTC](https://meta.discourse.org/t/unable-to-anonymize-user-via-api-with-sso-enabled/229610 "2022-06-10T13:16:30Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![FoxCZ](https://avatars.discourse-cdn.com/v4/letter/f/3da27b/32.png) [@FoxCZ](https://meta.discourse.org/u/FoxCZ)
#### Post date: [June 10, 2022, 1:16pm UTC](https://meta.discourse.org/t/unable-to-anonymize-user-via-api-with-sso-enabled/229610/1 "2022-06-10T13:16:30Z")

</div>

Hi everyone!

We have decided to use Discourse as our main forum interface with [Discourse SSO](https://meta.discourse.org/t/13045?silent=true) as login/signup.  
The SSO features (details sync, …) are implemented and working (mentioning this just for bit of background).

In order to comply with GDPR I’m trying to implement user anonymization using API call from our backend (as detailed here: [Discourse API Docs](https://docs.discourse.org/#tag/Admin/operation/anonymizeUser) ).  
Unfortunately the endpoint responses with:

```javascript
{ ...
statusCode: 403,
error: '{"errors":["You are not permitted to view the requested resource."],"error_type":"invalid_access"}',
... }

```

The API call looks like:

```javascript
await request.put({
      url: `${discourseApiUrl}/admin/users/${discourseUserId}/anonymize.json`,
      headers: {
          'Api-Key': "API KEY",
         'Api-Username': "system"
      },
});

```

The `discourseUserId` is obtained from the `admin/users/list/all.json?email=<email>` endpoint and that call works without any problems (using the same `API key` and `username`).

I’w tried calling the endpoint from Postman as well with the same result (“invalid\_access”).

I will greatly appreciate any pointer on what I’m missing or suggestion how to resolve this.

---

<div class="post-metadata">

### Author: ![FoxCZ](https://avatars.discourse-cdn.com/v4/letter/f/3da27b/32.png) [@FoxCZ](https://meta.discourse.org/u/FoxCZ)
#### Post date: [June 13, 2022, 10:31am UTC](https://meta.discourse.org/t/unable-to-anonymize-user-via-api-with-sso-enabled/229610/2 "2022-06-13T10:31:58Z")

</div>

I’m going to reply my self as I found out what was wrong with the call.  
Seems like the `admin` and `moderators` account can not be deleted or anonymized. And this was the case with my test account.  
Might be nice to mention this in the API documentation at some point.