Skip to main content

BanUser

POST 
/v1/users/:user_id/ban

BanUser bans a user (authn.user.banned = true) with a reason, and immediately revokes every live session and API key the user holds. This is the valet-native equivalent of fraser-auth's better-auth admin ban-user endpoint (fraser#9001): the flag lives on the shared authn.user row, the session revocation matches better-auth's ban-time deletion, and the key soft-delete matches the fraser#8689 hook (keys are marked deleted_at, never restored -- an unbanned user issues fresh keys).

Admin-gated and session-only, carrying the same caller contract as DeleteUser (fraser#9151): an interactive session that holds the admin scope, or the users.edit permission on a platform-scope RBAC binding. A ban revokes every session and every API key the target holds, so its blast radius equals a delete's and the two admit the same administrators. users.edit is also the atom fraser-auth authorizes its own ban endpoints on (fraser#8689), so valet and fraser-auth answer a ban from one permission.

The request names a bare user_id and no tenant, so users.edit is authorized at PLATFORM reach. The handler re-checks the session half: an API key is refused even when it carries users.edit.

Request​

Responses​

Success