Skip to main content

BanUser

POST 
/v1/users/:user_id/ban

BanUser bans a user (authn.user.banned = true) with a reason, and immediately revokes every live session and API key the user holds. It replaced better-auth's admin ban-user endpoint: the flag lives on the authn.user row, the session revocation matches better-auth's ban-time deletion, and the key soft-delete matches the ban hook (keys are marked deleted_at, never restored -- an unbanned user issues fresh keys).

Admin-gated and session-only, carrying the same caller contract as DeleteUser: an interactive session that holds the admin scope, or the users.edit permission on a platform-scope RBAC binding. A ban revokes every session and every API key the target holds, so its blast radius equals a delete's and the two admit the same administrators. users.edit is also the atom the old ban endpoints authorized on, so a ban still needs the same permission.

The request names a bare user_id and no tenant, so users.edit is authorized at PLATFORM reach. The handler re-checks the session half: an API key is refused even when it carries users.edit.

Request​

Responses​

Success