# Remove a person POST /v1/identity/users/{userId}/unregister ```sh curl --request POST \ --url https://example.com/v1/identity/users/example/unregister \ --header 'Authorization: Bearer ' ``` Removes a person from the tenant, in one step: they’re marked removed (`unregisteredAt`; their record stays, so their history still says who they were), every API key and session of theirs is revoked, and every grant and membership they hold is taken away, all before it answers. Their keys get `401` at once. Their email is free again: adding it makes a new person. Removing someone already removed changes nothing. Refused for yourself and the deployment’s seed user (`identity-user-unregister-refused`), and for the only tenant admin (`last-tenant-admin`). Tenant admins only. Mounted when the identity directory can remove people. ## Authorizations - **[bearerAuth](https://docs.kindgi.com/v0.1.8/reference/api.md#bearerauth)** ## Parameters ### Path Parameters **userId** required string \>= 1 characters ### Header Parameters **Idempotency-Key** string \>= 1 characters Caller-supplied idempotency key, scoped to the caller: the same key from someone else in the tenant is their own request (from 0.1.5). Retries with the same key return the original response byte-identical (per `docs/API-ROUTE-CONVENTIONS.md` §3.1). A retry sent while the first request still runs is answered `409 idempotency-key-in-flight` with `Retry-After`, on a runtime whose store holds keys (from 0.1.5); retry after it, and you get the first request’s answer. An answer that carries a secret (a new API key or public run token, a session token, a generated signing secret) isn’t kept: a retry gets `409 idempotency-key-replay-withheld`, with the first request’s status and when it succeeded (from 0.1.5). ## Responses ### 200 The removed person, and what removing them took away. application/json A removed person, and what removing them took away (each 0 when they were already removed). object **user** required Tenant-scoped user record (admin plane). `primaryEmail` may be redacted on the wire based on tenant policy (the routes treat it as opaque). `metadata` is free-form JSON — deployments carry IdP claims / provisioning source / roles here. object **userId** required string **tenantId** required string format: uuid **primaryEmail** string **displayName** string **createdAt** required string format: date-time **lastActiveAt** string format: date-time **unregisteredAt** When they were removed from the tenant (`POST /v1/identity/users/{userId}/unregister`); absent while they are here. string format: date-time **metadata** object **_key_** additional properties any **grants** The person’s grants: only on `GET /v1/identity/users?include=grants`, and only from a runtime that reads grants. object **userId** required string **tenantAdmin** Whether the person is a tenant admin. Absent when the runtime has no authorization store: nothing grants it then. boolean **tenantMember** Whether the person is a tenant member: they read the tenant’s settings (providers, policies, adapters, signing keys, deployments), not its projects. A person is one from being added. Absent when the runtime has no authorization store, or doesn’t report it. boolean **projects** required Direct project memberships. Array\