An admin with the user:manage permission removes a user in Administration, under Users, or with DELETE /api/users/:id. Nobody can delete the base admin account. Revoke the person's API tokens and check your pipelines, since jobs that used their token will fail.
Steps
- Use an account that holds
user:manage, such as a SuperAdmin. - Open Administration, go to Users and find the person.
- Revoke their API tokens first, if they had any, by following how to revoke a user's API tokens.
- Delete the user. Your screen may offer a delete control on their row, and the API route is
DELETE /api/users/:id. - Open Activity. Search for the person's name to review what the account did before it went, including scans it started, findings it triaged and any settings it touched along the way.
- Check any CI job that used their token, and give it a token from a current user.
We did not review the Administration screens, so button names may differ from the words here.
Good to know
Two rules come from the API Reference. You cannot delete the base admin, and other admins cannot change that account. A failed delete on that user means the protection is doing its job.
| Need | Better choice |
|---|---|
| Person leaves the company | Delete the user and revoke tokens |
| Person changes team | Update their role instead |
| Token leaked | Revoke tokens only |
- Issues belong to a target, not to a user, so the target's findings stay in place.
- Hand any issue assigned to them to someone else. See how to assign a finding.
- With single sign-on, also remove the person from your identity provider so they cannot sign in again.
This follows least privilege. Access that nobody needs should not exist. To add people, read how to add a new user.
Related questions
- How do I revoke a user's API tokens?
- How do I add a new user to my workspace?
- Why can't I delete the base admin account?
- How do I see each user's role and team grants?
- How do I assign a finding to a teammate?
Cyberlop API tokens and permissions: how to issue and limit them
Step-by-step, with annotated screenshots.
Updated · Back to the help centre
Still stuck?
Tell us what you see on screen and an engineer will help you sort it out.