Turns an account off without deleting it -- a disabled account can't authenticate, and any session it currently holds is killed immediately.

Having trouble reaching the API, or logging in from another machine? See Network Access & Authentication Security -- by default the Api only answers localhost, and PowerShell needs an extra flag once it does answer elsewhere.

Order of Operations

  1. Authenticate to the API.
  2. Get the user's id (from Manage App Accounts).
  3. Send the new disabled state.

The call

PATCH /api/security/users/{userId}/disabled

Permission needed: Security.Manage -- there's no self-service exemption here (unlike setting your own password).

C# example

var jsonOptions = new JsonSerializerOptions(JsonSerializerDefaults.Web);

// Step 1: Authenticate to the API.
using var handler = new HttpClientHandler { UseDefaultCredentials = true };
using var client = new HttpClient(handler) { BaseAddress = new Uri("http://your-minion-agent-server:5443") };
client.DefaultRequestHeaders.Add("X-App-Name", "MyIntegration");

// Step 2: You already have the user's id.
var userId = 41;

// Step 3: Disable the account -- this also immediately kills any session it currently holds.
var response = await client.PatchAsJsonAsync($"/api/security/users/{userId}/disabled", new SetUserDisabledRequest(IsDisabled: true), jsonOptions);
response.EnsureSuccessStatusCode();
Console.WriteLine("Disabled.");

record SetUserDisabledRequest(bool IsDisabled);

Not on a domain machine? Swap in the app-account login from Calling the API From Your Own Code.

PowerShell example

# Step 1: Authenticate to the API.
$headers = @{ "X-App-Name" = "MyIntegration" }

# Step 2: You already have the user's id.
$userId = 41

# Step 3: Disable the account. (-AllowUnencryptedAuthentication: PowerShell requires this for Windows auth over plain http to anything but localhost -- see "Network Access & Authentication Security".)
$body = @{ IsDisabled = $true } | ConvertTo-Json
Invoke-RestMethod -Uri "http://your-minion-agent-server:5443/api/security/users/$userId/disabled" `
    -Method Patch -Body $body -ContentType "application/json" -UseDefaultCredentials -AllowUnencryptedAuthentication -Headers $headers
"Disabled."

What you get back

204 No Content -- no body.

Codes this call can return

See API Response Codes for what each one means in general. For this specific call:

  • 204 -- updated.
  • 403 -- you don't have Security.Manage.
  • 404 -- no user exists with that id.

What gets audited

Recorded as AppUser / Alter User, with the new IsDisabled value in the after-state.

See also: Manage App Accounts, Set / Remove a User's Password.