Skip to main content
DELETE
Delete User
Revoke a user. Erases their wrapped DEK(s) for this index — even a captured cdbk_… token becomes useless on the next request. Cryptographic revocation, no propagation lag.
See Multi-Tenancy & RBAC for the full operator playbook.

Authentication

Required — root API key in the X-API-Key header:

Path Parameters

Headers

GET/DELETE on this resource have no request body, so the index key travels in the X-Index-Key header. The sibling POST /v1/indexes/{index_name}/users endpoint takes the same key as an index_key field in its JSON body.

Response

204 No Content on success — body is empty. Revocation is idempotent: an unknown or already-revoked user_id also returns 204, not an error.

Exceptions

user_id is not valid hex.
Authentication failed (invalid root API key).
RBAC is not enabled, or the caller is not using the root key.
Index not found.
Internal server error.

Example Usage

Verify revocation: