Users (RBAC)
Delete User
DELETE
Delete User
Revoke a user. Erases their wrapped DEK(s) for this index — even a captured
Verify revocation:
cdbk_… token becomes useless on the next request. Cryptographic revocation, no propagation lag.
See Multi-Tenancy & RBAC for the full operator playbook.
Authentication
Required — root API key in theX-API-Key header:
Path Parameters
Headers
GET/DELETE on this resource have no request body, so the index key travels in the X-Index-Key header. The sibling POST /v1/indexes/{index_name}/users endpoint takes the same key as an index_key field in its JSON body.Response
204 No Content on success — body is empty.
Revocation is idempotent: an unknown or already-revoked user_id also returns 204, not an error.
Exceptions
400 Bad Request
400 Bad Request
user_id is not valid hex.403 Forbidden
403 Forbidden
RBAC is not enabled, or the caller is not using the root key.
404 Not Found
404 Not Found
Index not found.
500 Internal Server Error
500 Internal Server Error
Internal server error.