Admin API cannot be used on unverified accounts

XMLWordPrintable

    • Type: Bug
    • Resolution: Fixed
    • Priority: Medium
    • Component/s: Profile - View
    • None
    • 4
    • Minor

      Issue Summary

      Unverified accounts can be be managed using the admin APIs. The following endpoints cannot be used against unverified accounts. 

      GET /users/{account_id}/manage/profile
PATCH /users/{account_id}/manage/profile
PUT /users/{account_id}/manage/email
POST /users/{account_id}/manage/lifecycle/disable
POST /users/{account_id}/manage/lifecycle/enable

      Steps to Reproduce

      Use the admin API to deactivate an unverified account.

      curl --request POST \
  --url 'https://api.atlassian.com/users/<UNVERIFIED_ACCOUNTID>/manage/lifecycle/disable' \
  --header 'Authorization: Bearer <ORG_APITOKEN>' \
  --header 'Content-Type: application/json' \
  --data '{
  "message": "..."
}'

      Expected Results

      The unverified account should be deactivated.

      Actual Results

      Error message returned

      < HTTP/2 403 
{"key":"forbidden.targetUnverified",
"context":"Error: Cannot perform action on unverified account",
"errorKey":"forbidden.target-unverified",
"errorDetail":"Error: Cannot perform action on unverified account"}

      Workaround

      Perform the deactivation via the org managed account admin interface if possible.

            Assignee:
            Aneita
            Reporter:
            Ramon M (Inactive)
            Votes:
            7 Vote for this issue
            Watchers:
            17 Start watching this issue

              Created:
              Updated:
              Resolved: