Uploaded image for project: 'Identity'
  1. Identity
  2. ID-7748

Admin API cannot be used on unverified accounts

    XMLWordPrintable

Details

    • Bug
    • Resolution: Fixed
    • Medium
    • Profile - View
    • None

    Description

      Issue Summary

      Unverified accounts can be be managed using the admin APIs. The following endpoints cannot be used against unverified accounts.

      GET /users/{account_id}/manage/profile
      PATCH /users/{account_id}/manage/profile
      PUT /users/{account_id}/manage/email
      POST /users/{account_id}/manage/lifecycle/disable
      POST /users/{account_id}/manage/lifecycle/enable
      

      Steps to Reproduce

      Use the admin API to deactivate an unverified account.

      curl --request POST \
        --url 'https://api.atlassian.com/users/<UNVERIFIED_ACCOUNTID>/manage/lifecycle/disable' \
        --header 'Authorization: Bearer <ORG_APITOKEN>' \
        --header 'Content-Type: application/json' \
        --data '{
        "message": "..."
      }'
      

      Expected Results

      The unverified account should be deactivated.

      Actual Results

      Error message returned

      < HTTP/2 403 
      {"key":"forbidden.targetUnverified",
      "context":"Error: Cannot perform action on unverified account",
      "errorKey":"forbidden.target-unverified",
      "errorDetail":"Error: Cannot perform action on unverified account"}
      

      Workaround

      Perform the deactivation via the org managed account admin interface if possible.

      Attachments

        Issue Links

          Activity

            People

              ayang@atlassian.com Aneita
              rmacalinao Ramon M
              Votes:
              7 Vote for this issue
              Watchers:
              17 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: