Offboard a User

Securely remove a departing employee's access while maintaining audit trail and preventing disruption to team workflows.

Critical: Security Checklist

Immediate Actions (Do First)

Disable User Account

Bash
    
 
PUT /admin/api/users/user-123{  "enabled": false}
Copy

Revoke All API Keys

Bash
    
​x
 
# List user's keysGET /admin/api/users/user-123/api-keys​# Delete each keyDELETE /admin/api/users/api-keys/AK-abc123DELETE /admin/api/users/api-keys/AK-def456
Copy

Remove from All Groups

Bash
    
 
PUT /admin/api/users/user-123/remove-groups{  "groupIds": [    "group-data-eng",    "group-pipeline-owners",    "group-prod-access"  ]}
Copy

Timeline: Complete within 1 hour of departure notification

Complete Offboarding Workflow

Step 1: Document Current Access

Bash
    
 
# Get full user detailsGET /admin/api/users/user-123​# Get rolesGET /authz/api/v1/users/user-123/roles​# Get API keysGET /admin/api/users/user-123/api-keys
Copy

Save this for audit trail and handover documentation.

Step 2: Disable Account (Don't Delete)

Bash
    
 
PUT /admin/api/users/user-123{  "enabled": false,  "attributes": {    "status": ["OFFBOARDED"],    "offboardDate": ["2024-12-05"],    "reason": ["Voluntary - New Job"],    "handedOffTo": ["replacement@company.com"]  }}
Copy

Why not delete?

Preserves audit history
Maintains data lineage
Compliance requirements
Can reactivate if they return

Step 3: Revoke API Keys

Bash
    
 
# Get all keysGET /admin/api/users/user-123/api-keys​# Revoke eachDELETE /admin/api/users/api-keys/AK-key1DELETE /admin/api/users/api-keys/AK-key2
Copy

Step 4: Remove Group Memberships

Bash
    
 
PUT /admin/api/users/user-123/remove-groups{  "groupIds": ["all", "groups", "user", "was", "in"]}
Copy

Step 5: Verify Access Removed

Bash
    
 
# Should return empty/minimal permissionsGET /authz/api/v1/users/permissions?userId=user-123​# Should show enabled: falseGET /admin/api/users/user-123
Copy

Step 6: Update Ownership

Transfer ownership of resources created by departing user:

Bash
    
 
# Update pipeline metadataPUT /torch-pipeline/api/pipelines{  "meta": {    "owner": "replacement@company.com"  }}
Copy

Emergency Offboarding

If user leaves unexpectedly or security incident:

Bash
    
 
# 1. Immediate disable (2 minutes)PUT /admin/api/users/user-123 {"enabled": false}​# 2. Mass revoke (5 minutes)DELETE /admin/api/users/api-keys/AK-* (all keys)​# 3. Group removal (3 minutes)PUT /admin/api/users/user-123/remove-groups {"groupIds": [...all]}​# Total time: 10 minutes
Copy

APIs Used

PUT /admin/api/users/:userId - Disable account
GET /admin/api/users/:userId/api-keys - List keys
DELETE /admin/api/users/api-keys/:accessKey - Revoke keys
PUT /admin/api/users/:userId/remove-groups - Remove access
GET /authz/api/v1/users/permissions - Verify removal

Last updated on

Was this page helpful?