Offboard a User

Securely remove a departing employee's access while maintaining audit trail and preventing disruption to team workflows.

Critical: Security Checklist

Immediate Actions (Do First)

  1. Disable User Account

PUT /admin/api/users/user-123 { "enabled": false }

  1. Revoke All API Keys

# List user's keys GET /admin/api/users/user-123/api-keys # Delete each key DELETE /admin/api/users/api-keys/AK-abc123 DELETE /admin/api/users/api-keys/AK-def456

  1. Remove from All Groups

PUT /admin/api/users/user-123/remove-groups { "groupIds": [ "group-data-eng", "group-pipeline-owners", "group-prod-access" ] }

Timeline: Complete within 1 hour of departure notification

Complete Offboarding Workflow

Step 1: Document Current Access

# Get full user details GET /admin/api/users/user-123 # Get roles GET /authz/api/v1/users/user-123/roles # Get API keys GET /admin/api/users/user-123/api-keys

Save this for audit trail and handover documentation.

Step 2: Disable Account (Don't Delete)

PUT /admin/api/users/user-123 { "enabled": false, "attributes": { "status": ["OFFBOARDED"], "offboardDate": ["2024-12-05"], "reason": ["Voluntary - New Job"], "handedOffTo": ["replacement@company.com"] } }

Why not delete?

  • Preserves audit history

  • Maintains data lineage

  • Compliance requirements

  • Can reactivate if they return

Step 3: Revoke API Keys

# Get all keys GET /admin/api/users/user-123/api-keys # Revoke each DELETE /admin/api/users/api-keys/AK-key1 DELETE /admin/api/users/api-keys/AK-key2

Step 4: Remove Group Memberships

PUT /admin/api/users/user-123/remove-groups { "groupIds": ["all", "groups", "user", "was", "in"] }

Step 5: Verify Access Removed

# Should return empty/minimal permissions GET /authz/api/v1/users/permissions?userId=user-123 # Should show enabled: false GET /admin/api/users/user-123

Step 6: Update Ownership

Transfer ownership of resources created by departing user:

# Update pipeline metadata PUT /torch-pipeline/api/pipelines { "meta": { "owner": "replacement@company.com" } }

Emergency Offboarding

If user leaves unexpectedly or security incident:

# 1. Immediate disable (2 minutes) PUT /admin/api/users/user-123 {"enabled": false} # 2. Mass revoke (5 minutes) DELETE /admin/api/users/api-keys/AK-* (all keys) # 3. Group removal (3 minutes) PUT /admin/api/users/user-123/remove-groups {"groupIds": [...all]} # Total time: 10 minutes

APIs Used

  1. PUT /admin/api/users/:userId - Disable account

  2. GET /admin/api/users/:userId/api-keys - List keys

  3. DELETE /admin/api/users/api-keys/:accessKey - Revoke keys

  4. PUT /admin/api/users/:userId/remove-groups - Remove access

  5. GET /authz/api/v1/users/permissions - Verify removal


Next to read:
Audit and Review User Access

For additional help, contact www.acceldata.force.com OR call our service desk +1 844 9433282

Copyright © 2025

On This Page
Offboard a UserCritical: Security ChecklistComplete Offboarding WorkflowEmergency OffboardingAPIs UsedImmediate Actions (Do First)Step 1: Document Current AccessStep 2: Disable Account (Don't Delete)Step 3: Revoke API KeysStep 4: Remove Group MembershipsStep 5: Verify Access RemovedStep 6: Update Ownership