Loading…
Delete a user from the system.
| Permission | Description |
|---|---|
users.delete_any | Delete any user |
Disabled by default.
users.delete_anyis defined inconfig/permission.phpbut assigned to no role, because user accounts must not be hard-deleted (data integrity and the activity-log audit trail depend on it). Every caller therefore gets a403. The endpoint, policy and tests are kept intact — granting the permission to a role inconfig/permission.phpand re-runningPlatformDataSeederre-enables it.
Beyond the permission, the policy also refuses when the target is at the same access level (also holds users.delete_any) or is the caller themselves.
Despite the 204, this endpoint does return a JSON body — a localized confirmation message.
HTTP defines 204 as bodyless, so some clients and proxies discard it; treat the body as informational,
not something to depend on.
{
"message": "User deleted successfully."
}
Localized from messages.users.deleted_successfully (fa: “کاربر با موفقیت حذف شد.”).
| Status | Description | Reference |
|---|---|---|
| 401 | Unauthorized | Authentication error |
| 403 | Forbidden (no permission) | Permission error |
| 404 | Not found | Not-found error |