# Remove an account lockout

`DELETE /v1/attack-protection/lockouts/{lockout_id}` · permission `attack-protection:write`

Removes one open account lockout: the user can sign in on that path again, and the failure count for the path starts over. The `user.unlocked` event (`by = admin`) and a management audit record (`user.unlocked`, target the user) are written in the same transaction, with your credential as the actor. To remove every lockout of a user at once, use [`POST /v1/users/{user_id}:unlock`](../users/unlock.md).

## Request

| Parameter | In | Required | Description |
|---|---|---|---|
| `lockout_id` | path | yes | Lockout id, prefixed `lck_`. |

## Response

`204 No Content`, without a body.

## Errors

Every error is an `application/problem+json` body with a stable `code`.

| HTTP | `code` | When |
|---|---|---|
| 404 | `not_found` | No open lockout has this id in this environment: it never existed, it was already removed, or it expired (or the id is malformed). |
| 401 | `unauthenticated` | The API key is missing, invalid or revoked. |
| 403 | `insufficient_permissions` | The key lacks the `attack-protection:write` permission. |
| 429 | `rate_limited` | The rate limit was exceeded; honor `Retry-After`. |
| 503 | `service_unavailable` | A dependency is temporarily unavailable; retry later. |

## Example

```bash
curl -X DELETE https://api.eu.keenauth.com/v1/attack-protection/lockouts/lck_01jaz8m5c3f6t9w2y4b7d0g3k6 \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY"
```

CLI: `keenauth attack-protection lockouts delete lck_01jaz8m5c3f6t9w2y4b7d0g3k6`