Unlink a linked identity from a user

DELETE /v1/users/{user_id}/identities/{identity_id} · permission users:write

Removes one linked identity of a user (password, social, SAML, OIDC or legacy). The removal goes through even when an organization the user belongs to enforces SSO through the identity's connection: the user cannot remove such an identity from the account portal (409 sso_enforced_by_organization), the customer removes it with this endpoint. The user's last first-factor method cannot be removed (409 last_login_method). The user is notified at every verified address, and the action is written to the management audit log with the API key as actor.

Request

Parameter In Required Description
user_id path yes User id, prefixed usr_.
identity_id path yes Identity id, prefixed idn_ (as returned by GET /v1/users/{user_id}/identities).

The request takes no body.

Response

204 No Content.

Errors

Every error is an application/problem+json body with a stable code.

HTTP code When
404 not_found The user does not exist in this environment, the identity does not belong to this user or is unknown, or an id is malformed.
409 last_login_method This identity is the user's last first-factor method; add another method first.
401 unauthenticated The API key is missing, invalid or revoked.
403 insufficient_permissions The key lacks the users:write permission.
429 rate_limited The rate limit was exceeded; honor Retry-After.
503 service_unavailable A dependency is temporarily unavailable; retry later.

Example

curl -X DELETE https://api.eu.keenauth.com/v1/users/usr_0a1b2c3d4e5f6g7h8j9k0m1n2p/identities/idn_0a1b2c3d4e5f6g7h8j9k0m1n2r \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY"

Personal data

This endpoint carries personal data: linked identities. Personal data in the KeenAuth APIs describes what is stored, how long it is kept and how it is deleted. Do not send special categories of personal data (health, biometric data, religion, political opinions, sexual orientation) in any field.