# Unlock a user

`POST /v1/users/{user_id}:unlock` · permission `user-credentials:write`

Removes every open account lockout of a user, on all sign-in paths, and starts their failure counts over. For each removed lockout the `user.unlocked` event (`by = admin`) is written, and one management audit record (`user.unlocked`) lists the removed lockouts, with your credential as the actor. A user without an open lockout gets `unlocked: 0` and nothing is written, so the call is safe to repeat. To remove a single lockout, use [`DELETE /v1/attack-protection/lockouts/{lockout_id}`](../attack-protection/delete-lockout.md).

## Request

| Parameter | In | Required | Description |
|---|---|---|---|
| `user_id` | path | yes | User id, prefixed `usr_`. |

The operation takes no body.

## Response

`200 OK`.

```json
{"unlocked": 2}
```

`unlocked` is the number of removed lockouts (at most one per sign-in path).

## Errors

Every error is an `application/problem+json` body with a stable `code`.

| HTTP | `code` | When |
|---|---|---|
| 404 | `not_found` | The user does not exist in this environment (or the id is malformed). |
| 401 | `unauthenticated` | The API key is missing, invalid or revoked. |
| 403 | `insufficient_permissions` | The key lacks the `user-credentials:write` permission. |
| 429 | `rate_limited` | The rate limit was exceeded; honor `Retry-After`. |
| 503 | `service_unavailable` | A dependency is temporarily unavailable; retry later. |

## Example

```bash
curl -X POST https://api.eu.keenauth.com/v1/users/usr_0a1b2c3d4e5f6g7h8j9k0m1n2p:unlock \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY"
```

CLI: `keenauth users unlock usr_0a1b2c3d4e5f6g7h8j9k0m1n2p`