Skip to main content
POST
Suspend a user
When you suspend a user, the user’s state transitions from ACTIVE to SUSPENDED, and their access to the account is removed. A successful request returns the updated user with the state set to SUSPENDED. The :suspend action is idempotent. Using this action on a user who is already suspended returns the user with no changes to their state. Only active users can be suspended. Suspending a user who is in another state, such as pending confirmation, returns 400 Bad Request with the failed_precondition code and the message user_not_suspendable. This endpoint doesn’t accept a request body.

Restrictions

The following users can’t be suspended from a 1Password account:
  • People in the External Account Managers group.
  • The last remaining owner of an account. Attempting to suspend the last owner returns 403 Forbidden with the message Cannot suspend user: no_owner_remain.
Your integration should handle these outcomes gracefully (for example, log the failure and notify an administrator).

Authorizations

Authorization
string
header
required

OAuth 2.0 access token authentication. Request an access token from the OAuth token endpoint using the client credentials for the OAuth application in your 1Password account, then include it in the Authorization header of every request as Bearer <token>. Access tokens expire after 15 minutes (900 seconds).

Headers

User-Agent
string

An identifiable user agent for your integration, in the format <CompanyOrProductName>/<version>, so requests can be attributed to a specific integration for support, troubleshooting, and usage analytics.

Path Parameters

account
string
required

The unique identifier of the 1Password account, a 26-character uppercase ID. A malformed ID returns 400 Bad Request.

Required string length: 26
user
string
required

The unique identifier of the user, a 26-character uppercase ID. A malformed ID returns 400 Bad Request.

Required string length: 26

Response

The updated user, with state SUSPENDED.

A user within a 1Password account.

id
string
read-only

The unique identifier (UUID) of the user.

email
string

The email address of the user.

display_name
string

The display name of the user.

state
enum<string>

The current state of the user. Omitted when the user is neither active nor suspended, for example while pending confirmation or in account recovery.

Available options:
STATE_UNSPECIFIED,
ACTIVE,
SUSPENDED
create_time
string<date-time>
read-only

The date and time the user was created, in RFC 3339 format.

path
string
read-only

The resource path of the user. Format: accounts/{account}/users/{user}