Offboard a User

Offboard a User

Disable a realm user, remove its roles and group membership, and optionally delete it.

1. Resolve the account UUID from the username. Every subsequent admin call is keyed on the UUID, and a miss here stops the flow before anything is changed.
2. Disable the account first. This is the step that actually stops access, so it runs before the slower entitlement teardown rather than after it.
3. Read the realm-level role mappings currently granted to the user. The removal endpoint needs these representations verbatim in its body, so they have to be captured before they can be revoked.
4. Revoke every realm-level role captured in the previous step by passing the role representations back to the delete-mappings endpoint.
5. Read the groups the user belongs to, since group membership carries roles of its own and survives a disabled account.
6. Remove the user from the first group returned. Keycloak exposes group removal one group at a time, so a user in several groups needs this workflow re-run per group id.
7. Re-read the account to confirm it is disabled, and stop here unless the caller explicitly asked for a hard delete.
8. Permanently delete the stripped account. Only reached when hardDelete is true; this cannot be undone.

What you'll need to have ready

• realm: The name of the realm the user belongs to.
• username: The username of the account to offboard.
• hardDelete: When true the account is permanently deleted after being stripped. When false (the default posture) the account is left disabled and empty but recoverable.

For your developer

Arazzo workflow keycloak:offboard-user, 8 operations: getUsers → updateUser → getUserRealmRoleMappings → deleteUserRealmRoleMappings → getUserGroups → removeUserFromGroup → getUser → deleteUser. Specs on APIs.io.