Deactivate Account

Temporarily deactivate the current account. Profile becomes hidden, all sessions revoked. Reversible via /users/reactivate.

POST /api/v1/users/deactivate — 🔑 Bearer · Rate limit: 3 req / hour

Sets User.status = DEACTIVATED and revokes every active session for this user. Reversible — the user can come back via POST /users/reactivate (auth-session mode) or by clicking a reactivation link sent later (token-bearer mode).

All sessions are revoked, including the one calling this endpoint. The next request with the existing access token will succeed only until the JWT expires (auth.access_token_ttl_seconds); the refresh cookie is dead immediately. Plan a redirect to a logged-out landing page on success.

Deactivation is distinct from deletion. Deactivation is reversible and preserves all data. Deletion is POST /users/delete (or POST /gdpr/delete), which schedules permanent erasure after a grace period. Deactivation by itself does not start any deletion timer.

Request

No body, no params.

Header	Required	Notes
`Authorization: Bearer <accessToken>`	✓	JWT from `POST /auth/login`

Response

`200 OK` — `SuccessOnlyResponseDto`

{
  "success": true
}

Field	Type	Notes
`success`	boolean	Always `true` on 200

Errors

HTTP	`code` / `i18nKey`	Reason
`400`	`error.user.account_not_active`	`User.status` is not `ACTIVE` (already DEACTIVATED, SUSPENDED, BANNED, or DELETED)
`401`	(guard)	Missing / invalid bearer token
`404`	`error.user.not_found`	Token decoded but user row missing
`429`	(throttle)	Rate limit exceeded (3 req/hour)

Side effects

Lookup User; throw not_found if missing.
Reject if User.status !== 'ACTIVE' — no idempotent re-deactivation.
Inside one transaction:
- User.status = DEACTIVATED.
- UPDATE Session SET revoked = true, revokedAt = now() WHERE userId = :userId AND revoked = false (every live session).
Audit log: [account] AUDIT: Deactivated by user {userId} (warn level).
No scheduled deletion is created — that requires the separate /users/delete flow.

Code samples

curl -X POST https://api.bio.re/api/v1/users/deactivate \
  -H "Authorization: Bearer $ACCESS_TOKEN"

async function deactivateAccount(accessToken: string): Promise<void> {
  const res = await fetch('https://api.bio.re/api/v1/users/deactivate', {
    method: 'POST',
    headers: { Authorization: `Bearer ${accessToken}` },
  });
  const json = await res.json();
  if (!res.ok || !json.success) {
    throw Object.assign(new Error(json?.error?.message ?? 'Deactivate failed'), {
      code: json?.error?.code,
    });
  }
}

import { useMutation, useQueryClient } from '@tanstack/react-query';

export function useDeactivateAccount() {
  const qc = useQueryClient();
  return useMutation({
    mutationFn: async () => {
      const res = await fetch('/api/v1/users/deactivate', { method: 'POST' });
      const json = await res.json();
      if (!res.ok || !json.success) {
        throw Object.assign(new Error(json?.error?.message ?? 'Deactivate failed'), {
          code: json?.error?.code,
          i18nKey: json?.error?.i18nKey,
        });
      }
    },
    onSuccess: () => {
      // Sessions revoked server-side — drop all caches, force re-auth flow
      qc.clear();
    },
  });
}

Try it

Authorization

bearer

AuthorizationBearer <token>

In: header

Response Body

`application/json`

curl -X POST "https://loading/api/v1/users/deactivate"

{
  "success": true
}

{
  "success": false,
  "error": {
    "code": "AUTH_UNAUTHORIZED",
    "message": "Invalid credentials",
    "i18nKey": "auth.login.invalid_credentials",
    "i18nVars": {
      "field": "email"
    },
    "details": [
      {
        "message": "email must be an email"
      }
    ],
    "correlationId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
  }
}

{
  "success": false,
  "error": {
    "code": "AUTH_UNAUTHORIZED",
    "message": "Invalid credentials",
    "i18nKey": "auth.login.invalid_credentials",
    "i18nVars": {
      "field": "email"
    },
    "details": [
      {
        "message": "email must be an email"
      }
    ],
    "correlationId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
  }
}

Source

Source	Path	Lines
Controller	`apps/api-core/src/modules/user/user.controller.ts`	`158–167` (`deactivateAccount`)
DTO (response)	`apps/api-core/src/common/dto/common-response.dto.ts`	`SuccessOnlyResponseDto`
Service	`apps/api-core/src/modules/user/user.service.ts`	`402–421` (`deactivateAccount`)
Prisma models	`packages/prisma/prisma/schema.prisma`	`User.status` (`UserStatus` enum), `Session.revoked`

Deactivate Account

200application/json

400application/json

401application/json

On this page

`application/json`

`application/json`

`application/json`