Remove user access

curl --request POST \
  'https://wfa-team-tool-v1.bubbleapps.io/version-test/api/1.1/wf/remove_user_access' \
  --header "Authorization: Bearer $WFA_COMPANY_TOKEN" \
  --header 'Content-Type: application/json' \
  --data '{"staff_id":"STAFF-001"}'

// Run on your server. Keep WFA_COMPANY_TOKEN in its environment.
const response = await fetch('https://wfa-team-tool-v1.bubbleapps.io/version-test/api/1.1/wf/remove_user_access', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.WFA_COMPANY_TOKEN}`,
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({ staff_id: 'STAFF-001' })
});
const result = await response.json();
if (!response.ok || result.status !== 'success' || result.success !== true) {
  throw new Error(result.message || 'User access removal failed');
}

# Run on your server. Keep WFA_COMPANY_TOKEN in its environment.
import os
import requests

response = requests.post(
    'https://wfa-team-tool-v1.bubbleapps.io/version-test/api/1.1/wf/remove_user_access',
    headers={'Authorization': f"Bearer {os.environ['WFA_COMPANY_TOKEN']}"},
    json={'staff_id': 'STAFF-001'},
    timeout=45,
)
result = response.json()
if not response.ok or result.get('status') != 'success' or result.get('success') is not True:
    raise RuntimeError(result.get('message', 'User access removal failed'))

{"status":"success","success":true,"role":"Remove Access"}

{"status":"error","success":false,"message":"Invalid authorization token"}

{"status":"error","success":false,"message":"staff_id must match exactly one user in this company"}

POST

version-test

api

1.1

remove_user_access

curl --request POST \
  'https://wfa-team-tool-v1.bubbleapps.io/version-test/api/1.1/wf/remove_user_access' \
  --header "Authorization: Bearer $WFA_COMPANY_TOKEN" \
  --header 'Content-Type: application/json' \
  --data '{"staff_id":"STAFF-001"}'

// Run on your server. Keep WFA_COMPANY_TOKEN in its environment.
const response = await fetch('https://wfa-team-tool-v1.bubbleapps.io/version-test/api/1.1/wf/remove_user_access', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.WFA_COMPANY_TOKEN}`,
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({ staff_id: 'STAFF-001' })
});
const result = await response.json();
if (!response.ok || result.status !== 'success' || result.success !== true) {
  throw new Error(result.message || 'User access removal failed');
}

# Run on your server. Keep WFA_COMPANY_TOKEN in its environment.
import os
import requests

response = requests.post(
    'https://wfa-team-tool-v1.bubbleapps.io/version-test/api/1.1/wf/remove_user_access',
    headers={'Authorization': f"Bearer {os.environ['WFA_COMPANY_TOKEN']}"},
    json={'staff_id': 'STAFF-001'},
    timeout=45,
)
result = response.json()
if not response.ok or result.get('status') != 'success' or result.get('success') is not True:
    raise RuntimeError(result.get('message', 'User access removal failed'))

{"status":"success","success":true,"role":"Remove Access"}

{"status":"error","success":false,"message":"Invalid authorization token"}

{"status":"error","success":false,"message":"staff_id must match exactly one user in this company"}

POST /remove_user_access

This endpoint is available in the test environment. It has not been deployed live.

Sets the user’s account role to Remove Access. The profile, user identifier, company association, Staff ID and historical assessment records are retained. This request sends no invitation or notification emails and does not delete the user.

Authorization

string

required

Company Bearer token. Keep it on your server. The token determines which company’s users can be changed.

Body parameters

string

required

The external Staff ID used when inviting the user. It must match exactly one user within the authenticated company. This is separate from the returned Bubble user_id.

No reason, email, company identifier or event identifier is required.

Response and retries

string

success after the role has been set.

boolean

true on success; false on an application error.

string

Remove Access on success.

Repeated calls for an already archived user return the same success response. They do not recreate the account or send emails. Retry the same request after a transport failure if removal is still intended. A later request will remove access again if an administrator has restored the user in the meantime; this endpoint does not deduplicate requests by event ID. To restore access, call Add or restore staff with the existing account email and the same company token, or restore it through the administration screen. This endpoint only changes the account role; it does not revoke the company’s API token, remove the user’s historical approvals, or delete employee assessment data. Clients must enforce the removed role when authorizing protected actions; changing the role is not a promise that every previously issued session has been invalidated.

Error responses

Check the JSON body even when the HTTP status is 200.

Message	Meaning	Action
`Invalid authorization token`	Missing or unmatched company authorization.	Check the company token, environment and Bearer header.
`staff_id must match exactly one user in this company`	Missing Staff ID, no matching user in this company, or multiple matching users.	Use the invitation’s Staff ID and resolve duplicate IDs before retrying. No user’s role is changed.

curl --request POST \
  'https://wfa-team-tool-v1.bubbleapps.io/version-test/api/1.1/wf/remove_user_access' \
  --header "Authorization: Bearer $WFA_COMPANY_TOKEN" \
  --header 'Content-Type: application/json' \
  --data '{"staff_id":"STAFF-001"}'

// Run on your server. Keep WFA_COMPANY_TOKEN in its environment.
const response = await fetch('https://wfa-team-tool-v1.bubbleapps.io/version-test/api/1.1/wf/remove_user_access', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.WFA_COMPANY_TOKEN}`,
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({ staff_id: 'STAFF-001' })
});
const result = await response.json();
if (!response.ok || result.status !== 'success' || result.success !== true) {
  throw new Error(result.message || 'User access removal failed');
}

# Run on your server. Keep WFA_COMPANY_TOKEN in its environment.
import os
import requests

response = requests.post(
    'https://wfa-team-tool-v1.bubbleapps.io/version-test/api/1.1/wf/remove_user_access',
    headers={'Authorization': f"Bearer {os.environ['WFA_COMPANY_TOKEN']}"},
    json={'staff_id': 'STAFF-001'},
    timeout=45,
)
result = response.json()
if not response.ok or result.get('status') != 'success' or result.get('success') is not True:
    raise RuntimeError(result.get('message', 'User access removal failed'))

{"status":"success","success":true,"role":"Remove Access"}

{"status":"error","success":false,"message":"Invalid authorization token"}

{"status":"error","success":false,"message":"staff_id must match exactly one user in this company"}

Getting started

API reference

Reference

Help

Remove user access

Authorization

Body parameters

Response and retries

Error responses

​Authorization

​Body parameters

​Response and retries

​Error responses

Authorization

Body parameters

Response and retries

Error responses