> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wfa.team/llms.txt
> Use this file to discover all available pages before exploring further.

# Remove user access

> Archive a staff account by setting its existing role to Remove Access.

`POST /remove_user_access`

<Info>
  This endpoint is available in the test environment. It has not been deployed live.
</Info>

Sets the user's account role to **Remove Access**. The profile, user identifier, company association, Staff ID and historical assessment records are retained. This request sends no invitation or notification emails and does not delete the user.

## Authorization

<ParamField header="Authorization" type="string" required>
  Company Bearer token. Keep it on your server. The token determines which company's users can be changed.
</ParamField>

## Body parameters

<ParamField body="staff_id" type="string" required>
  The external Staff ID used when [inviting the user](/api-reference/invite-staff). It must match exactly one user within the authenticated company. This is separate from the returned Bubble user\_id.
</ParamField>

No reason, email, company identifier or event identifier is required.

## Response and retries

<ResponseField name="status" type="string">
  `success` after the role has been set.
</ResponseField>

<ResponseField name="success" type="boolean">
  `true` on success; `false` on an application error.
</ResponseField>

<ResponseField name="role" type="string">
  `Remove Access` on success.
</ResponseField>

Repeated calls for an already archived user return the same success response. They do not recreate the account or send emails. Retry the same request after a transport failure if removal is still intended. A later request will remove access again if an administrator has restored the user in the meantime; this endpoint does not deduplicate requests by event ID.

To restore access, call [Add or restore staff](/api-reference/invite-staff) with the existing account email and the same company token, or restore it through the administration screen. This endpoint only changes the account role; it does not revoke the company's API token, remove the user's historical approvals, or delete employee assessment data. Clients must enforce the removed role when authorizing protected actions; changing the role is not a promise that every previously issued session has been invalidated.

## Error responses

Check the JSON body even when the HTTP status is 200.

| Message | Meaning | Action |
| - | - | - |
| `Invalid authorization token` | Missing or unmatched company authorization. | Check the company token, environment and Bearer header. |
| `staff_id must match exactly one user in this company` | Missing Staff ID, no matching user in this company, or multiple matching users. | Use the invitation's Staff ID and resolve duplicate IDs before retrying. No user's role is changed. |

<RequestExample>
  ```bash cURL theme={null}
  curl --request POST \
    'https://wfa-team-tool-v1.bubbleapps.io/version-test/api/1.1/wf/remove_user_access' \
    --header "Authorization: Bearer $WFA_COMPANY_TOKEN" \
    --header 'Content-Type: application/json' \
    --data '{"staff_id":"STAFF-001"}'
  ```

  ```javascript JavaScript theme={null}
  // Run on your server. Keep WFA_COMPANY_TOKEN in its environment.
  const response = await fetch('https://wfa-team-tool-v1.bubbleapps.io/version-test/api/1.1/wf/remove_user_access', {
    method: 'POST',
    headers: {
      Authorization: `Bearer ${process.env.WFA_COMPANY_TOKEN}`,
      'Content-Type': 'application/json'
    },
    body: JSON.stringify({ staff_id: 'STAFF-001' })
  });
  const result = await response.json();
  if (!response.ok || result.status !== 'success' || result.success !== true) {
    throw new Error(result.message || 'User access removal failed');
  }
  ```

  ```python Python theme={null}
  # Run on your server. Keep WFA_COMPANY_TOKEN in its environment.
  import os
  import requests

  response = requests.post(
      'https://wfa-team-tool-v1.bubbleapps.io/version-test/api/1.1/wf/remove_user_access',
      headers={'Authorization': f"Bearer {os.environ['WFA_COMPANY_TOKEN']}"},
      json={'staff_id': 'STAFF-001'},
      timeout=45,
  )
  result = response.json()
  if not response.ok or result.get('status') != 'success' or result.get('success') is not True:
      raise RuntimeError(result.get('message', 'User access removal failed'))
  ```
</RequestExample>

<ResponseExample>
  ```json Success or already archived theme={null}
  {"status":"success","success":true,"role":"Remove Access"}
  ```

  ```json Invalid token theme={null}
  {"status":"error","success":false,"message":"Invalid authorization token"}
  ```

  ```json Invalid Staff ID theme={null}
  {"status":"error","success":false,"message":"staff_id must match exactly one user in this company"}
  ```
</ResponseExample>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.