> ## Documentation Index > Fetch the complete documentation index at: https://docs.qumo-deploy.com/llms.txt > Use this file to discover all available pages before exploring further. # Deactivate a managed account > Deactivates the account: in the same transaction its sessions and device codes are deleted and its personal tokens revoked, and from then on every login is refused and every credential it still presents is refused (401). It is a state, never a deleted row: no membership changes, and releasing the domain does not reactivate it. Your own account and a platform administrator's are refused with 422; an account the organization does not manage is a 404. Deactivating a deactivated account returns it unchanged. ## OpenAPI ````yaml /api-reference/openapi.yaml post /v1/organizations/{id}/managed-accounts/{userID}/deactivate openapi: 3.1.0 info: title: Qumo Deploy REST API description: > The Qumo Deploy control plane: organizations, projects, signing keys, machine identities, access control, audit and billing. Relay credentials are not issued here: your app signs them with its own [signing keys](/guides/signing-keys). Every operation here is generated against the routes the server registers and checked in CI, so an operation in this reference exists and a route missing from it is deliberately internal (relay mesh, webhooks, probes, operator-only and browser sign-in routes). Errors are JSON objects with one `error` field. What each status code means is in [Error codes](/guides/error-codes); the token scope each permission needs is in [Scopes and permissions](/guides/scopes-permissions). version: 1.0.0 servers: - url: https://api.qumo-deploy.com description: Public API (Bearer tokens only; cookies are ignored) security: [] tags: - name: Account description: The signed-in user's own sessions, tokens, security settings and data. - name: Device flow description: OAuth 2.0 device authorization, used by `qumod login`. - name: Organizations description: Organizations, their members and usage. - name: Projects description: Projects inside an organization. - name: Signing keys description: Keys your app signs relay credentials with. - name: Relays description: Where clients of a broadcast path connect. - name: Identities description: Machine identities, their tokens and IP allowlists. - name: Access control description: Roles, IAM bindings and invitations. - name: Audit description: The audit log and its webhook. - name: Notifications description: Notification policies. - name: Billing description: Plans, usage cost, budgets, invoices and payment methods. - name: Pricing description: Public price list. paths: /v1/organizations/{id}/managed-accounts/{userID}/deactivate: parameters: - name: id in: path required: true description: The organization's id. schema: type: string format: uuid example: 3f8c2a1e-7b4d-4e9a-9c61-2d5e8f0a1b7c - name: userID in: path required: true description: The managed account's user id. schema: type: string format: uuid example: 9a7c5e3b-1d2f-4a6c-8e0b-3f5d7c9a1b2e post: tags: - Organizations summary: Deactivate a managed account description: | Deactivates the account: in the same transaction its sessions and device codes are deleted and its personal tokens revoked, and from then on every login is refused and every credential it still presents is refused (401). It is a state, never a deleted row: no membership changes, and releasing the domain does not reactivate it. Your own account and a platform administrator's are refused with 422; an account the organization does not manage is a 404. Deactivating a deactivated account returns it unchanged. operationId: deactivateManagedAccount responses: '200': description: The account, deactivated. content: application/json: schema: $ref: '#/components/schemas/ManagedAccount' '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '422': $ref: '#/components/responses/UnprocessableEntity' security: - token: [] - cliSession: [] - sessionCookie: [] csrfToken: [] components: schemas: ManagedAccount: type: object description: >- An account the organization manages, because its email is at one of the organization's claimed domains (exact domain only). required: - user_id - email - name - domain - state - deactivated_at properties: user_id: type: string format: uuid example: 9a7c5e3b-1d2f-4a6c-8e0b-3f5d7c9a1b2e email: type: string example: alice@acme.com name: type: string example: Alice domain: type: string description: The organization's claimed domain the email is at. example: acme.com state: type: string enum: - active - deactivated example: active deactivated_at: type: string format: date-time nullable: true Error: type: object required: - error properties: error: type: string description: A human-readable message. example: organization_id is required responses: BadRequest: description: >- Malformed request or failed validation. See [Error codes](/guides/error-codes). content: application/json: schema: $ref: '#/components/schemas/Error' Unauthorized: description: Missing or invalid credentials. See [Error codes](/guides/error-codes). content: application/json: schema: $ref: '#/components/schemas/Error' Forbidden: description: >- Authenticated but not allowed (permission, token scope, IP allowlist or CSRF). See [Error codes](/guides/error-codes). content: application/json: schema: $ref: '#/components/schemas/Error' NotFound: description: >- Not found, or not visible to the caller. See [Error codes](/guides/error-codes). content: application/json: schema: $ref: '#/components/schemas/Error' UnprocessableEntity: description: >- Well-formed but semantically invalid. See [Error codes](/guides/error-codes). content: application/json: schema: $ref: '#/components/schemas/Error' securitySchemes: token: type: http scheme: bearer bearerFormat: qumo_pat_ description: > A personal access token (`POST /v1/auth/tokens`) or a machine identity token (`POST /v1/projects/{project_id}/identities/{identity_id}/tokens`), both prefixed `qumo_pat_`. A token's scopes cap what it can do; see [Scopes and permissions](/guides/scopes-permissions). A personal token names no organization: on a route whose path names no project or organization, pass `?organization_id=`. cliSession: type: http scheme: bearer description: | The session token `qumod login` obtains through the device flow (`POST /v1/auth/device/token`). It acts as the signed-in user, like a console session, and needs no CSRF token. sessionCookie: type: apiKey in: cookie name: __Host-qumo_session description: | The console's browser session. Accepted only on the console origin (`https://console.qumo-deploy.com`), never on `api.qumo-deploy.com`. A request that changes state must also send `X-CSRF-Token`. csrfToken: type: apiKey in: header name: X-CSRF-Token description: | CSRF token paired with `sessionCookie` on POST, PUT, PATCH and DELETE. Bearer requests do not send it. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.