> For the complete documentation index, see [llms.txt](https://docs.oceanenterprise.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.oceanenterprise.io/operational-guidelines/user-directory-management/user-removal.md).

# User Removal

### Overview

User removal is an irreversible operation which deletes the user record together with its attributes, sessions, tokens, consents and source connections from Authentik database - PostgreSQL.

For detail-oriented flow illustration, please consult [Sequence Flow](#sequence-flow).

### Procedure

1. Authenticate in Authentik Dashboard as `akadmin` , Administrator account which was created at [initial setup](/infrastructure/user-management-package/deployment-steps/post-installation-steps.md#set-the-authentik-server-administrator-account).
2. Navigate to **Directory → Users** and search for the user to be deleted.
3. Select the checkbox of the user, and select **Delete**.

<figure><img src="https://1789397093-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FH0zpgrXbeZ7u6UuCV9Gz%2Fuploads%2Fvcv5K5iI8QlTOhQyKghY%2FScreenshot%202026-09-08%20at%2020.04.42.png?alt=media&amp;token=5326aedd-cf6c-40bc-8234-ddd4408b8810" alt=""><figcaption></figcaption></figure>

### Verification

1. The user is no longer listed under **Directory → Users** after refresh.
2. Authentication with the user's credentials is rejected.

### Notes

* **Removing a federated shadow user is not permanent.** The Participant OAuth Source is created with `user_matching_mode: identifier` and the JIT enrollment flow `oe-central-federated-jit-enrollment`, whose user write stage creates users when required. The next successful upstream authentication therefore creates a new shadow user with newly mapped attributes, and any authorization groups previously assigned to the shadow user are lost.

  To remove a Participant user's access permanently, remove or deactivate the user on the **Participant** Authentik instance first, then remove the Operator shadow user.
* **Pending invitations.** A user who has not yet completed enrollment has no user record. Revoke the access by deleting the invitation under **Directory → Invitations** instead.

### Appendix

#### Sequence Flow

```mermaid
sequenceDiagram
    autonumber
    actor OA as Administrator
    participant UI as Authentik<br>Service
    participant PG as Authentik<br>Database
    participant PA as Data Space<br>Participant Authentik
    participant BAO as OpenBao

    opt The user is a federated Participant user
        Note over OA,PA: The Participant user must be removed first, otherwise the shadow user is recreated at the next federated login
        OA->>PA: Remove or deactivate the Participant user
    end

    OA->>UI: Open Directory → Users and search for the user
    OA->>UI: Select the user and select Delete
    UI->>PG: Deletes the objects depending on the user<br>and user record in cascade
    PG-->>UI:
    OA-->>UI: Sees user no longer listed
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.oceanenterprise.io/operational-guidelines/user-directory-management/user-removal.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.