Getting 403 error when calling delete user api

[Apurv Rathore]

When calling the api :"https://api.atlassian.com/users/{user_id}/manage/lifecycle/disable", I am getting error 403

b'{"key":"forbidden.action","context":{"allowed":false,"reason":{"key":"externalDirectory.scim"}},"errorKey":"forbidden.action","errorDetail":{"allowed":false,"reason":{"key":"externalDirectory.scim"}}}'

Can you please help

[Marc - Devoteam]

Hi @Apurv Rathore 

Are you using the Account ID of the user, this is quite a long number.

Also this is a Cloud only API option.

Do you provide an API key as bearer token for authentication, this is required.

[Apurv Rathore]

Hey @Marc - Devoteam . Yes I am using account ID of the user, and yes it's a long string.

Yes I am also using API key as bearer token. Other api's such as create account are working, it's just that this particular api is not working.

Could you please help here.

[Apurv Rathore]

I do not understand what this error means

b'{"key":"forbidden.action","context":{"allowed":false,"reason":{"key":"externalDirectory.scim"}},"errorKey":"forbidden.action","errorDetail":{"allowed":false,"reason":{"key":"externalDirectory.scim"}}}'

What does this error with key externalDirectory.scim mean, and how do we resolve this issue.

[Marc - Devoteam]

Hi @Apurv Rathore 

Is you Cloud SSO and a user directory connected?

If so this probably means the user is managed and will only be disabled or deleted if done so in the user directory.

In this case you are no able to delete the user as it's a managed user.

[Apurv Rathore]

@Marc - Devoteam 

Thanks. Disconnecting Google as Identity Provider, re linking out the domains, and then claiming accounts under verified domains worked.

I had one further doubt. If I pay for Atlassian Gaurd, will using Google for SSO and using some other IDP for provisioning and deprovisioning will be blocked by SCIM setup?

Is this true?

[Marc - Devoteam]

Hi @Apurv Rathore 

I think this could be possible, if the IDP provides provisioning and de-provisioning