nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

[Jira REST API] Deleted Users Still Accessible via API – Why?

Vasilis Kokotakis

Hey all,

I'm working with the Jira REST API for my application and have a question.

I'm an admin in Jira and have successfully established a connection between Postman and my Jira account (I created an app via Atlassian Developer, and everything is working as expected).

However, when I delete a Jira user—either through Postman or the web UI—I can still access their data via the API.

Why is this happening? If I delete a user, I would expect their data to be inaccessible.

Has anyone else encountered this issue? Is there any documentation that explains this behavior?

Thanks in advance!

Accepted answers

Tuncay Senturk _Snapbytes_

Hi @Vasilis Kokotakis

Take it with a pinch of salt but I presume, when a user is deleted in Jira, their account is deactivated but not removed entirely. In order to retain historical data related to the user (they created, commented, transitioned, etc) this is a must for the auditing and issue history purposes.

All comments

Tuncay Senturk _Snapbytes_

Hi @Vasilis Kokotakis

Vasilis Kokotakis

Hey, thanks for your reply.

This seems really strange to me. I understand that Jira needs to retain some data for reference, but deleted users should be completely inaccessible to admins—both from the web UI (which already seems to be the case) and from the backend API.

Right now, I can still fetch and even update (!) data of deleted users from my organization via the API, which doesn’t seem right.

Is this behavior documented anywhere? I’d really like to spend some time reading about it.

Vasilis

Vasilis Kokotakis

+ Is there any way / are we able to detect with API if user was "deleted"?

Tuncay Senturk _Snapbytes_

Yes, you can detect if a user was deleted (or deactivated) via the Jira REST API. However, I'm uncertain whether you can differentiate between the two; I mean, I don't know if there is a way to determine if the user is deactivated due to being deleted. You can call /rest/api/3/user?accountId=<USER_ACCOUNT_ID> REST API and check the active property from the returned JSON.

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

jira

cloud

jira-cloud