403 on delete user

Question

I am trying to write a user management script which uses the JIRA user's own permissions to determine whether or not they can delete a user. I have been trying to make delete requests to /user?username=USERNAME trying both Basic Auth and logging in<code> via /rest/auth/1/session. What is the proper process for deleting a user from JIRA? The Documentation says that this method is experimental, so any help is appreciated.

Best,

Tom Judd

crf · Answer

Although 403 doesn't really make sense as a response, it doesn't look to me like the /user resource supports the DELETE method at all; it doesn't look like it can do anything except change a user's avatar.

To do a DELETE you would need /rest/api/2/user?username=fred

(you can specify the user's key with key= instead if that's what you have)

Thomas Judd · Answer

I can delete the user from the UI without a problem. The response body doesn't say much useful aside from 403 forbidden. I checked my permissions via REST call to /rest/api/2/mypermissions and it looks like the user I authenticate as does not have the same permissions as the one I use via the Admin portal, despite using the same credentials for both.

Petar Petrov _Appfire_ · Answer

The fact that 403 is returned means that the problem is not related to authentication. If you were not properly authenticated, the server would return 401. 403 means either that you don't have permissions to delete the user or the user does not exist. I would look at the response body for more clues. Also, are you able to delete this user from the administrative UI after logging with the same credentials you use for the REST call?