{"record":{"id":"2747b38d55f01463","repo":"n8n-io/n8n","slug":"cannot-delete-your-own-user","errorCode":null,"errorMessage":"Cannot delete your own user","messagePattern":"Cannot delete your own user","errorType":"exception","errorClass":"BadRequestError","httpStatus":400,"severity":"error","filePath":"packages/cli/src/controllers/users.controller.ts","lineNumber":232,"sourceCode":"\t\t});\n\n\t\treturn user.settings;\n\t}\n\n\t/**\n\t * Delete a user. Optionally, designate a transferee for their workflows and credentials.\n\t */\n\t@Delete('/:id')\n\t@GlobalScope('user:delete')\n\tasync deleteUser(req: UserRequest.Delete) {\n\t\tconst { id: idToDelete } = req.params;\n\n\t\tif (req.user.id === idToDelete) {\n\t\t\tthis.logger.debug(\n\t\t\t\t'Request to delete a user failed because it attempted to delete the requesting user',\n\t\t\t\t{ userId: req.user.id },\n\t\t\t);\n\t\t\tthrow new BadRequestError('Cannot delete your own user');\n\t\t}\n\n\t\tconst { transferId } = req.query;\n\n\t\tconst userToDelete = await this.userRepository.findOne({\n\t\t\twhere: { id: idToDelete },\n\t\t\trelations: ['role'],\n\t\t});\n\n\t\tif (!userToDelete) {\n\t\t\tthrow new NotFoundError(\n\t\t\t\t'Request to delete a user failed because the user to delete was not found in DB',\n\t\t\t);\n\t\t}\n\n\t\tif (userToDelete.role.slug === GLOBAL_OWNER_ROLE.slug) {\n\t\t\tthrow new ForbiddenError('Instance owner cannot be deleted.');\n\t\t}","sourceCodeStart":214,"sourceCodeEnd":250,"githubUrl":"https://github.com/n8n-io/n8n/blob/5ac6606e81f67bb9534255570cd4e86fd8101eee/packages/cli/src/controllers/users.controller.ts#L214-L250","documentation":"Thrown by DELETE /users/:id (scope user:delete) when req.user.id === idToDelete — i.e. the authenticated user is attempting to delete their own account through the admin deletion endpoint. This is a self-protection guard; HTTP 400. The endpoint is meant for deleting other users; self-deletion has a separate flow.","triggerScenarios":"An admin opens the user management page and clicks delete on their own row, or a script iterates a user-id list that includes the caller's own id.","commonSituations":"Bulk-cleanup automation that did not exclude the caller; UI bug surfacing the delete action on the current user's own row; testing the endpoint with the caller's own id.","solutions":["Exclude req.user.id from any batch deletion list before issuing DELETE calls.","Use the dedicated self-account-removal flow if self-deletion is genuinely intended.","In the UI, hide or disable the delete control on the current user's row."],"exampleFix":"// before\nfor (const id of allUserIds) await del(`/users/${id}`);\n// after\nfor (const id of allUserIds) {\n  if (id === currentUser.id) continue;\n  await del(`/users/${id}`);\n}","handlingStrategy":"validation","validationCode":"function excludeSelfFromBatch(ids: string[], currentUserId: string) {\n  return ids.filter((id) => id !== currentUserId);\n}\nconst targets = excludeSelfFromBatch(allUserIds, currentUser.id);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never call DELETE /users/:id with the caller's own id.","Hide/disable the delete control on the current user's row in the UI.","Use the self-account-removal flow for self-deletion."],"tags":["users","delete","self-protection","rest-api","bad-request"],"backgroundTag":null,"analyzedSha":"5ac6606e81f67bb9534255570cd4e86fd8101eee","analyzedAt":"2026-08-12T05:26:35.080Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}