{"record":{"id":"4a2d38ade42a6e8d","repo":"medusajs/medusa","slug":"a-user-cannot-delete-itself","errorCode":null,"errorMessage":"A user cannot delete itself","messagePattern":"A user cannot delete itself","errorType":"exception","errorClass":"MedusaError","httpStatus":403,"severity":"error","filePath":"packages/medusa/src/api/admin/users/[id]/route.ts","lineNumber":82,"sourceCode":"  const user = await refetchUser(\n    req.params.id,\n    req.scope,\n    req.queryConfig.fields\n  )\n\n  res.status(200).json({ user })\n}\n\n// delete user\nexport const DELETE = async (\n  req: AuthenticatedMedusaRequest,\n  res: MedusaResponse<HttpTypes.AdminUserDeleteResponse>\n) => {\n  const { id } = req.params\n  const { actor_id } = req.auth_context\n\n  if (actor_id === id) {\n    throw new MedusaError(\n      MedusaError.Types.NOT_ALLOWED,\n      \"A user cannot delete itself\"\n    )\n  }\n\n  const workflow = removeUserAccountWorkflow(req.scope)\n\n  await workflow.run({\n    input: { userId: id },\n  })\n\n  res.status(200).json({\n    id,\n    object: \"user\",\n    deleted: true,\n  })\n}\n","sourceCodeStart":64,"sourceCodeEnd":100,"githubUrl":"https://github.com/medusajs/medusa/blob/5e06e544a296b9033f20f71f11c559f81a0e5739/packages/medusa/src/api/admin/users/[id]/route.ts#L64-L100","documentation":"Thrown by DELETE /admin/users/:id when the authenticated actor's id equals the id being deleted. Prevents a user from removing their own account.","triggerScenarios":"DELETE /admin/users/{id} where {id} equals req.auth_context.actor_id — i.e. an admin deleting themselves.","commonSituations":"Scripts that iterate all user ids and delete them while authenticated as one of those users; cleanup routines run with an admin token.","solutions":["Exclude the current user's id from deletion lists","Authenticate as a different admin user to perform the deletion","Filter out req.auth_context.actor_id before calling the endpoint"],"exampleFix":"// before\nawait medusa.admin.users.delete(myUserId) // same user as token\n// after\nif (myUserId !== currentActorId) {\n  await medusa.admin.users.delete(myUserId)\n}","handlingStrategy":"validation","validationCode":"if (targetUserId === me.auth_identity_id || targetUserId === me.id) throw new Error('skip self')","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never delete the account that issued the current token","Filter current actor id out of bulk deletions"],"tags":["admin","users","self-delete","not-allowed"],"backgroundTag":"operation-not-permitted","analyzedSha":"5e06e544a296b9033f20f71f11c559f81a0e5739","analyzedAt":"2026-08-27T07:24:39.599Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}