{"record":{"id":"e23d933a6d7e705c","repo":"netbirdio/netbird","slug":"only-integration-service-user-can-delete-this-user","errorCode":null,"errorMessage":"only integration service user can delete this user","messagePattern":"only integration service user can delete this user","errorType":"validation","errorClass":null,"httpStatus":400,"severity":"error","filePath":"management/server/user.go","lineNumber":1288,"sourceCode":"\t\tif initiatorUserID == targetUserID {\n\t\t\tallErrors = errors.Join(allErrors, errors.New(\"self deletion is not allowed\"))\n\t\t\tcontinue\n\t\t}\n\n\t\ttargetUser, err := am.Store.GetUserByUserID(ctx, store.LockingStrengthNone, targetUserID)\n\t\tif err != nil {\n\t\t\tallErrors = errors.Join(allErrors, err)\n\t\t\tcontinue\n\t\t}\n\n\t\tif targetUser.Role == types.UserRoleOwner {\n\t\t\tallErrors = errors.Join(allErrors, fmt.Errorf(\"unable to delete a user: %s with owner role\", targetUserID))\n\t\t\tcontinue\n\t\t}\n\n\t\t// disable deleting integration user if the initiator is not admin service user\n\t\tif targetUser.Issued == types.UserIssuedIntegration && !initiatorUser.IsServiceUser {\n\t\t\tallErrors = errors.Join(allErrors, errors.New(\"only integration service user can delete this user\"))\n\t\t\tcontinue\n\t\t}\n\n\t\tuserInfo, ok := userInfos[targetUserID]\n\t\tif !ok || userInfo == nil {\n\t\t\tallErrors = errors.Join(allErrors, fmt.Errorf(\"user info not found for user: %s\", targetUserID))\n\t\t\tcontinue\n\t\t}\n\n\t\t_, err = am.deleteRegularUser(ctx, accountID, initiatorUserID, userInfo)\n\t\tif err != nil {\n\t\t\tallErrors = errors.Join(allErrors, err)\n\t\t\tcontinue\n\t\t}\n\t}\n\n\treturn allErrors\n}","sourceCodeStart":1270,"sourceCodeEnd":1306,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/management/server/user.go#L1270-L1306","documentation":"Returned in AccountManager.DeleteUsers (management/server/user.go:1288): users created by an integration (targetUser.Issued == types.UserIssuedIntegration) may only be deleted by a service-user initiator (initiatorUser.IsServiceUser). Regular human admins and owners get this error so integration-owned lifecycle stays under integration control.","triggerScenarios":"A human admin (non-service user) calls delete-users with the ID of a user that was provisioned by an integration; the check fires per-target and is joined into the aggregate error.","commonSituations":"SCIM/IdP-provisioned users appearing in the account; admin trying to clean up leftover service accounts from an old integration; bulk delete over the full user list that includes integration-managed entries.","solutions":["Use a service user (API token issued to a service user) as the initiator to delete integration-issued users","Or disconnect/remove the integration so the user is no longer UserIssuedIntegration before deleting","Exclude integration-issued users from bulk delete lists when running as a human admin"],"exampleFix":"// before: human admin tries to delete an integration-issued user\nam.DeleteUsers(ctx, accountID, humanAdminID, []string{integrationUserID})\n\n// after: perform the call with a service-user initiator\nam.DeleteUsers(ctx, accountID, serviceUserID, []string{integrationUserID})","handlingStrategy":"validation","validationCode":"// Skip integration-issued users unless running as a service user\nfunc deletableByHuman(u *types.User) bool {\n    return u.Issued != types.UserIssuedIntegration\n}\n\nif initiatorUser.IsServiceUser || deletableByHuman(targetUser) {\n    // safe to include in the delete batch\n}","typeGuard":null,"tryCatchPattern":"err := am.DeleteUsers(ctx, accountID, initiatorID, targets)\nif err != nil && strings.Contains(err.Error(), \"only integration service user can delete this user\") {\n    // re-run the batch with a service-user initiator or exclude these targets\n}","preventionTips":["Provision deletions of integration users through the integration's own service-user token","Check the Issued field when enumerating deletable users in admin tooling","Keep one dedicated service user with the Users module permission for lifecycle automation"],"tags":["management","users","api","permissions","integration"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}