medusajs/medusa · error · MedusaError

A user cannot delete itself

Error message

A user cannot delete itself

What it means

Thrown by DELETE /admin/users/:id when the authenticated actor's id equals the id being deleted. Prevents a user from removing their own account.

Source

Thrown at packages/medusa/src/api/admin/users/[id]/route.ts:82

  const user = await refetchUser(
    req.params.id,
    req.scope,
    req.queryConfig.fields
  )

  res.status(200).json({ user })
}

// delete user
export const DELETE = async (
  req: AuthenticatedMedusaRequest,
  res: MedusaResponse<HttpTypes.AdminUserDeleteResponse>
) => {
  const { id } = req.params
  const { actor_id } = req.auth_context

  if (actor_id === id) {
    throw new MedusaError(
      MedusaError.Types.NOT_ALLOWED,
      "A user cannot delete itself"
    )
  }

  const workflow = removeUserAccountWorkflow(req.scope)

  await workflow.run({
    input: { userId: id },
  })

  res.status(200).json({
    id,
    object: "user",
    deleted: true,
  })
}

View on GitHub (pinned to 5e06e544a2)

Solutions

1. Exclude the current user's id from deletion lists
2. Authenticate as a different admin user to perform the deletion
3. Filter out req.auth_context.actor_id before calling the endpoint

Example fix

// before
await medusa.admin.users.delete(myUserId) // same user as token
// after
if (myUserId !== currentActorId) {
  await medusa.admin.users.delete(myUserId)
}

if (targetUserId === me.auth_identity_id || targetUserId === me.id) throw new Error('skip self')

When it happens

Trigger: DELETE /admin/users/{id} where {id} equals req.auth_context.actor_id — i.e. an admin deleting themselves.

Common situations: Scripts that iterate all user ids and delete them while authenticated as one of those users; cleanup routines run with an admin token.

Related errors

• User with id "${userId}" not found
• User with id: ${id} was not found
• Forbidden
• Invite with id: ${id} was not found
• The user is already authenticated and cannot accept an invit

AI-assisted analysis of medusajs/medusa@5e06e544a2 (2026-08-27). Data as JSON: /api/errors/4a2d38ade42a6e8d. Report an issue: GitHub.