n8n-io/n8n · error · BadRequestError

Cannot delete your own user

Error message

Cannot delete your own user

What it means

Thrown by DELETE /users/:id (scope user:delete) when req.user.id === idToDelete — i.e. the authenticated user is attempting to delete their own account through the admin deletion endpoint. This is a self-protection guard; HTTP 400. The endpoint is meant for deleting other users; self-deletion has a separate flow.

Source

Thrown at packages/cli/src/controllers/users.controller.ts:232

		});

		return user.settings;
	}

	/**
	 * Delete a user. Optionally, designate a transferee for their workflows and credentials.
	 */
	@Delete('/:id')
	@GlobalScope('user:delete')
	async deleteUser(req: UserRequest.Delete) {
		const { id: idToDelete } = req.params;

		if (req.user.id === idToDelete) {
			this.logger.debug(
				'Request to delete a user failed because it attempted to delete the requesting user',
				{ userId: req.user.id },
			);
			throw new BadRequestError('Cannot delete your own user');
		}

		const { transferId } = req.query;

		const userToDelete = await this.userRepository.findOne({
			where: { id: idToDelete },
			relations: ['role'],
		});

		if (!userToDelete) {
			throw new NotFoundError(
				'Request to delete a user failed because the user to delete was not found in DB',
			);
		}

		if (userToDelete.role.slug === GLOBAL_OWNER_ROLE.slug) {
			throw new ForbiddenError('Instance owner cannot be deleted.');
		}

View on GitHub (pinned to 5ac6606e81)

Solutions

1. Exclude req.user.id from any batch deletion list before issuing DELETE calls.
2. Use the dedicated self-account-removal flow if self-deletion is genuinely intended.
3. In the UI, hide or disable the delete control on the current user's row.

Example fix

// before
for (const id of allUserIds) await del(`/users/${id}`);
// after
for (const id of allUserIds) {
  if (id === currentUser.id) continue;
  await del(`/users/${id}`);
}

function excludeSelfFromBatch(ids: string[], currentUserId: string) {
  return ids.filter((id) => id !== currentUserId);
}
const targets = excludeSelfFromBatch(allUserIds, currentUser.id);

When it happens

Trigger: An admin opens the user management page and clicks delete on their own row, or a script iterates a user-id list that includes the caller's own id.

Common situations: Bulk-cleanup automation that did not exclude the caller; UI bug surfacing the delete action on the current user's own row; testing the endpoint with the caller's own id.

Related errors

• Request to delete a user failed because the user to delete a
• Request to delete a user failed because the user to delete w
• Request to delete a user failed because the transferee proje
• Invalid invite URL
• Invalid request

AI-assisted analysis of n8n-io/n8n@5ac6606e81 (2026-08-12). Data as JSON: /api/errors/2747b38d55f01463. Report an issue: GitHub.