Locking User Accounts

A user account can be locked by creating a lock. An account can have multiple active locks at once, and every one of them must be unlocked before the account itself is considered unlocked.

A locked account can't sign in. Access tokens issued to a locked user are considered invalid, but relying parties must introspect the token regularly to detect this, since the token itself isn't immediately revoked just because the account was locked.

Why accounts become locked

An account can become locked for several reasons:

1. An administrator locks it manually.
2. Too many failed password entries — depends on namespace configuration.
3. The account has been inactive for too long — depends on namespace configuration.

An administrator or API client can lock another user's account if both of the following are true:

• The target user must be visible to them — they must have access to the target user's namespace.
• They must have the ACCOUNT_LOCK permission.

Locking and unlocking in the Management UI

The account editor's Core tab shows the account's current lock status at the top — Account is locked (Sign-in is not possible) or Account is not locked (Sign-in is possible) — with an Unlock button shown directly there when the account is locked.

Locks can also be managed in bulk from the Accounts view:

• Select one or more target users.
• Select Actions → Lock selected account or Actions → Unlock selected account.

Lock management via the REST API

• Create a lock — POST /api/rest/v1/user/{userId}/locks, with a JSON body of lockedBy and lockReason. The revokeAccessTokens query parameter (default false) additionally revokes the user's existing access tokens immediately, instead of waiting for relying parties to next introspect them. logEventText optionally customises the text logged in the Event Log.
• List locks — GET /api/rest/v1/user/{userId}/locks — retrieves all locks on the account, including ones that are no longer active.
• Get a specific lock — GET /api/rest/v1/user/{userId}/locks/{lockId} — returns the lock's lockedTime / lockedBy / lockedDetails, unlockedTime / unlockedBy / unlockedDetails (if unlocked), and whether it's still active.
• Unlock a specific lock — DELETE /api/rest/v1/user/{userId}/locks/{lockId}, optionally with a JSON body of unlockedBy and unlockReason. The account is considered unlocked only once every one of its locks has been unlocked this way.