Ban user (from report)
Reports
Ban user (from report)
Terminally ban the accused user. Revokes refresh tokens, sets bannedAt + status=BANNED, transitions report OPEN → BANNED.
POST
Ban user (from report)
Overview
Terminally bans the user named as the accused on this report. Internally this delegates to the same code path asPOST /admin/users/:id/ban — there is exactly one ban implementation:
- Sets
users.bannedAt = now,users.bannedReason = banReason,users.status = BANNED. - Revokes all active refresh tokens for the user (the user is logged out of every device on next API call).
- Transitions the report from
OPEN→BANNEDwithresolvedBy,resolvedAt,resolutionReason = banReason.
BANNED report returns the row unchanged. Re-banning a user who is already banned is a no-op (no double-stamp).
See Ban user for the user-side ban semantics and admin auth and MFA for how revoked refresh tokens propagate.
Authentication
Bearer <accessToken> with scope: 'admin' required.
Path parameters
| Field | Type | Required | Notes | Example |
|---|---|---|---|---|
id | string | yes | The report id from the list endpoint. 1..64 chars. | 665a3f1e9c2b0a0001a4d201 |
Query parameters
None.Request body
| Field | Type | Required | Notes | Example |
|---|---|---|---|---|
banReason | string | yes | 1..500 chars. Stored on both users.bannedReason AND reports.resolutionReason. Surfaced to the user as ACCOUNT_BANNED detail on their next API call. | Repeated harassment after prior warning. |
Example payload
Response — 200 OK
Returns the full updated report row.
| Field | Type | Notes |
|---|---|---|
id | string | Report id. |
status | string | Always "BANNED". |
resolvedBy | string | The admin id (from the bearer token). |
resolvedAt | string (ISO 8601) | Server clock at the moment of resolution. |
resolutionReason | string | Echo of banReason. |
Error responses
| Status | Code | Meaning |
|---|---|---|
| 400 | VALIDATION_FAILED | banReason missing, empty, or longer than 500 chars. |
| 401 | UNAUTHENTICATED | Missing / malformed / expired admin token, or non-admin scope. |
| 403 | FORBIDDEN | Caller is a FINANCE admin. SUPER or MODERATOR required. |
| 404 | NOT_FOUND | No report exists with that id, or the accused user no longer exists. |
| 409 | STATE_CONFLICT | Report is in DISMISSED or WARNED — terminal states never transition. |
Example error — 403 FORBIDDEN
Side effects
| Effect | Notes |
|---|---|
| User row | bannedAt, bannedReason, status = BANNED set. |
| Refresh tokens | All active refresh tokens revoked. The user is logged out of every device on next API call. |
| Report row | status = BANNED, resolvedBy, resolvedAt, resolutionReason set. |
| Audit row | action: report.ban, targetType: report, targetId: <reportId>. The downstream ban path also writes its own user.ban audit row. |
Unlike warn, ban does not send a push or email to the banned user. They will discover the ban on their next API call (which returns
403 ACCOUNT_BANNED with the banReason in detail).See also
- Ban user (direct) — the underlying ban path.
- Unban user — reverse a ban (does NOT reopen the report).
- Dismiss report / Warn user — milder resolutions.
curl
Postman
Seedocs/postman/swappr.postman_collection.json → Admin Reports → Ban.