POST
/
api
/
v1
/
admin
/
users
/
:id
/
unban
Unban user
curl --request POST \
  --url https://api.example.com/api/v1/admin/users/:id/unban
import requests

url = "https://api.example.com/api/v1/admin/users/:id/unban"

response = requests.post(url)

print(response.text)
const options = {method: 'POST'};

fetch('https://api.example.com/api/v1/admin/users/:id/unban', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));
<?php

$curl = curl_init();

curl_setopt_array($curl, [
CURLOPT_URL => "https://api.example.com/api/v1/admin/users/:id/unban",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}
package main

import (
"fmt"
"net/http"
"io"
)

func main() {

url := "https://api.example.com/api/v1/admin/users/:id/unban"

req, _ := http.NewRequest("POST", url, nil)

res, _ := http.DefaultClient.Do(req)

defer res.Body.Close()
body, _ := io.ReadAll(res.Body)

fmt.Println(string(body))

}
HttpResponse<String> response = Unirest.post("https://api.example.com/api/v1/admin/users/:id/unban")
.asString();
require 'uri'
require 'net/http'

url = URI("https://api.example.com/api/v1/admin/users/:id/unban")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)

response = http.request(request)
puts response.read_body

Overview

Reverses a ban. Clears bannedAt and bannedReason and restores users.status = ACTIVE. The user can sign in again (they were forced out of all sessions at ban time; unban does not re-issue tokens — the user logs in normally). Idempotent: a no-op on a user who is already ACTIVE.

Authentication

Bearer <accessToken> with scope: 'admin' required (requireAdmin).
Role-gated: requires SUPER or MODERATOR. A FINANCE admin receives 403 FORBIDDEN.

Path parameters

NameTypeRequiredNotesExample
idstringyesUser ObjectId, 1..64 chars.66400a8f1c2b4d5e6f7a8b01

Query parameters

None.

Request body

None.

Response — 200 OK

Returns the updated user summary object with status: "ACTIVE" and bannedAt/bannedReason cleared to null.
{
  "id": "66400a8f1c2b4d5e6f7a8b01",
  "email": "jane@example.com",
  "firstName": "Jane",
  "lastName": "Doe",
  "status": "ACTIVE",
  "tenancyStatus": "APPROVED",
  "subscriptionStatus": "ACTIVE",
  "bannedAt": null,
  "bannedReason": null,
  "createdAt": "2026-04-12T09:00:00.000Z"
}

Error responses

StatusCodeMeaning
401UNAUTHENTICATEDMissing, malformed, expired, or non-admin-scope token.
403FORBIDDENCaller is a FINANCE admin (read-only on the user surface).
404NOT_FOUNDNo user with that id.

Example error — 404 NOT_FOUND

{
  "type": "https://api.swappr.co.uk/errors/not-found",
  "title": "Resource not found",
  "status": 404,
  "code": "NOT_FOUND",
  "detail": "User not found",
  "instance": "/api/v1/admin/users/66400a8f1c2b4d5e6f7a8b01/unban",
  "requestId": "01HZQ7K3M4N5P6Q7R8S9T0V1W2"
}

Side effects

  • users row updated (status = ACTIVE, bannedAt/bannedReason = null).
  • An audit-log row is written (admin id, target user id, action users.unban).

See also

  • Ban user — the action this reverses.

curl

curl -X POST https://api.swappr.co.uk/api/v1/admin/users/66400a8f1c2b4d5e6f7a8b01/unban \
  -H "Authorization: Bearer $ADMIN_ACCESS_TOKEN"

Postman

See docs/postman/swappr.postman_collection.jsonAdmin Users → Unban.