---
title: "Revoke system administrator privileges from a user"
method: POST
path: "/system/admin/revoke"
tags: ["System Admin"]
---

# Revoke system administrator privileges from a user

`POST /system/admin/revoke`

Remove system administrator privileges from a user (SystemAdmin only).
Two safety guards: the caller cannot revoke their own privileges,
and revoking the last remaining system admin is rejected — both
prevent a SystemAdmin from accidentally locking the platform out
of system-level administration. Idempotent on already-non-admin users.

## Request body

- InternalHandlerRevokeSystemAdminRequest
  - `user_id` string, required

## Response `200`

Privileges revoked successfully

- GithubComTencentWeKnoraInternalTypesUserInfo
  - `avatar` string
  - `can_access_all_tenants` boolean
  - `created_at` string
  - `email` string
  - `id` string
  - `is_active` boolean
  - `is_system_admin` boolean
  - `preferences` GithubComTencentWeKnoraInternalTypesUserPreferences
    - `last_active_tenant_id` integer — LastActiveTenantID remembers the last workspace the user actively switched into, so a fresh login (new device, cleared browser, new refresh token) lands them back in that workspace instead of always bouncing to their home workspace. Login / RefreshToken validate that the workspace still exists and the user still has an active membership (or CanAccessAllTenants) before honouring this preference; an invalid pointer is best-effort cleared and the user falls back to home. nil = no preference (use user.TenantID, i.e. home) *0 = "clear preference" sentinel for the partial-update endpoint (UpdateUserPreferences turns this into nil). Otherwise treat a stored *0 the same as nil. *N = preferred workspace id.
    - `oidc_only_login` boolean — OidcOnlyLogin is set server-side when an account is auto-provisioned via OIDC with a random password the user never received. The profile UI hides self-service password rotation until the user sets a known password via ChangePassword (which clears this flag).
  - `tenant_id` integer
  - `updated_at` string
  - `username` string

## Other responses

- `400` — Bad request / would remove last admin / self-revoke
- `403` — Forbidden: not a system admin
- `404` — User not found

---

[API](https://skmtc.net/tencentblueking/apis/weknora-api.md) · [All operations](https://skmtc.net/tencentblueking/apis/weknora-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/tencentblueking/weknora-api/revisions/6e297e21afca/schema)