Antylogic
DemoApp login

399 operational guides

Docs sections
DocsAccess management
Device

How to remove user access

Remove a non-owner user from Harbor Demo Group organization access or from Harbor Soho location access. The action requires `users:manage`, asks for confirmation, has no undo in the access management UI, and needs extra care for matching internal users.

In this article

Use this guide when an administrator needs to remove a user from access management without changing unrelated records. Organization removal detaches the user from Harbor Demo Group; location removal detaches the user only from Harbor Soho.

Treat the action as destructive. Owners are protected, view-only users cannot see the Remove action, and matching internal users can be deleted as identities rather than only detached from a membership.

Before you start

  • The operator is signed in to the app.
  • Harbor Demo Group is selected for organization access, or Harbor Soho is selected for location access.
  • The target user appears in the Users list for the selected scope and is not the organization owner.
  • The operator has `users:manage` for the same scope. `users:view` can show the list, but it does not expose Remove.
  • For documentation captures, use a temporary non-owner user because the UI does not provide restore or undo.

Instructions

  1. 1.

    Open Users and roles

    Open `organization/access` for Harbor Demo Group or `location/access` for Harbor Soho, then use the Users tab. The screen can load for `users:view` or `users:manage`, but Remove is only available with `users:manage` for the current scope.

  2. 2.

    Find a removable user

    Search by name or email and choose a temporary non-owner user. Do not use Harbor Demo User, the organization owner, or a primary demo account for destructive documentation captures.

  3. 3.

    Choose Remove

    Open the row actions for the target user and select Remove. Owner rows are shown as Owner and remain blocked even when the operator has `users:manage`.

  4. 4.

    Review the confirmation

    The modal is titled Remove user. Organization access says the user will be removed from the organization; location access says the user will be removed from this location. Cancel closes the modal without sending a DELETE request.

  5. 5.

    Confirm only when the scope is correct

    Select Remove only after checking both the target user and the scope. Organization removal deletes the ordinary `user_organizations` membership; location removal deletes the ordinary `user_locations` membership and leaves organization membership in place.

  6. 6.

    Handle internal users carefully

    If the user has internal credentials in a namespace that matches the selected organization or location scope, the backend can delete the internal user identity instead of only removing a membership.

Validations and limits

  • The Users tab is available when the operator has `users:view` or `users:manage`.
  • The Remove row action is only added when `users:manage` is true for the current organization or location scope.
  • Owner rows are protected in the UI and by backend owner-specific errors.
  • The confirmation modal must be accepted explicitly before a removal request is sent.
  • Organization removal calls `DELETE /api/app/{orgId}/users/{userId}`.
  • Location removal calls `DELETE /api/app/{orgId}/{locationId}/users/{userId}`.
  • After a successful ordinary removal, the list and user detail queries are refreshed.
  • Removing location access does not remove the user's organization membership.
  • Matching internal users can take the higher-risk `DeleteUser` path instead of `DeleteUserOrganization` or `DeleteUserLocation`.

Expected result

If the operator confirms, the selected non-owner user's access is removed for the chosen scope, the modal closes, the list refreshes and a success toast is shown. If the operator cancels, access remains unchanged.

Related articles