> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cocoondata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# <access-service>/api/v1/users/bulk

## URL structure&#x20;

```text theme={null}
https://access-service.xy-company.com/api/v1/users/bulk
```

## Supported methods and overview&#x20;

* `POST` - used to perform a specific action on one or more [Covata users](/3.0/admin/administering-users.md) (i.e. [disable, enable](/3.0/admin/administering-users.md#disabling-or-re-enabling-users), [expire tokens/sessions](/3.0/admin/administering-users.md#expiring-users-tokens-sessions), [force passwords to be reset](/3.0/admin/administering-users.md#forcing-users-to-reset-their-passwords) or [delete](/3.0/admin/administering-users.md#deleting-users)).

## Detailed description&#x20;

This API endpoint performs any one of the following actions on one or more Covata users (each of which is specified by their Covata user ID):

* Disable or (re-)enable the account(s) of one or more Covata user(s). This can also be performed for an individual Covata user by calling the [\<access-service>/api/v1/users/\{userId}/enable](/3.0/api/access-service-api-v1-users-userid-enable.md) API endpoint.
* Expire (i.e. invalidate) all access/refresh tokens associated with the Covata user(s). This can also be performed for an individual:

  * Covata user by calling the [\<access-service>/api/v1/users/\{userId}/expire](/3.0/api/access-service-api-v1-users-userid-expire.md) API endpoint.
  * Access token (and its associated refresh token) by calling the [\<access-service>/api/v1/auth/token/revoke](/3.0/api/access-service-api-v1-auth-token-revoke.md) API endpoint.
* Force the Covata user(s) password(s) to be reset. This can also be performed for an individual Covata user by calling the `PUT` method of the [\<access-service>/api/v1/users/\{userid}](/3.0/api/access-service-api-v1-users-userid.md) API endpoint.
* Delete the Covata user(s). This can also be performed for an individual Covata user by calling the `DELETE` method of the [\<access-service>/api/v1/users/\{userid}](/3.0/api/access-service-api-v1-users-userid.md) API endpoint. \

  **Important:** It is *strongly advised* that you first explicitly delete these users' entire Secure Object content in storage (that will require multiple calls to the [\<content-service>/api/v1/users/\{userid}/contents](/3.0/api/content-service-api-v1-users-userid-contents.md) API endpoint - one for each user being deleted) *before* calling this API endpoint (with the **action** parameter value of `delete`), which changes the state of all Secure Objects that these users currently own to *Deleted*. If you call this endpoint first, then the available storage space reported by the Covata Platform is likely to remain significantly lower and will continue to do so, since the Covata Platform can no longer authenticate these users to obtain the appropriate access tokens required to manipulate these Secure Objects' data in storage through the Covata API.

## Supported roles&#x20;

This API endpoint supports the following Covata user [roles](/3.0/admin/administering-users.md#a-users-roles) (as described in the [Covata Platform Administrator's Guide](/3.0/admin.md)):

* [System administrator](/3.0/admin/administering-users.md#system-administrator-role)

The Covata Platform's resources available to one of these Covata users (above) is determined by the access token passed in the [header](/3.0/api/access-service-api-v1-users-bulk.md#access-service-api-v1-users-bulk-required-headers) of requests to this endpoint.

## Required headers&#x20;

* `Authorization: Bearer a1b2c3d4-e5f6-g7h8-i9j0-k1l2m3n4o5p6` \

  where the `Bearer` token is the appropriate access token.
* `Content-Type: application/json`

## Required parameters&#x20;

The following required parameter must be sent in the URL of the POST request:

* **action** - disable, enable, expire, resetPassword or delete.

  **Example ():**

## Optional parameters&#x20;

The following optional parameter can be sent in the body of the POST request, as an individual member of a JSON object:

* **ids** - An array of Covata user IDs.

  **Example ():**

Although omitting the **ids** parameter above in a request serves no purpose, an empty JSON object must at least be passed in the body of POST requests to this endpoint for a successful response:

* `{}`

## Returns&#x20;

If the request succeeded, then an HTTP response status `200 OK` is returned.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.