Book a demo

anonymize_user

Anonymize a user

act entity tenant-private since 2026-10-01

Permanently anonymizes a user; it cannot be undone. Their records are kept and now show the tombstone "Deleted user #n" in place of their name; their email addresses, profile details and sessions are removed, their Clerk user is deleted, and they are deactivated. Calling it again changes nothing. An org admin cannot anonymize anyone (they deactivate); an account owner can anonymize only a user whose every org is in an account they own; staff can anonymize anyone but themselves.

Contract

shape
entity
authority
act
evidence
none
subscription
false
permission
any one of: account.owner (account role owner or higher in the account of EVERY org the user `user_id` belongs to; an org with no account blocks); staff.ops (the staff role staff_ops held in the Internal org, tradehq_role.staff_role); a deactivated caller is refused first
idempotency
natural
emits
user.anonymized
MCP tool
anonymize_user
decision_set
approve, reject, escalate
REST
POST https://api.containertradehq.com/v1/cap/anonymize_user

Through MCP this call returns an approval request first; see Approvals.

Idempotency: keyed by the contract's own inputs: the same inputs replay the first call's result

Inputs

nametyperequiredvalidation
user_iduser_idrequiredtradehq-user-id; 1 to 20 characters
The user to anonymize.

Response

  • user_id · string · The user.
  • tombstone · string · What their records now show: "Deleted user #n".
  • tombstone_no · integer · n.
  • orgs · string[] · The orgs the user belongs to, whose admins the event reaches.
Full JSON Schema 
{
  "type": "object",
  "properties": {
    "user_id": {
      "type": "string",
      "minLength": 1,
      "maxLength": 20,
      "pattern": "^[A-Za-z0-9_-]{1,20}$",
      "format": "tradehq-user-id",
      "description": "The user.",
      "x-data-class": "operational"
    },
    "tombstone": {
      "type": "string",
      "description": "What their records now show: \"Deleted user #n\".",
      "x-data-class": "operational"
    },
    "tombstone_no": {
      "type": "integer",
      "description": "n.",
      "x-data-class": "operational"
    },
    "orgs": {
      "type": "array",
      "items": {
        "type": "string",
        "minLength": 1,
        "maxLength": 20,
        "pattern": "^[A-Za-z0-9_-]{1,20}$",
        "format": "tradehq-org-id"
      },
      "description": "The orgs the user belongs to, whose admins the event reaches.",
      "x-data-class": "operational"
    }
  },
  "required": [
    "user_id",
    "tombstone",
    "tombstone_no",
    "orgs"
  ],
  "additionalProperties": false
}

Refusals

not yet declared

The platform refusals apply to every call: version, authentication, authority, validation and rate limits, each in the same envelope.

Surfaces

DesktopF
MobileF
APIF
MCPF*
VoiceD2
PushF
OneBoxN
OutboundN
  • MCP: approval required
  • Voice: degraded: confirmation
  • OneBox: no document originates an anonymization
  • Outbound: crosses to no counterparty

Events

Related

None.