Delete user with proget api

[certificatemanager_4002]

Hello,
I'm using the ProGet api endpoint DELETE /api/security/users/delete?user=«username» to delete a user. Although the request return a 200 OK response, the user is not removed and still appears in ProGet.

[atripp]

Hi @certificatemanager_4002 ,

My guess is there's some kind of typo with the username you're sending.

The name is not validated before attempting to delete, which means you can type in any string and a 200 will be returned.

If you don't send an arggument, you will get an error however.

I would also try using pgutil security users delete to see if that helps:
https://docs.inedo.com/docs/proget/api/security/users/delete

Thanks,
Alana

[certificatemanager_4002]

@atripp
Thanks for your quick answer.
I checked the name and it's correct, I was able to find it into the proget portal.
I also check the Diagnostics Center but not error appear.
Do I need to add simple or double quote around the name?
Does pgutil a better option the api?

[atripp]

Hi @certificatemanager_4002 ,

Maybe you're attempting to delete a principal that's not a user, such as a group or Anonymous or something.

In any case, the API uses the exact same code as the UI; I'll share it:

case "delete":
    EnsureMethod(context, "POST", "DELETE");
    var userName = context.Request.QueryString["user"];
    if (string.IsNullOrEmpty(userName))
        throw new HttpException(400, "Expected user query argument.");
    DB.Users_DeleteUser(userName);
    break;

Here is the UI code for the button click on the /administration/security/users/delete-user?userName=asdfasdf page:

var btnDelete = new PostBackButtonLink(
    "Yes, Delete User",
    () =>
    {
        DB.Users_DeleteUser(this.UserName);
        WebUserContext.ClearCache();
        this.CloseModalWindow(false);
    }
);

Your request might not be reaching the endpoint; I would attempt to do DELETE /api/security/users/delete?something=nothing to make sure you're getting a 400 error.

Hope that helps.
Alana

[certificatemanager_4002]

Hello,
Following your idea, I have done a test with wrong api call to remove a user from a group and I got an error into Proget Diagnostic Center. This stage confirm that I reach the correct server. I remove the error and the server answer me 200 but the user is still there.
I'm using Proget version 2025.26 (Build 11).
The apikey to do such operation is the admin one.
The url xxx/api/security/groups/update
The body of my request was

{
  "users": [
    "username"
  ],
  "name": "group"
}

The server answer is
VERBOSE: WebRequest: v1.1 POST https://mydomain/api/security/groups/update with application/x-www-form-urlencoded payload with body size 109 B (109 bytes)
VERBOSE: WebResponse: 200 OK with body size 0 b (0 bytes).
How can I trust a server which is not able to accomplish a task.
I can do it manually and with pgutil.

[atripp]

Hi @certificatemanager_4002 ,

The API is a bit harder to use than just pgutil, so I'd suggest to use pgutil instead and it's easy to make a simple mistake like encoding something incorrectly. Without studying your code and having direct access to your ProGet instance, I cannot tell you what the issue is.

But, since pgutil works we know the API is fine; here is the code that pgutil uses to delete the user:
https://github.com/Inedo/pgutil/blob/thousand/Inedo.ProGet/ProGetClient.cs#L744

would suggest to use a local proxy tool like fiddler classic, proxyamn, postman, etc., that can capture and analyze local HTTP traffic so you can see the difference between what your code is doing and what pgutil is doing.

Thanks,
Alana