Authenticate with an Organization Admin User API key, sent in the skyfire-api-key header. Keys belonging to callers whose organization role is ADMIN are accepted; a MEMBER key, or any Agent API key, is rejected with 401.

The user identified by userId must belong to your organization. A user from another organization, or one that does not exist, is reported as 404.

On success the endpoint returns 204 No Content with an empty body.

What deactivation blocks

Deactivating a user revokes their own access and the access of every agent they own. Deactivating a user who is already inactive succeeds and returns 204.

The organization's representative user cannot be deactivated, and the attempt returns 400. Assign the representative role to a different user first.

API key lookups are cached for up to 60 seconds, so access may persist for up to a minute after this call returns. Do not treat it as an immediate revocation for incident response.