---
type: api
title: Disable users
description: **All methods and paths for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/operation/operation-security-disable-user
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/operation/operation-security-disable-user
products:
  - Elasticsearch
---

# Disable users


Availability:

## Paths

- `POST` (also `PUT`) `/_security/user/{username}/_disable`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/elasticsearch/authentication#apikeyauth)
- [Basic auth](/elastic/docs-builder/docs/4371/api/doc/elasticsearch/authentication#basicauth)
- [Bearer auth](/elastic/docs-builder/docs/4371/api/doc/elasticsearch/authentication#bearerauth)

#### Path Parameters

- `username` (string)
  An identifier for the user.

## Description

Disable users in the native realm.
By default, when you create users, they are enabled.
You can use this API to revoke a user's access to Elasticsearch.

## Required authorization

* Cluster privileges: `manage_security`

## Query String Parameters

- `refresh` (enum Refresh)
  If `true` (the default) then refresh the affected shards to make this operation visible to search, if `wait_for` then wait for a refresh to make this operation visible to search, if `false` then do nothing with refreshes.
  Values: `true`, `false`, `wait_for`

## Response

`application/json`

Type: `object`

## Code Examples

#### Console

```console
POST /_security/user/jacknich/_disable
```

#### JavaScript

```javascript
const response = await client.security.disableUser({
  username: "jacknich",
});
```

#### Python

```python
resp = client.security.disable_user(
    username="jacknich",
)
```

#### curl

```curl
curl -X POST "$ELASTICSEARCH_URL/_security/user/jacknich/_disable" \
  -H "Authorization: ApiKey $ELASTIC_API_KEY"
```

#### Java

```java
client.security().disableUser(d -> d
    .username("jacknich")
);
```

#### C#

```c#
var response = await client.Security.DisableUserAsync(username: "jacknich");
```

#### PHP

```php
$resp = $client->security()->disableUser([
    "username" => "jacknich",
]);
```

#### Ruby

```ruby
response = client.security.disable_user(
  username: "jacknich"
)
```