Skip to content

Spec User suspension & locking endpoints #2278

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
anoadragon453 merged 7 commits into from
Feb 16, 2026
Merged

Spec User suspension & locking endpoints #2278

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
05b0d06
Spec User suspension & locking endpoints
zecakeh Dec 19, 2025
bcd5f6b
Add changelog
zecakeh Dec 19, 2025
147f870
Fix fragments
zecakeh Dec 19, 2025
19bf443
Fix examples
zecakeh Dec 19, 2025
c98c03b
Fix changelogs
zecakeh Dec 19, 2025
f95dcfb
Fix changelog (again)
zecakeh Dec 19, 2025
b3e2de3
Apply suggestions from code review
zecakeh Feb 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions changelogs/client_server/newsfragments/2278.feature
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Add administrator endpoints to lock and suspend server-local users and add the `m.account_management` capability, as per [MSC4323](https://github.com/matrix-org/matrix-spec-proposals/pull/4323).
1 change: 1 addition & 0 deletions changelogs/client_server/newsfragments/2278.new.1
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Add `GET /_matrix/client/v1/admin/suspend/{userId}`, as per [MSC4323](https://github.com/matrix-org/matrix-spec-proposals/pull/4323).
1 change: 1 addition & 0 deletions changelogs/client_server/newsfragments/2278.new.2
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Add `PUT /_matrix/client/v1/admin/suspend/{userId}`, as per [MSC4323](https://github.com/matrix-org/matrix-spec-proposals/pull/4323).
1 change: 1 addition & 0 deletions changelogs/client_server/newsfragments/2278.new.3
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Add `GET /_matrix/client/v1/admin/lock/{userId}`, as per [MSC4323](https://github.com/matrix-org/matrix-spec-proposals/pull/4323).
1 change: 1 addition & 0 deletions changelogs/client_server/newsfragments/2278.new.4
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Add `PUT /_matrix/client/v1/admin/lock/{userId}`, as per [MSC4323](https://github.com/matrix-org/matrix-spec-proposals/pull/4323).
17 changes: 11 additions & 6 deletions content/client-server-api/_index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2280,9 +2280,12 @@ The server SHOULD return one of the following responses:
Server administrators may apply locks to prevent users from usefully
using their accounts, for instance, due to safety or security concerns.
In contrast to account deactivation, locking is a non-destructive action
that can be reversed. This specification describes the behaviour of clients
and servers when an account is locked. It deliberately leaves the methods
for locking and unlocking accounts as a server implementation detail.
that can be reversed.

{{% added-in v="1.18" %}} To lock or unlock an account, administrators
SHOULD use the [`PUT /admin/lock/{userId}`](#put_matrixclientv1adminlockuserid)
endpoint. They MAY also use [`GET /admin/lock/{userId}`](#get_matrixclientv1adminlockuserid)
to check whether a user's account is locked.

When an account is locked, servers MUST return a `401 Unauthorized` error
response with an `M_USER_LOCKED` error code and [`soft_logout`](#soft-logout)
Expand Down Expand Up @@ -2331,6 +2334,11 @@ from that account. The effect is similar to [locking](#account-locking), though
without risk of the client losing state from a logout. Suspensions are reversible,
like locks and unlike deactivations.

{{% added-in v="1.18" %}} To suspend or unsuspend an account, administrators
SHOULD use the [`PUT /admin/suspend/{userId}`](#put_matrixclientv1adminsuspenduserid)
endpoint. They MAY also use [`GET /admin/suspend/{userId}`](#get_matrixclientv1adminsuspenduserid)
to check whether a user's account is suspended.

The actions a user can perform while suspended is deliberately left as an
implementation detail. Servers SHOULD permit the user to perform at least the
following, however:
Expand Down Expand Up @@ -2386,9 +2394,6 @@ Content-Type: application/json
}
```

APIs for initiating suspension or unsuspension are not included in this version
of the specification, and left as an implementation detail.

### Adding Account Administrative Contact Information

A homeserver may keep some contact information for administrative use.
Expand Down
Loading