Factory-reset a user's data to their post-registration state (admin only).
const url = 'https://api.tradr.cloud/api/admin/users/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/reset';const options = { method: 'POST', headers: {'Content-Type': 'application/json'}, body: '{"confirmEmail":"hello@example.com","removeSettings":false}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://api.tradr.cloud/api/admin/users/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/reset \ --header 'Content-Type: application/json' \ --data '{ "confirmEmail": "hello@example.com", "removeSettings": false }'Admin-gated (403 ADMIN_REQUIRED). DESTRUCTIVE AND IRREVERSIBLE — there is no undo and no backup taken. POST (never GET) per the SameSite=Lax CSRF posture.
confirmEmail must equal the target user’s email (case-insensitive) or the request is a 400 VALIDATION_ERROR and nothing is changed; the check is enforced here, not only in the UI that collects it.
ALWAYS DELETED: accounts, positions, fills, ledger entries, expenses, the user’s own brokerages and their fee schedules, and staged CSV rows. ALWAYS RESET: the user’s onboarding state, so the walkthrough can be walked again. DELETED ONLY WHEN removeSettings IS TRUE (default false): BYOK provider and external API keys, advisor personas/conversations/messages/summaries, the dashboard layout, and the user’s preference columns.
NEVER TOUCHED: billing and wallet state (wallets, wallet_transactions, usage_records, subscriptions, billing_customers) — these mirror Stripe and hold purchased credit; the non-evasion quota counters (csv_import_counters, advisor_turn_counters, advisor_image_counters); and the user’s identity (email, password, admin flag, verified flag, created-at) and sessions — the user stays logged in.
Deletes and the admin_audit_log entry recording them commit in one transaction. That entry’s detail is the only surviving record of what was removed.
Parameters
Section titled “Parameters”Path Parameters
Section titled “Path Parameters”Request Bodyrequired
Section titled “Request Bodyrequired”object
Must match the target user’s email, case-insensitively.
Also delete BYOK keys, advisor data, dashboard layout and preferences.
Responses
Section titled “Responses”AdminResetResult — { userId, email, removeSettings, deleted }.
VALIDATION_ERROR — id is not a UUID, body malformed, or confirmEmail does not match.
Not authenticated.
ADMIN_REQUIRED — authenticated but not an admin.
NOT_FOUND — no such user.
Admin rate limit reached (60 / 60 s per user).