Scenario #9035: A Global Admin Can Deactivate a Removed Subject

UseCase Deactivate Subject => SubjectSync: sync-alice - deactivated

When a user or group is removed from Keycloak, the sync program deletes the corresponding subject. This is a soft-delete (deactivation): the subject record is retained but no longer visible or assignable, so DELETE returns 204 No Content and the subject can no longer be fetched.

Properties

Required

• SubjectSync: sync-alice - renamed to sync-alicia from 9033: Re Synchronizing an Existing Subject Updates Its Name Idempotently

Given

name	value
subjectUuid	238a0001-0000-0000-0000-000000000001

Deactivate the removed subject via DELETE

HTTP DELETE "/api/rbac/subjects/238a0001-0000-0000-0000-000000000001" // SubjectSync: sync-alice \
  -H "Authorization: Bearer $HSADMINNG_JWT_BEARER" \
  `# {` \
  `#   "sub" : "uuid<hsh-alex_superuser>"` \
  `# }` \
  -H 'Content-Type: application/json'
=> status: 204 NO_CONTENT 

The deactivated subject is no longer visible

HTTP GET "/api/rbac/subjects/238a0001-0000-0000-0000-000000000001" // SubjectSync: sync-alice \
  -H "Authorization: Bearer $HSADMINNG_JWT_BEARER" \
  `# {` \
  `#   "sub" : "uuid<hsh-alex_superuser>"` \
  `# }`
=> status: 404 NOT_FOUND 

---

generated on 2026-07-17 01:44:28 for branch