Unlock a locked user account (admin only)
POST
/users/{userId}/unlock
Restores sign-in access for a locked user account. Requires admin role. Clears failed_attempts counter and locked_at timestamp. Creates an audit trail entry recording who unlocked the account.
Authorizations
tokenAuth
Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.
Type
HTTP (token)
Responses
Account unlocked
application/json
JSON "toast": { "title": "Account unlocked.", "message": [ "Account jane.doe@example.org unlocked." ], "variant": "success" }, "user": { "id": 42, "name": "Jane Doe", "email": "jane.doe@example.org", "admin": false, "locked_at": null }
{
}