Investors

Set an investor's status

PATCH/investors/{userId}/status
investors:writeset_investor_statusDeprecatedSunset 2027-06-30

Sets the user's lifecycle status.

  • active: re-enables a suspended user and clears disabled_email_sent.
  • suspended: disables the user. notify (none default, email, password) controls the account-disabled email; remove_distribution removes the user from every distribution list. Both are only accepted with suspended.
  • deactivated: sets the user's status to deactivated, which an active can reverse. The response is { "deactivated": true } rather than the user.

notify and remove_distribution must be omitted entirely (not sent as null or false) unless status is suspended, else 422.

Deprecated: withdrawn on 2027-06-30. POST /investors/{id}/actions/activate replaces it for active, POST /investors/{id}/actions/suspend for suspended and DELETE /investors/{id} for deactivated; every answer carries a Link header with rel="successor-version". This route keeps its old body and answer. Like the actions it moves an investor from any status to any other.

Path parameters

  • userIdstring (uuid)Required#

    The user's public guid.

Request body

application/json, required

  • statusstringRequired#
    One of: active, suspended, deactivated
  • notifystring#
    One of: none, email, passwordDefault: "none"
  • remove_distributionboolean#
    Default: false
{
  "status": "suspended",
  "notify": "email"
}

Responses

200

OK

{
  "data": {
    "id": "6f1c2e8a-1b2c-4d5e-8f90-1a2b3c4d5e6f",
    "first_name": "Ada",
    "last_name": "Lovelace",
    "email": "ada.lovelace@example.com",
    "type": "investor",
    "status": "suspended",
    "created_at": "2026-06-15T10:30:00+00:00",
    "updated_at": "2026-06-18T16:20:00+00:00"
  }
}
401

Authentication failed. error.code is one of invalid_token, expired, revoked.

Error
403

Authorization failed. error.code is one of org_disabled, ip_blocked, missing_scope, scope_disabled, user_disabled.

Error
404

Resource not found (error.code = not_found).

Error
409

The user is provisioned by SCIM (error.code = scim_managed), so this change must be made through the identity provider instead.

Error
422

Request validation failed (HTTP 422). The body is either the Laravel validation envelope (message + field-keyed errors) or the API error envelope for domain rejections (e.g. form_type_not_supported, folder_locked, parent_not_found, folder_not_empty).

429

Rate limit exceeded (error.code = rate_limited).

Error

Examples

curl -X PATCH https://your-org-domain/kong/core/api/v2/investors/{userId}/status\
  -H "Authorization: Bearer $HELM_API_KEY"\
  -H "Content-Type: application/json"\
  -d '{
  "status": "suspended",
  "notify": "email"
}'