Cleaning up dormant user accounts

Here’s how to safely automate dormant-user clean-up on your Huwise portal.

💡 Strategic recommendations before you start

Before running any deletion script, we recommend setting clear rules to avoid revoking legitimate access:

• Set a reasonable inactivity threshold: For a first clean-up, favor 12 to 24 months. A 90-day threshold can be too short for a data portal where some users only log in once or twice per year.
• Segment your user populations: You can be stricter (e.g., 90 days) for invitations that were never activated, while staying more flexible with long-standing users.
• Protect critical accounts: Always exclude from your filters administrators, editors (publishers), data managers (data stewards), and service/API accounts.
• Notify your users: Send a reactivation email about 30 days before the deadline. This is a best practice and may also be required under GDPR.

🖱️ No script needed: clean up from the back office

Since the latest updates, you can do the whole clean-up from Access > Users:

1. Open the filters and set Last activity to end at your inactivity threshold (for example, 12 months ago). Last activity also counts API calls made with a user’s API key, so your service accounts stay out of the results as long as they’re used.
2. To find invitations that were never accepted, filter on Status > Pending and Joined on instead. These users have no last activity date, so the Last activity filter doesn’t show them.
3. Select the users, check the counter, then click Deactivate or Delete. The platform never removes your last administrator.

Need a review file first? Export all users to CSV gives you every user with last_seen (Last activity), last_login, status, groups and permissions. Note that it exports all users, not only the filtered ones.

All the details are in the user guide: Managing users.

🛠️ The automation workflow 

We recommend a 5-step approach to ensure data safety:

1. Extract: Retrieve the full list of users via GET /users/.
2. Filter locally: Identify dormant users using the last_seen_at field (shown as Last activity in the back office). last_seen_at also changes when a user calls the API with their API key, while last_login_at only changes when they sign in. If last_seen_at is empty, the user has never been active on your portal: use joined_at for them.
3. Validate (dry run): Export a CSV file for internal manual review before taking any action.
4. Grace period: (Optional) Send the reactivation email.
5. Execute: Delete the users via DELETE /users/{username}/. Deletion can’t be undone, and it also deletes the user’s API keys.

📌 IMPORTANT

What “deletion” means: The API revokes access to your workspace and removes permissions/API keys, but it does not delete the user’s global Huwise account.

💻 Example script (Python)

To help you, here is the basic logic to implement for safe filtering:

# Excerpt of the recommended filtering logic
def is_protected(user):
    # Protection based on permissions and groups
    PROTECTED_PERMISSIONS = {"edit_domain"}
    PROTECTED_GROUPS = {"admins", "publishers", "data-stewards"}# Replace with your own group identifiers

    perms = set(user.get("permissions", []))
    group_uids = {g.get("uid", "").lower() for g in user.get("groups", [])}

    if (perms & PROTECTED_PERMISSIONS) or (group_uids & PROTECTED_GROUPS): 
        return True
    return False

(The full script generates a review CSV before switching the DRY_RUN variable to False.)

🔗 Useful resources

• Base URL: https://<your-domain>.huwise.com/api/automation/v1.0/
• Full documentation: Automation API documentation
• Interactive console: Open Swagger

And you? What is your policy for cleaning up inactive accounts? Share your feedback in the comments!