removeOrganizationUser

Remove a user from an organization (revoke membership). Strips every role the user holds in the org so they are no longer a member; the Keycloak user account is NOT deleted (they may belong to other orgs). Rejects removing the organization's only admin. Requires change-user-roles permission on the organization.

Deliberately NOT gated on team_management, unlike its acquiring siblings inviteOrganizationUser / resendOrganizationInvitation / changeOrganizationUserRole. Revoking a person's membership is the only way an org cuts off someone who has left, and the same rule billing.EnforceMarketplacePublish states for unpublishListing applies with more force here: gate acquiring a capability, never relinquishing what was already acquired. team_management is Enterprise-only, so while the gate stood a Starter or Pro org could never offboard anyone — and after lapse-to-Free an org whose CARD merely failed lost offboarding overnight while every other capability kept working. A revocation primitive that answers to billing state turns a payment incident into a security incident.

Safe to leave ungated precisely because the destructive edge is guarded in the domain, not by the paywall: organization.RemoveUser returns ErrLastAdmin rather than removing an org's only admin, so an unpaid org cannot strand itself. cancelOrganizationInvitation is ungated for the same reason (a pending invite is a live bearer credential). Do NOT "fix" this for consistency with the siblings — see TestRemoveOrganizationUser_IsNotBillingGated.

removeOrganizationUser(
  organizationId: String!
  userId: String!
): Boolean!

Arguments

removeOrganizationUser.organizationId ● String! non-null scalar

removeOrganizationUser.userId ● String! non-null scalar

Type

Boolean scalar

The Boolean scalar type represents true or false.