# View User API Call Issue

**URL:** https://community.sendbird.com/t/view-user-api-call-issue/3571
**Category:** JavaScript
**Tags:** sendbird-call
**Created:** [December 14, 2021, 12:44pm UTC](https://community.sendbird.com/t/view-user-api-call-issue/3571 "2021-12-14T12:44:45Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Brandon\_Ho](https://sea2.discourse-cdn.com/flex020/user_avatar/community.sendbird.com/brandon_ho/32/1857_2.png) [@Brandon\_Ho](https://community.sendbird.com/u/Brandon_Ho)
#### Post date: [December 14, 2021, 12:44pm UTC](https://community.sendbird.com/t/view-user-api-call-issue/3571/1 "2021-12-14T12:44:45Z")

</div>

Hey there,

During preliminary security stress testing, a fellow colleague and I found that we could update user properties via the View User API Call ([User | Chat Platform API | Sendbird Docs](https://sendbird.com/docs/chat/v3/platform-api/guides/user#2-view-a-user)).

For example, a PUT request (https://{application-id}.sendbird.com/v3/users/{user-id}/ with the body parameters

```auto
{
    "is_active": false
}

```

Could deactivate the user. Is this intended?

We also noticed that once a user has been deactivated and then reactivated, the user would lose all their chats. We were unsure if this was also intended?

Regards,  
Brandon

---

<div class="post-metadata">

### Author: ![Brandon\_Ho](https://sea2.discourse-cdn.com/flex020/user_avatar/community.sendbird.com/brandon_ho/32/1857_2.png) [@Brandon\_Ho](https://community.sendbird.com/u/Brandon_Ho)
#### Post date: [December 15, 2021, 10:57am UTC](https://community.sendbird.com/t/view-user-api-call-issue/3571/2 "2021-12-15T10:57:38Z")

</div>

Managed to find out about the API call also being used to update various properties, as listed here: [User | Chat Platform API | Sendbird Docs](https://sendbird.com/docs/chat/v3/platform-api/guides/user#2-update-a-user-3-http-request)

My colleague and I, however, are still curious about the consequence of deactivating/reactivating a user, where all the existing chats are deleted. Is this an intended effect?

---

<div class="post-metadata">

### Author: ![Brandon\_Ho](https://sea2.discourse-cdn.com/flex020/user_avatar/community.sendbird.com/brandon_ho/32/1857_2.png) [@Brandon\_Ho](https://community.sendbird.com/u/Brandon_Ho)
#### Post date: [December 15, 2021, 11:03am UTC](https://community.sendbird.com/t/view-user-api-call-issue/3571/3 "2021-12-15T11:03:40Z")

</div>

Just realised the `leave_all_when_deactivated` user property. This has solved our question/issue!
