Make the change in all layers of the code, but at the controller, level, keep the existing /api/namedusers/:username/deprovision endpoint and provide a new /api/namedusers/:username/ban with the same functionality (a redirect may not work, depending on the client impl., so we may need to keep both implementations until the registration app has been updated to call the new ban endpoint)
Having ban endpoint would help clarifying the role, compared to the upcoming deactivate endpoint which has not exactly the same business rules:
when an account is deactivated, all data is removed (briefly explained), but the user may come back and register again
when an account is banned, all data is removed but the user is not allowed to connect the SaaS again.
Make the change in all layers of the code, but at the controller, level, keep the existing
/api/namedusers/:username/deprovisionendpoint and provide a new/api/namedusers/:username/banwith the same functionality (a redirect may not work, depending on the client impl., so we may need to keep both implementations until the registration app has been updated to call the newbanendpoint)Having
banendpoint would help clarifying the role, compared to the upcomingdeactivateendpoint which has not exactly the same business rules: