Make the change in all layers of the code, but at the controller, level, keep the existing /api/namedusers/:username/deprovision endpoint and provide a new /api/namedusers/:username/ban with the same functionality (a redirect may not work, depending on the client impl., so we may need to keep both implementations until the registration app has been updated to call the new ban endpoint)
Having ban endpoint would help clarifying the role, compared to the upcoming deactivate endpoint which has not exactly the same business rules:
when an account is deactivated, all data is removed (briefly explained), but the user may come back and register again
when an account is banned, all data is removed but the user is not allowed to connect the SaaS again.
Make the change in all layers of the code, but at the controller, level, keep the existing
/api/namedusers/:username/deprovision
endpoint and provide a new/api/namedusers/:username/ban
with the same functionality (a redirect may not work, depending on the client impl., so we may need to keep both implementations until the registration app has been updated to call the newban
endpoint)Having
ban
endpoint would help clarifying the role, compared to the upcomingdeactivate
endpoint which has not exactly the same business rules: