User accounts unexpectedly deleted from Esper tenant — investigate and recover

Android

When one or more user accounts disappear from your Esper tenant without a deliberate action in the Esper Console, the accounts have most likely been deleted by an API client or automation script that holds User Management write permissions.

Why this happens

The Esper API allows any authenticated client with sufficient permissions to delete user accounts programmatically. If an automation script, CI/CD pipeline, or third-party integration (such as an HR system sync) sends a DELETE request to the users endpoint — intentionally or due to a misconfiguration — the account is removed immediately with no in-console warning. Because the deletion originates outside the Console, there is no activity visible in the standard UI without a backend log review.

Step 1: Restore the missing accounts

1. Navigate to Settings → Users in the Esper Console and compare the current user list against your expected roster to confirm exactly which accounts are missing.
2. Click Invite User for each removed account, enter the user's email address, and assign the appropriate role (Admin, Viewer, or other).
3. If your tenant uses SAML/SSO, confirm that each re-invited user can authenticate through your configured identity provider before continuing — the Console invitation alone does not verify SSO access is intact.

Step 2: Audit your API tokens

1. Navigate to Settings → API Key Management and list every active token.
2. For each token, note:
   • The date it was created and who created it
   • The permission scopes assigned, specifically whether it holds User Management write access
   • Whether it corresponds to a known integration, script, or team member
3. Cross-reference token creation dates and known owners against the approximate time the deletions occurred to narrow down which client is responsible.
4. Review all automation scripts, CI/CD pipelines, and third-party integrations that have been granted API access. Look specifically for any code paths that call a user management endpoint — these are the most likely sources of the unintended deletions.

Step 3: Request a backend API log review

User deletions made through the API are not surfaced in the Esper Console Activity Feed. If your internal audit in Step 2 does not identify the responsible client, Esper Support can pull backend API logs for your tenant.

1. Open a support ticket and include:
   • The date and time range when the deletions are believed to have occurred
   • The email addresses or user IDs of all affected accounts
   • A request for the HTTP method, endpoint URL, timestamp, API token identifier, and User-Agent string for each deletion event
2. When you receive the log output, examine the User-Agent header for each deletion request — this identifies whether the call came from a browser session, a known integration, or a custom script (for example, python-requests/2.32.2 indicates a Python automation).
3. Match the User-Agent, timestamp, and token identifier from the logs against your internal API token inventory and automation audit trails to pinpoint the exact client.

Step 4: Revoke unauthorized or over-permissioned tokens

1. Return to Settings → API Key Management.
2. Revoke any token that meets one or more of the following criteria:
   • Cannot be attributed to a known owner or system
   • Was granted broader permissions than its intended function requires
   • Was active at the time of the deletion incident
3. After revoking tokens, re-issue narrowly scoped replacements only for the integrations that legitimately require API access, following the principle of least privilege.

Verify: Navigate to Settings → Users and confirm all expected accounts appear with the correct roles. Have each affected user log in to the Esper Console to confirm access is fully restored. Monitor Settings → Users for at least 24 hours after revoking suspicious tokens to confirm no further unexpected deletions occur.

If this doesn't resolve it

If accounts continue to be deleted after completing the steps above, or if you cannot match the log data to any known integration, contact Esper Support. When you open the ticket, provide:

• The backend log output from Step 3, if already retrieved
• A list of all API tokens you have reviewed and their disposition (retained, revoked, or unidentified)
• The names and versions of any automation tools or third-party platforms with access to your tenant
• The exact timestamps and affected user IDs for any deletions that occurred after Step 4

Still need help?

If user accounts continue to be unexpectedly deleted from your Esper tenant after following these steps, submit a support ticket with the date and time of the deletion, affected usernames, and any error messages observed in your audit logs.