Users unexpectedly removed from Esper tenant: how to investigate API-driven bulk user deletions

Android

If one or more user accounts have been unexpectedly removed from your Esper tenant, this article will help you recover access and investigate what happened. User removals typically occur when an API client or automation script executes deletion requests outside the Esper Console.

Before you begin

Gather the following information:

The email addresses or user IDs of affected users
The approximate date and time the removals occurred
A list of all API tokens and automation scripts that have access to your tenant

Step 1: Recover immediate access

In the Esper Console, go to Settings → Users.
Compare the current user list against your expected roster to confirm which accounts are missing.
Click Invite User for each removed account.
Enter their email address and assign the appropriate role (Admin, Viewer, or other).
If your tenant uses SAML/SSO, verify that re-invited users can log in through your configured identity provider before proceeding.

Step 2: Identify the source of the deletions

User deletions via API are not logged in the Esper Console. You'll need to review your API token usage and automation scripts:

In the Esper Console, go to Settings → API Key Management.
Identify all active API tokens that have User Management write permissions.
For each token, verify:
- When it was created
- Who created it
- Whether it matches any scripts or integrations running at the time of the deletion
Review all automation scripts, CI/CD pipelines, and third-party integrations (such as HR system syncs) that have been granted API access to your tenant.
Check for any scripts that include user management operations.

Step 3: Request backend log analysis from Esper Support

If you cannot identify the source from your API token audit, contact Esper Support for a backend API audit log review.

Submit a support ticket and include:
The date range when the deletions occurred
The affected user email addresses or IDs
A request for the HTTP method, endpoint, timestamp, and client User-Agent string for each deletion event
Review the log output for the User-Agent header — this identifies whether the call came from a browser, a known integration, or a custom script (for example, python-requests/2.32.2).
Cross-reference the User-Agent, timestamp, and token metadata with your internal API token inventory and automation audit trails.

Step 4: Revoke unauthorized or suspicious tokens

Return to Settings → API Key Management.
Revoke any token that:
- Cannot be accounted for
- Was issued with broader permissions than required
- Matches the timeframe of the deletion incident
After revoking tokens, monitor for any additional unexpected deletions.

Step 5: Verify the incident has been resolved

Confirm all expected users appear in Settings → Users with the correct roles.
Test that affected users can successfully log in to the Esper Console.
Monitor your tenant for at least 24 hours to ensure no additional unexpected deletions occur.

Additional considerations

If none of the above steps identify the source of the deletions, consider these scenarios:

Multiple automation clients: Your tenant may have more than one script or integration making API calls. Request a full API access audit from Esper Support.
Security breach: If you suspect an unauthorized external actor obtained an API token, treat this as a security incident. Contact Esper Support immediately and flag it for the Security team to review token issuance and rotation policies.
Recurrent deletions: If deletions continue after revoking suspected tokens, contact Esper Support for a deeper investigation into your API access controls.

Still need help?

If you cannot identify the source of the deletions or if unexpected removals continue, submit a support ticket. Provide the date range of the incident, affected user accounts, and the results of your API token audit. Our support team can review your tenant's backend logs and help secure your account.