Scenario #9036: A Deactivated Subject No Longer Appears in Queries

A deactivated subject is excluded from all read paths, so it neither appears in the list of subjects (GET /api/rbac/subjects) nor can it be assigned any longer.

Properties

Required

• SubjectSync: sync-alice - deactivated from 9035: A Global Admin Can Deactivate a Removed Subject

Expected

name	value
unexpectedSubjectNames	[   { “name”: “sync-alice” },   { “name”: “sync-alicia” } ]

Fetch visible RBAC subjects

HTTP GET "/api/rbac/subjects" \
  -H "Authorization: Bearer $HSADMINNG_JWT_BEARER" \
  `# {` \
  `#   "sub" : "uuid<hsh-alex_superuser>"` \
  `# }`
=> status: 200 OK 
[
  {
    "uuid" : "242a0005-0000-0000-0000-000000000005",
    "name" : "abc-peter.smith",
    "organization" : "abc",
    "type" : "USER"
  },
  {
    "uuid" : "7243562a-523f-4282-94f2-226e89bfa254",
    "name" : "/abc-Team",
    "organization" : "abc",
    "type" : "GROUP"
  },
  {
    "uuid" : "a91c0005-0000-0000-0000-000000000005", // ApiKey-Subject: bootstrapped.key
    "name" : "bootstrapped.key",
    "organization" : "bootstrapped",
    "type" : "API_KEY"
  },
  {
    "uuid" : "a91c0008-0000-0000-0000-000000000008",
    "name" : "business.attempt.key",
    "organization" : "business",
    "type" : "API_KEY"
  },
  {
    "uuid" : "242a0006-0000-0000-0000-000000000006",
    "name" : "def-peter.smith",
    "organization" : "def",
    "type" : "USER"
  },
  "..."
]

---

generated on 2026-08-10 04:34:39 for branch HEAD