Why does a super admin on multi site get a rest_user_invalid_id error code when requesting user details through REST?

Question

My goal is to (completely) delete users from a multi site installation using the REST API.

Using DELETE or GET ends with a rest_user_invalid_id error code even though the user (and its id) exist.

curl --user "superadmin:TOKEN" -X GET https://example.com/wp-json/wp/v2/users/5

The authentification works just fine. What is even more obscure is the fact that for some random users this works.

I do not use WordFence or to my knowledge any other security plugin (and I am quite sure about this).

What's the API's problem and how do I solve? Any hints are appreciated. Thank you!

Answer 1

Deleting users with the REST API isn't supported for multisite, as seen in the source code:

// We don't support delete requests in multisite.
if ( is_multisite() ) {
    return new WP_Error(
        'rest_cannot_delete',
        __( 'The user cannot be deleted.' ),
        array( 'status' => 501 )
    );
}

For GET requests the user ID is checked against is_user_member_of_blog() for the current site. If the user is a super admin but has not been explicitly added to that site then they will not be returned and you will receive the rest_user_invalid_id error.