Deregister User

Remove a user from ZTXBAS. This disables ZTXBAS authentication for the user and removes their association with your client.

Data Removal

Deregistering a user removes their ability to authenticate via ZTXBAS for your applications.

Endpoint

POST /api/v1/users/deregister

Request Body

{
  "email": "user@example.com"
}

Request Fields

Field	Type	Required	Description
email	string	Yes	User's email address

Response

Success

{
  "success": true,
  "message": "User deregistered successfully"
}

User Not Found

{
  "success": true,
  "message": "User not found"
}

Errors

Error Code	HTTP Status	Description
INVALID_REQUEST	400	Missing email
INTERNAL_ERROR	500	Device not found

---

Examples

cURL

#!/bin/bash

CLIENT_ID="your-client-id"
CLIENT_SECRET="your-client-secret"
API_BASE="https://ztabas01.corezt.com"

USER_EMAIL="user@example.com"

TIMESTAMP=$(date +%s)
NONCE=$(openssl rand -hex 32)
BODY="{\"email\":\"${USER_EMAIL}\"}"

SIGN_DATA="POST|/api/v1/users/deregister|${TIMESTAMP}|${NONCE}|${BODY}"
SIGNATURE=$(echo -n "$SIGN_DATA" | openssl dgst -sha256 -hmac "$CLIENT_SECRET" | awk '{print $2}')

curl -X POST "${API_BASE}/api/v1/users/deregister" \
  -H "Content-Type: application/json" \
  -H "X-Client-ID: ${CLIENT_ID}" \
  -H "X-Timestamp: ${TIMESTAMP}" \
  -H "X-Nonce: ${NONCE}" \
  -H "X-Signature: ${SIGNATURE}" \
  -d "$BODY"

Python

import hmac
import hashlib
import time
import secrets
import requests
import json

class ZTXClient:
    def __init__(self, client_id: str, client_secret: str, base_url: str = "https://ztxbas01.corezt.com"):
        self.client_id = client_id
        self.client_secret = client_secret
        self.base_url = base_url
    
    def _sign_request(self, method: str, endpoint: str, body: str) -> dict:
        timestamp = str(int(time.time()))
        nonce = secrets.token_hex(32)
        
        sign_data = f"{method}|{endpoint}|{timestamp}|{nonce}|{body}"
        signature = hmac.new(
            self.client_secret.encode(),
            sign_data.encode(),
            hashlib.sha256
        ).hexdigest()
        
        return {
            "X-Client-ID": self.client_id,
            "X-Timestamp": timestamp,
            "X-Nonce": nonce,
            "X-Signature": signature,
            "Content-Type": "application/json"
        }
    
    def deregister_user(self, email: str) -> dict:
        """
        Deregister a user from ZTXBAS.
        
        Args:
            email: User's email address
            
        Returns:
            Deregistration result
        """
        endpoint = "/api/v1/users/deregister"
        body = json.dumps({"email": email})
        
        headers = self._sign_request("POST", endpoint, body)
        response = requests.post(f"{self.base_url}{endpoint}", headers=headers, data=body)
        response.raise_for_status()
        
        return response.json()


# Usage
client = ZTXClient("your-client-id", "your-client-secret")

result = client.deregister_user("user@example.com")
print(f"Result: {result['message']}")

Node.js

const crypto = require('crypto');
const https = require('https');

class ZTXClient {
  constructor(clientId, clientSecret, baseUrl = 'https://ztxbas01.corezt.com') {
    this.clientId = clientId;
    this.clientSecret = clientSecret;
    this.baseUrl = new URL(baseUrl);
  }

  _signRequest(method, endpoint, body) {
    const timestamp = Math.floor(Date.now() / 1000).toString();
    const nonce = crypto.randomBytes(32).toString('hex');
    
    const signData = `${method}|${endpoint}|${timestamp}|${nonce}|${body}`;
    const signature = crypto
      .createHmac('sha256', this.clientSecret)
      .update(signData)
      .digest('hex');

    return {
      'X-Client-ID': this.clientId,
      'X-Timestamp': timestamp,
      'X-Nonce': nonce,
      'X-Signature': signature,
      'Content-Type': 'application/json'
    };
  }

  async deregisterUser(email) {
    const endpoint = '/api/v1/users/deregister';
    const body = JSON.stringify({ email });
    const headers = this._signRequest('POST', endpoint, body);

    return new Promise((resolve, reject) => {
      const options = {
        hostname: this.baseUrl.hostname,
        port: this.baseUrl.port || 443,
        path: endpoint,
        method: 'POST',
        headers
      };

      const req = https.request(options, (res) => {
        let data = '';
        res.on('data', chunk => data += chunk);
        res.on('end', () => resolve(JSON.parse(data)));
      });

      req.on('error', reject);
      req.write(body);
      req.end();
    });
  }
}

// Usage
const client = new ZTXClient('your-client-id', 'your-client-secret');

client.deregisterUser('user@example.com')
  .then(result => {
    console.log(`Result: ${result.message}`);
  })
  .catch(console.error);

C# (.NET)

using System;
using System.Collections.Generic;
using System.Net.Http;
using System.Security.Cryptography;
using System.Text;
using System.Text.Json;
using System.Threading.Tasks;

public class ZTXClient
{
    private readonly string _clientId;
    private readonly string _clientSecret;
    private readonly HttpClient _httpClient;

    public ZTXClient(string clientId, string clientSecret, string baseUrl = "https://ztxbas01.corezt.com")
    {
        _clientId = clientId;
        _clientSecret = clientSecret;
        _httpClient = new HttpClient { BaseAddress = new Uri(baseUrl) };
    }

    private Dictionary<string, string> SignRequest(string method, string endpoint, string body)
    {
        var timestamp = DateTimeOffset.UtcNow.ToUnixTimeSeconds().ToString();
        var nonce = Convert.ToHexString(RandomNumberGenerator.GetBytes(32)).ToLower();
        
        var signData = $"{method}|{endpoint}|{timestamp}|{nonce}|{body}";
        
        using var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(_clientSecret));
        var signature = Convert.ToHexString(hmac.ComputeHash(Encoding.UTF8.GetBytes(signData))).ToLower();

        return new Dictionary<string, string>
        {
            ["X-Client-ID"] = _clientId,
            ["X-Timestamp"] = timestamp,
            ["X-Nonce"] = nonce,
            ["X-Signature"] = signature
        };
    }

    public async Task<UserDeregistrationResponse> DeregisterUserAsync(string email)
    {
        var endpoint = "/api/v1/users/deregister";
        var body = JsonSerializer.Serialize(new { email });
        var headers = SignRequest("POST", endpoint, body);

        var request = new HttpRequestMessage(HttpMethod.Post, endpoint)
        {
            Content = new StringContent(body, Encoding.UTF8, "application/json")
        };

        foreach (var header in headers)
        {
            request.Headers.Add(header.Key, header.Value);
        }

        var response = await _httpClient.SendAsync(request);
        response.EnsureSuccessStatusCode();
        
        var json = await response.Content.ReadAsStringAsync();
        return JsonSerializer.Deserialize<UserDeregistrationResponse>(json);
    }
}

public class UserDeregistrationResponse
{
    public bool Success { get; set; }
    public string Message { get; set; }
}

// Usage
var client = new ZTXClient("your-client-id", "your-client-secret");

var result = await client.DeregisterUserAsync("user@example.com");
Console.WriteLine($"Result: {result.Message}");

---

When to Deregister

Account Deletion

def delete_user_account(user):
    # Deregister from ZTXBAS first
    try:
        ztx_client.deregister_user(user.email)
    except Exception as e:
        # Log but don't block account deletion
        log.warning(f"ZTXBAS deregistration failed: {e}")
    
    # Delete from your system
    user.delete()

Disabling MFA

def disable_ztx_authentication(user):
    # Deregister from ZTXBAS
    ztx_client.deregister_user(user.email)
    
    # Update user preferences
    user.mfa_enabled = False
    user.mfa_method = None
    user.save()

GDPR Data Deletion Request

def handle_gdpr_deletion_request(user):
    # Deregister from all external services
    ztx_client.deregister_user(user.email)
    
    # Remove from your system
    anonymize_user_data(user)

---

Notes

• Idempotent: Safe to call multiple times
• No Cascade: Only removes the user-client association; user's ZTXBAS app and other integrations are unaffected
• Immediate Effect: User cannot authenticate via ZTXBAS for your app immediately after deregistration