Manage end users

Find end users by their host application ID and stop or restore embedded access when needed. Each action applies to that user within the current organization and agent.

Prepare and choose an action

You need a service agent with an embed policy, organization management access, and the external_user_id used at issuance. Verify actions with an isolated test user first. Revocation and blocking interrupt that user's ongoing conversations.

Goal	Action	Subsequent access
End access through existing credentials	Revoke tokens	Revokes all existing tokens for this user; the host can issue new ones
Continue refusing access	Block	Revokes existing tokens and rejects new issuance
Allow issuance again	Unblock	Allows new issuance; previously revoked tokens remain revoked

To revoke just one token, use token management instead of user-wide revocation.

Find and manage a user

Open Service agents → Select agent → Operations → End users (终端用户). Labels describe the current Chinese Dashboard.
Enter an ID in Search by end-user ID prefix (按终端用户 ID 前缀搜索). The table shows first seen, last active, session count, cost and status.
Click the user ID to open details. Check Recent sessions (最近会话) to confirm the intended user.
Click Revoke tokens (吊销令牌), Block (封禁) or Unblock (解封) in the row or details. Verify the ID in the dialog and confirm the action.

Expected: Revocation reports “已吊销 N 张” (N tokens revoked). Blocking changes the status to “已封禁”; unblocking changes it to “正常”. These actions do not delete the user's session or cost records.

Verify the access boundary

After revocation, access with an old token must fail. The host can issue a new token after checking the user's login again. After blocking, issuance must return EMBED_USER_BLOCKED (HTTP 403). After unblocking, issue a new token and send a message. A revoked token must not become valid again.

Check that another user's access to this agent remains unaffected. Derive identity from the host's authenticated server session, not an arbitrary ID submitted by the browser.

Handle failures

If a user cannot be found, verify the organization, public agent ID and complete ID used at issuance. Dashboard Playground data is excluded from customer user listings. Similar ID prefixes do not establish identity.

If blocking fails, read the state again before retrying. The blocked state may already be saved while token revocation remains incomplete. Do not report the operation as complete in that case. Record the HTTP status and request ID, then use Limits and errors.

Next steps

Inspect sessions and usage · Test your embed · Agent API · Cookbook