[claude]

Requested by Cemal Kilic · Slack thread

Before: openapi.yaml says DELETE /admin/users/{userId} returns 200 with a UserSchema ("User's account data.") and documents no request body.

After: The spec documents what the endpoint actually returns, an empty {} body, plus the optional should_soft_delete request body.

This fixes the OpenAPI entry for DELETE /admin/users/{userId} so generated clients and docs match the server.

How: The adminUserDelete handler in internal/api/admin.go always responds with sendJSON(w, http.StatusOK, map[string]interface{}{}) for hard delete, soft delete, and already-soft-deleted users. It optionally reads a JSON body with should_soft_delete. The spec change adds an optional requestBody with should_soft_delete (boolean, default false) and replaces the 200 schema with type: object, additionalProperties: false, example: {}. Only openapi.yaml changes, and only this one operation. No Go changes.

Overlaps with the DELETE /admin/users/{userId} hunk in #2866 (credit to haranishi); this is a narrow version so that endpoint can land independently. Context: supabase/supabase-js#2758.

🤖 Generated with Claude Code

https://claude.ai/code/session_0137vz1dKsd2RZigEqmeo8N3

---

Generated by Claude Code

[claude]

The failing check "Test / Postgres" fails in make vulncheck (govulncheck), not in any Go test: 12 newly published advisories in the Go 1.27.0 stdlib, golang.org/x/net v0.58.0 and go.opentelemetry.io/otel v1.44.0 are unignored by hack/vulncheck-filter. This PR only changes openapi.yaml, so it is unrelated; the same job passed on another PR earlier today (run 38514004158). A re-run would fail the same way, so I haven't triggered one. A partial fix is in #2858 (otel v1.45.0 only); the rest needs a separate toolchain/dependency bump (Go 1.27.2, x/net v0.60.0) or temporary ignores in the filter. I'm keeping this PR scoped to the spec change.

---

Generated by Claude Code