How to remove badges from a user in Zoho Desk

Removing badges from a Help Center user in Zoho Desk is done via a single authenticated DELETE request against the Zoho Desk API, targeting the badges sub-resource on a specific user record.

Why this matters

Badges in Zoho Desk's Help Center are awarded to community users as recognition for participation and contributions. There are times — such as account resets, policy changes, or data corrections — when an administrator needs to revoke those badges programmatically. Knowing the correct API endpoint and required parameters saves time and avoids accidental changes to unrelated user data.

> Note: Beam Help is an independent expert support resource, not official Zoho support.

---

Step-by-step

Step 1. Confirm your OAuth credentials and scopes.

Before making any API call, ensure your connected Zoho Desk application has the appropriate OAuth scopes authorised. At minimum, your integration should include Desk.settings.ALL or the relevant settings-level permissions, since badge management falls under Help Center configuration. ^[3]

Step 2. Identify your helpcenterid and userid.

You will need two path parameters before constructing the request:

• helpcenter_id — the unique identifier for the Help Center portal where the user is registered.
• user_id — the unique identifier for the specific Help Center user whose badges you want to remove.

Both values can be retrieved from earlier API calls (for example, listing Help Center users). Store them securely before proceeding. ^[1]

Step 3. Obtain a valid access token.

Your integration must hold a current OAuth access token. If the token has expired, use your stored refresh token to obtain a new one before calling the badges endpoint. The token refresh flow exchanges the refresh token for a fresh access token and updates the expiry timestamp accordingly. ^[4]

Step 4. Send the DELETE request.

Issue an HTTP DELETE to the following endpoint, substituting your actual IDs:

DELETE /api/v1/helpcenter/{helpcenter_id}/users/{user_id}/badges

Include your access token in the Authorization header. If you need to pass additional filter or selection parameters (for example, specifying which badges to remove), supply them via the optional p dictionary as query parameters. ^[1]

A minimal Python example using the Zoho Desk client wrapper looks like this:

response = desk_api.remove_badges_from_user(
    helpcenter_id="your_helpcenter_id",
    user_id="your_user_id",
    p={}  # add badge-specific params here if required
)

^[1]

Step 5. Handle the API response.

A successful deletion will return an appropriate HTTP success status. If the response indicates an error, check that both IDs are correct and that your token has not expired. Log the full response body for troubleshooting.

---

Common pitfalls

• Mixing up user endpoints. The badges endpoint (/users/{userid}/badges) is distinct from the labels endpoint (/users/{userid}/labels). Sending a DELETE to the labels path will remove labels, not badges — a different operation entirely. ^[1][2]
• Wrong resource direction. There is also a separate endpoint for removing users from under a label (/labels/{label_id}/users), which operates in the opposite direction. Make sure you are calling the correct path for your use case. ^[8]
• Missing or expired access token. If your token has lapsed, the API will reject the request. Always verify the token expiry before making destructive calls, and implement a refresh flow to handle this automatically. ^[4]
• Undefined p parameter behaviour. The p parameter is optional, but omitting it entirely versus passing an empty dictionary may behave differently depending on your client implementation. Pass p={} explicitly when no additional parameters are needed. ^[1]

---

What to check

• Verify the helpcenterid and userid are correct by first retrieving the user record and confirming the badge data is present before issuing the DELETE.
• Confirm the response status indicates success and that a subsequent GET on the user record no longer shows the removed badges.
• Review your OAuth scopes to ensure the token used for this call includes the necessary Desk settings permissions, otherwise the request will be rejected at the authorisation layer. ^[3]