Blocked User Does not Exist Under User Management

A user is blocked due to brute-force protection, but the user's account does not appear in the Auth0 Dashboard under User Management > Users.

• Auth0

• Brute-Force Protection

• User Management

Brute-force protection is triggered after a specific number of failed attempts to prevent enumeration attacks. This block occurs regardless of whether the user exists in the Auth0 Dashboard under User Management > Users.

This situation can occur for several reasons:

• The user mistyped their email address during the sign-in attempt.

• The user attempted to sign in with an email address that is not registered.

• During a bot attack, an unregistered email address is used repeatedly, causing the system to block the identifier before an account is created.

1. Use the Auth0 Management API Get blocks by identifier endpoint to retrieve the blocks for the given identifier (for example, the user's email).

2. An example GET request:

   GET api/v2/user-blocks?identifier=<user@email.com>
   

3. If the block is found, unblock the user by using the Management API Unblock by identifier endpoint by sending the identifier (username, phone number, or email).

4. An example DELETE request:

   DELETE api/v2/user-blocks?identifier=<user@email.com>