When you deactivate a user, Parallel transfers their parallels, templates and other resources to the user that you choose. API tokens and webhooks are different: they stay with the deactivated user and stop working. They never go to another user.
What happens to API tokens and webhooks
API tokens: Parallel rejects every request made with a token of a deactivated user.
Webhooks (event subscriptions): they stop sending events.
When you deactivate a user who has API tokens or webhooks, the deactivation window shows a warning with the number of tokens and webhooks that will stop working.
If you reactivate the user later, their tokens and webhooks work again.
Why we don't transfer them
Transferring an integration to another user looks convenient, but it creates security risks:
An API token is a credential. The person who created it can still have a copy, for example in a script, in an automation tool or on their computer. If the token moved to another user, that person would keep access to Parallel after they leave your organization, and with the permissions of the new user.
A webhook sends data to an address that the deactivated user chose. If the webhook moved to another user, that address would start to receive the events of everything the new user can access. This can be much more information than before, sent to an address that your organization may not control.
Traceability. Everything that the integration did after the transfer would appear as an action of the new user, although that user never set it up.
For these reasons, Parallel doesn't transfer them automatically. Keeping an integration must be an explicit decision, made by someone who knows where the integration runs and who can access it.
How to keep an integration running
If an integration of the user that you want to deactivate must keep working, set it up again with another user. We recommend that you do it before you deactivate the user, so the integration doesn't stop.
Choose the user that will own the integration. We recommend a service user that doesn't belong to a person, for example integrations@yourcompany.com, with only the permissions that the integration needs. This way, the integration doesn't depend on any employee. See Planning permissions before starting an integration via Zapier.
Create a new API token with that user, in Settings > Developers. See Manage tokens to access the API.
Create the webhooks again with that user, in Settings > Developers, with the same URL and the same events. If your system verifies the signatures of the events, add the signature keys too. See Manage event subscriptions and signature keys.
Update your system or your automation tool (for example Zapier or Make): replace the old token with the new one and, if you verify signatures, replace the old public key with the new one.
Check that the integration works: make a call with the new token, and check that the new webhook receives events.
Deactivate the user. Their old tokens and webhooks stop working.
Frequently asked questions
Can I transfer a token or a webhook to another user?
No. Create a new token or a new webhook with the user that will own the integration, as described above.
Are the old tokens and webhooks deleted?
No. They stay with the deactivated user and don't work. If you reactivate the user, they work again.
What is transferred when I deactivate a user?
Their parallels and templates, the automatic assignments of templates and their profile subscriptions. Their drafts are transferred only if you select Include drafts; otherwise, they are deleted. See How to deactivate a user.
If you have any questions, contact us through the chat.