To deactivate a user, the field enabled = false must be set via the "Create or update multiple users at once" request. As soon as a user is reactivated via enabled = true, he or she is given access to the previous files and contents of the app again.

Users can be deleted with the "Delete multiple users at once using their externalId" request. The user then no longer has access to files and contents of the app.