From 0d51f2dbe515238328ed089a137c372f7bcbaabb Mon Sep 17 00:00:00 2001
From: Matthias Mair <code@mjmair.com>
Date: Wed, 27 May 2026 03:12:53 +0200
Subject: [PATCH] !refactor(backend): remove legacy user endpoints (#11985)

* realign user API endpoints (#11963)

* realign user API endpoints to make it clearer which one are only applicable to the current user

* fix name

* bump api

* fix test

* fix reference

* fix test exception

* update ref

* reduce breakage

* re-add legacy urls till next `breaking`

(cherry picked from commit 9908870a81ee3036d7217797c2cf38ccd477e25f)

* remove fallback

* fix style

* fix style

* fix performance test
---
 CHANGELOG.md                       |  1 +
 src/backend/InvenTree/users/api.py | 20 --------------------
 src/performance/tests.py           |  4 ++--
 3 files changed, 3 insertions(+), 22 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6242bb4037..b2a9bf5eb6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,6 +13,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - [#11111](https://github.com/inventree/InvenTree/pull/11111) - removes legacy metadata APIs
 - [#9814](https://github.com/inventree/InvenTree/pull/9814) - removes legacy config path support
 - [#11667](https://github.com/inventree/InvenTree/pull/11667) - removes legacy url patterns
+- [#11985](https://github.com/inventree/InvenTree/pull/11985) - removes legacy user endpoint fallback
 
 
 ## Unreleased - YYYY-MM-DD
diff --git a/src/backend/InvenTree/users/api.py b/src/backend/InvenTree/users/api.py
index 13ef2fa501..fb2a2fc0b5 100644
--- a/src/backend/InvenTree/users/api.py
+++ b/src/backend/InvenTree/users/api.py
@@ -33,7 +33,6 @@ from InvenTree.mixins import (
     SerializerContextMixin,
     UpdateAPI,
 )
-from InvenTree.schema import exclude_from_schema
 from InvenTree.settings import FRONTEND_URL_BASE
 from users.models import ApiToken, Owner, RuleSet, UserProfile
 from users.serializers import (
@@ -502,25 +501,6 @@ class UserProfileDetail(RetrieveUpdateAPI):
 
 
 user_urls = [
-    # Legacy endpoints (to avoid breaking existing API clients)
-    # TODO @matmair - remove these legacy endpoints in the next breaking release
-    path(
-        'roles/',
-        exclude_from_schema(RoleDetails, '/api/user/me/roles/').as_view(),
-        name='api-user-roles_legacy',
-    ),
-    path(
-        'token/',
-        ensure_csrf_cookie(
-            exclude_from_schema(GetAuthToken, '/api/user/me/token/').as_view()
-        ),
-        name='api-token_legacy',
-    ),
-    path(
-        'profile/',
-        exclude_from_schema(UserProfileDetail, '/api/user/me/profile/').as_view(),
-        name='api-user-profile_legacy',
-    ),
     # Individual user endpoints
     path(
         'me/',
diff --git a/src/performance/tests.py b/src/performance/tests.py
index db2dd8896c..e05c32391a 100644
--- a/src/performance/tests.py
+++ b/src/performance/tests.py
@@ -50,7 +50,7 @@ def test_api_auth_performance():
         '/api/order/so/shipment/',
         #'/api/order/po/',
         #'/api/order/po-line/',
-        '/api/user/roles/',
+        '/api/user/me/roles/',
         '/api/parameter/',
         '/api/parameter/template/',
     ],
@@ -77,7 +77,7 @@ def test_api_list_performance(url):
         '/api/order/so/shipment/',
         '/api/order/po/',
         '/api/order/po-line/',
-        '/api/user/roles/',
+        '/api/user/me/roles/',
         '/api/parameter/',
         '/api/parameter/template/',
     ],