How to quickly delete all users in a tenant for frequent test environment resets?

FASupportBot

I'm running a FusionAuth migration in the cloud where we need to frequently sync user data into non-production environments. Each sync requires wiping all users from a tenant and re-importing a fresh set — sometimes with millions of users.

Currently using Delete Users by Query with hardDelete: true and queryString: registrations.applicationId:<id>, but running into issues:

Getting 504 timeouts even with a limit of 1500 users per request
Observing CloudFront terminating requests after 30 seconds, though the delete likely continues server-side
Best measured throughput is ~15 seconds per 1,000 users, which would take hours for full user delete of millions of users
Retries feel risky since we have no visibility into how many users were actually removed before the timeout

Questions:

Is there a faster path to zero users than query-based bulk delete — ideally close to instantaneous?
Is Delete Users by Query driven by the search index?
Would deleting and recreating the tenant itself be faster?
What are recommended approaches for maintaining user parity across multiple environments with large user populations?

FASupportBot

For frequent, large-scale user resets in test environments, deleting and recreating the tenant is the recommended approach over bulk user deletion. While there's no "near-instant" bulk deletion method, tenant recreation is significantly faster than iterative bulk deletes at scale.

Key Points About Bulk Delete

Delete Users by Query is driven by the search index (specifically Elasticsearch). The queryString parameter has limited support when using the database as the search engine (only simple single-term searches on basic fields like firstName, lastName, fullName, email, and username).
CloudFront has a 30-second timeout for origin responses, which explains the 504 errors you're seeing
The delete operation likely continues on the FusionAuth side even after CloudFront terminates the connection, making retries risky

Recommended Approach: Tenant Delete/Recreate

For test environments with large user populations, follow this workflow:

Cannot delete the Default tenant — the default tenant contains the FusionAuth application and cannot be deleted. Create separate tenants for testing purposes.
Delete the test tenant when ready to reset using the admin UI or the Delete Tenant API. This will permanently delete all users, applications, and groups belonging to that tenant.
Use docker compose down -v to fully clean the environment
Use docker compose up -d to restart
Use Kickstart to automatically recreate tenants, applications, and API keys

Kickstart will only run on an empty instance, so the down -v step is necessary. Configure a Kickstart file with your test environment configuration (tenants, applications, API keys) for reproducible deployments.

Note that tenant deletion is an asynchronous operation (as of FusionAuth 1.22), meaning it runs in the background. For very large tenants (2M users), this will still take time but is considerably faster than bulk deleting millions of users through the API.

Note on Import Timeouts

If you're also seeing CloudFront timeouts during large batch imports (e.g., 100k users), the same 30-second CloudFront limit applies. Consider reducing batch sizes when users have multiple registrations, as each registration inserts additional rows into related tables (registrations, application role mappings, etc.), significantly increasing processing time. For best import performance, minimize network hops and consider setting validateDbConstraints to false.

How to quickly delete all users in a tenant for frequent test environment resets?

Key Points About Bulk Delete

Recommended Approach: Tenant Delete/Recreate

Note on Import Timeouts

Related Documentation