Skip to main content
DELETE
Remove role assignments

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Body

application/json

Request body for DELETE /role-assignments.

role_assignments
object[]
required
Required array length: 1 - 100 elements

Response

The role assignments were revoked (or did not exist; see idempotency note).

Response body for DELETE /role-assignments.

task_ids
string[]
required

Opaque identifiers for the push tasks enqueued to propagate the revocation to the end system. Encoded identically to the PushTaskId scalar in the GraphQL API (base64 of the underlying protobuf). One ID per deferred revocation (today, resource/user grants are always deferred); empty when every revocation completed inline (resource/group, group/user, group/group).

entries
object[]
required

One entry per role assignment that was removed inline. Shorter than the request when some assignments did not exist (idempotent), and empty when every revocation in the batch was deferred to an async propagation task — in that case task_ids carries one ID per deferred revocation and entries is empty. Resource/user grants are currently always deferred; the other (entity, principal) combinations complete inline and populate entries.