> ## Documentation Index > Fetch the complete documentation index at: https://docs.opal.dev/llms.txt > Use this file to discover all available pages before exploring further. # Remove role assignments > Revoke one or more role assignments. Each entry identifies a specific stored grant by the 5-tuple `(entity_id, entity_type, principal_id, principal_type, access_level_remote_id)` — see the field description on `access_level_remote_id` for when it must be supplied and when it must be omitted. The call is idempotent: an entry that does not match any stored grant is silently skipped and absent from `entries` in the response. Caller must have `EDIT_ASSIGNMENTS` on each entity. ## OpenAPI ````yaml https://app.opal.dev/openapi.yaml delete /role-assignments openapi: 3.1.0 info: contact: email: hello@opal.dev name: Opal Team url: https://www.opal.dev/ description: >- The Opal API is a RESTful API that allows you to interact with the Opal Security platform programmatically. title: Opal API version: '1.0' servers: - description: Production url: https://api.opal.dev/v1 security: [] tags: - name: access-rules description: Operations related to access rules - name: agent-activity description: Operations related to agent activity telemetry - name: apps description: Operations related to apps - name: bundles description: Operations related to bundles - name: campaigns description: Operations related to access review campaigns - name: configuration-templates description: Operations related to configuration templates - name: delegations description: Operations related to request reviewer delegations - name: event-streams description: Operations related to event streaming connections - name: events description: Operations related to events - name: groups description: Operations related to groups - name: group-bindings description: Operations related to group bindings - name: idp-group-mappings description: Operations related to IDP group mappings - name: message-channels description: Operations related to message channels - name: non-human-identities description: Operations related to non-human identities - name: on-call-schedules description: Operations related to on-call schedules - name: opal-queries description: Operations related to OpalQuery - name: opal-scripts description: Operations related to OpalScripts - name: owners description: Operations related to owners - name: requests description: Operations related to requests - name: resources description: Operations related to resources - name: role-assignments description: >- Operations related to role assignments (general grants between an entity and a principal) - name: paladin description: Operations related to Paladin - name: service-users description: Operations related to service users (non-human identities owned by a team) - name: sessions description: Operations related to sessions - name: tags description: Operations related to tags - name: tokens description: Operations related to API tokens - name: uars description: Operations related to UARs. Deprecated in favor of the `campaigns` API. - name: users description: Operations related to users paths: /role-assignments: delete: tags: - role-assignments summary: Remove role assignments description: | Revoke one or more role assignments. Each entry identifies a specific stored grant by the 5-tuple `(entity_id, entity_type, principal_id, principal_type, access_level_remote_id)` — see the field description on `access_level_remote_id` for when it must be supplied and when it must be omitted. The call is idempotent: an entry that does not match any stored grant is silently skipped and absent from `entries` in the response. Caller must have `EDIT_ASSIGNMENTS` on each entity. operationId: removeRoleAssignments requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/RemoveRoleAssignmentsRequest' responses: '200': content: application/json: schema: $ref: '#/components/schemas/RemoveRoleAssignmentsResponse' description: >- The role assignments were revoked (or did not exist; see idempotency note). '400': description: The request body was malformed or failed schema validation. '403': description: Caller lacks `EDIT_ASSIGNMENTS` on one or more entities. '422': description: Business validation rejected the request. security: - BearerAuth: [] components: schemas: RemoveRoleAssignmentsRequest: description: Request body for `DELETE /role-assignments`. type: object required: - role_assignments properties: role_assignments: type: array minItems: 1 maxItems: 100 items: $ref: '#/components/schemas/RemoveRoleAssignmentInput' RemoveRoleAssignmentsResponse: description: Response body for `DELETE /role-assignments`. type: object required: - task_ids - entries properties: task_ids: type: array items: type: string description: >- Opaque identifiers for the push tasks enqueued to propagate the revocation to the end system. Encoded identically to the `PushTaskId` scalar in the GraphQL API (base64 of the underlying protobuf). One ID per deferred revocation (today, resource/user grants are always deferred); empty when every revocation completed inline (resource/group, group/user, group/group). entries: type: array items: $ref: '#/components/schemas/RemoveRoleAssignmentsEntry' description: >- One entry per role assignment that was removed inline. Shorter than the request when some assignments did not exist (idempotent), and empty when every revocation in the batch was deferred to an async propagation task — in that case `task_ids` carries one ID per deferred revocation and `entries` is empty. Resource/user grants are currently always deferred; the other `(entity, principal)` combinations complete inline and populate `entries`. RemoveRoleAssignmentInput: description: A single role assignment to revoke. type: object required: - entity_id - entity_type - principal_id - principal_type properties: entity_id: description: The ID of the entity (resource or group) to revoke access from. format: uuid type: string entity_type: $ref: '#/components/schemas/EntityTypeEnum' principal_id: description: The ID of the principal (user, group, or resource) losing access. format: uuid type: string principal_type: $ref: '#/components/schemas/EntityTypeEnum' access_level_remote_id: type: string nullable: true description: | Remote ID of the specific access-level grant to revoke. The lookup is exact-match on this value against stored grants. Required when the entity has access levels defined (the server returns 422 if omitted or sent as `null`/empty for such an entity). Must be omitted or `null` for entities with no access-level catalog (group memberships and resources that have no defined access levels); supplying a value in that case also returns 422. These rules mirror those of `POST /v1/role-assignments`. A specified value that does not match any stored grant for this `(entity_id, principal_id)` pair is a successful idempotent no-op: HTTP 200 is returned and the entry is absent from `entries`. RemoveRoleAssignmentsEntry: description: A single revoked role assignment in a `RemoveRoleAssignmentsResponse`. type: object required: - role_assignment properties: role_assignment: $ref: '#/components/schemas/RoleAssignment' EntityTypeEnum: description: The type of an entity. enum: - GROUP - RESOURCE - USER example: GROUP type: string RoleAssignment: description: >- A role assignment representing access granted to a principal for an entity. type: object required: - id - entity_id - entity_type - principal_id - principal_type properties: id: description: Unique identifier for the role assignment. format: uuid type: string entity_id: description: The ID of the entity (resource or group) being accessed. format: uuid type: string entity_type: $ref: '#/components/schemas/EntityTypeEnum' principal_id: description: The ID of the principal being granted access. format: uuid type: string principal_type: $ref: '#/components/schemas/EntityTypeEnum' access_level: description: >- The level of access granted. Null when the entity does not define access levels. allOf: - $ref: '#/components/schemas/ResourceAccessLevel' nullable: true expiration: description: When this access expires. Null when the grant is indefinite. format: date-time nullable: true type: string granted_at: description: When this access was first granted. format: date-time nullable: true type: string ResourceAccessLevel: description: >- # Access Level Object ### Description The `AccessLevel` object is used to represent the level of access that a principal has. The "default" access level is a `AccessLevel` object whose fields are all empty strings. ### Usage Example View the `AccessLevel` of a resource/user or resource/group pair to see the level of access granted to the resource. example: access_level_name: AdminRole access_level_remote_id: arn:aws:iam::590304332660:role/AdministratorAccess properties: access_level_name: description: The human-readable name of the access level. example: AdminRole type: string access_level_remote_id: description: The machine-readable identifier of the access level. example: arn:aws:iam::590304332660:role/AdministratorAccess type: string required: - access_level_name - access_level_remote_id type: object securitySchemes: BearerAuth: scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.