curl --request POST \
--url https://api.opal.dev/v1/users/{user_id}/revoke-all \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.opal.dev/v1/users/{user_id}/revoke-all"
headers = {"Authorization": "Bearer <token>"}
response = requests.post(url, headers=headers)
print(response.text)const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.opal.dev/v1/users/{user_id}/revoke-all', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.opal.dev/v1/users/{user_id}/revoke-all",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.opal.dev/v1/users/{user_id}/revoke-all"
req, _ := http.NewRequest("POST", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.opal.dev/v1/users/{user_id}/revoke-all")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.opal.dev/v1/users/{user_id}/revoke-all")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"success": true
}Revoke all of a user's access
Immediately removes all of a user’s access across connected systems, regardless of the user’s status in the identity provider. Intended for incident response, e.g. a security tool reacting to a compromised account. Ends the user’s Opal sessions, deletes their Opal API tokens and third-party tokens, revokes their MCP OAuth grants, removes their direct group, access rule and resource access (pushing the removals to the connected systems), and cancels their pending access requests. Recorded as a USER_ACCESS_REVOKED event with the caller as the actor.
This does not lock the user out, and the revocation does not last on its own. The user and their accounts in connected systems are kept, and they can sign in again through your identity provider. Access granted by Opal access rules is granted again on the next access rule sync while the user still matches the rule, and memberships that identity provider rules control return on the next identity provider sync. To keep the user’s access revoked, also disable or deprovision them in your identity provider. With the organization setting that revokes access for deprovisioned users turned on, Opal then offboards them and stops granting them access through access rules.
Also not removed: membership in groups computed by a connected system (e.g. dynamic groups), access to unmanaged groups and resources, and the user’s owner and reviewer roles. Removal from connected systems runs asynchronously; a 200 response means the removals were started, not that every connected system has finished. A removal that failed permanently before is retried. A removal that is already in progress is left to finish and is not started again, so check its propagation status if it stays pending.
curl --request POST \
--url https://api.opal.dev/v1/users/{user_id}/revoke-all \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.opal.dev/v1/users/{user_id}/revoke-all"
headers = {"Authorization": "Bearer <token>"}
response = requests.post(url, headers=headers)
print(response.text)const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.opal.dev/v1/users/{user_id}/revoke-all', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.opal.dev/v1/users/{user_id}/revoke-all",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.opal.dev/v1/users/{user_id}/revoke-all"
req, _ := http.NewRequest("POST", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.opal.dev/v1/users/{user_id}/revoke-all")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.opal.dev/v1/users/{user_id}/revoke-all")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"success": true
}Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Path Parameters
The ID of the user whose access should be revoked.
Response
The user's access removal was started.
Was this page helpful?