> ## Documentation Index > Fetch the complete documentation index at: https://docs.opal.dev/llms.txt > Use this file to discover all available pages before exploring further. # Revoke all of a user's access > Immediately removes all of a user's access across connected systems, regardless of the user's status in the identity provider. Intended for incident response, e.g. a security tool reacting to a compromised account. Ends the user's Opal sessions, deletes their Opal API tokens and third-party tokens, revokes their MCP OAuth grants, removes their direct group, access rule and resource access (pushing the removals to the connected systems), and cancels their pending access requests. Recorded as a USER_ACCESS_REVOKED event with the caller as the actor. This does not lock the user out, and the revocation does not last on its own. The user and their accounts in connected systems are kept, and they can sign in again through your identity provider. Access granted by Opal access rules is granted again on the next access rule sync while the user still matches the rule, and memberships that identity provider rules control return on the next identity provider sync. To keep the user's access revoked, also disable or deprovision them in your identity provider. With the organization setting that revokes access for deprovisioned users turned on, Opal then offboards them and stops granting them access through access rules. Also not removed: membership in groups computed by a connected system (e.g. dynamic groups), access to unmanaged groups and resources, and the user's owner and reviewer roles. Removal from connected systems runs asynchronously; a 200 response means the removals were started, not that every connected system has finished. A removal that failed permanently before is retried. A removal that is already in progress is left to finish and is not started again, so check its propagation status if it stays pending. ## OpenAPI ````yaml https://app.opal.dev/openapi.yaml post /users/{user_id}/revoke-all openapi: 3.1.0 info: contact: email: hello@opal.dev name: Opal Team url: https://www.opal.dev/ description: >- The Opal API is a RESTful API that allows you to interact with the Opal Security platform programmatically. title: Opal API version: '1.0' servers: - description: Production url: https://api.opal.dev/v1 security: [] tags: - name: access-rules description: Operations related to access rules - name: agent-activity description: Operations related to agent activity telemetry - name: apps description: Operations related to apps - name: bundles description: Operations related to bundles - name: campaigns description: Operations related to access review campaigns - name: configuration-templates description: Operations related to configuration templates - name: delegations description: Operations related to request reviewer delegations - name: event-streams description: Operations related to event streaming connections - name: events description: Operations related to events - name: groups description: Operations related to groups - name: group-bindings description: Operations related to group bindings - name: idp-group-mappings description: Operations related to IDP group mappings - name: message-channels description: Operations related to message channels - name: non-human-identities description: Operations related to non-human identities - name: on-call-schedules description: Operations related to on-call schedules - name: opal-queries description: Operations related to OpalQuery - name: opal-scripts description: Operations related to OpalScripts - name: owners description: Operations related to owners - name: requests description: Operations related to requests - name: resources description: Operations related to resources - name: role-assignments description: >- Operations related to role assignments (general grants between an entity and a principal) - name: paladin description: Operations related to Paladin - name: service-users description: Operations related to service users (non-human identities owned by a team) - name: sessions description: Operations related to sessions - name: tags description: Operations related to tags - name: tokens description: Operations related to API tokens - name: uars description: Operations related to UARs. Deprecated in favor of the `campaigns` API. - name: users description: Operations related to users paths: /users/{user_id}/revoke-all: post: tags: - users summary: Revoke all of a user's access description: > Immediately removes all of a user's access across connected systems, regardless of the user's status in the identity provider. Intended for incident response, e.g. a security tool reacting to a compromised account. Ends the user's Opal sessions, deletes their Opal API tokens and third-party tokens, revokes their MCP OAuth grants, removes their direct group, access rule and resource access (pushing the removals to the connected systems), and cancels their pending access requests. Recorded as a USER_ACCESS_REVOKED event with the caller as the actor. This does not lock the user out, and the revocation does not last on its own. The user and their accounts in connected systems are kept, and they can sign in again through your identity provider. Access granted by Opal access rules is granted again on the next access rule sync while the user still matches the rule, and memberships that identity provider rules control return on the next identity provider sync. To keep the user's access revoked, also disable or deprovision them in your identity provider. With the organization setting that revokes access for deprovisioned users turned on, Opal then offboards them and stops granting them access through access rules. Also not removed: membership in groups computed by a connected system (e.g. dynamic groups), access to unmanaged groups and resources, and the user's owner and reviewer roles. Removal from connected systems runs asynchronously; a 200 response means the removals were started, not that every connected system has finished. A removal that failed permanently before is retried. A removal that is already in progress is left to finish and is not started again, so check its propagation status if it stays pending. operationId: revokeAllUserAccess parameters: - description: The ID of the user whose access should be revoked. example: 32acc112-21ff-4669-91c2-21e27683eaa1 in: path name: user_id required: true schema: type: string format: uuid style: simple responses: '200': description: The user's access removal was started. content: application/json: schema: type: object properties: success: type: boolean required: - success '400': description: The request body contained unknown JSON fields. '403': description: The caller is not authorized to delete this user. '404': description: The user was not found. '409': description: > The Opal system user cannot be modified, or the user is the last direct Opal admin. Their API tokens, third-party tokens and MCP OAuth grants are still revoked and their pending requests still canceled in that case. security: - BearerAuth: [] components: securitySchemes: BearerAuth: scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.