authz

Revoke Assignment

Revoke a role x scope assignment from a tenant member.

Tenant-scoped (ADR 0016 code fix): an assignment id belonging to a different tenant answers 404 assignment.not_found, indistinguishable from an unknown id — no cross-tenant existence leak. An admin may revoke up to admin; only an owner may revoke an owner assignment. The last owner of a tenant cannot be revoked (self-lockout guard, re-pointed from the old "last tenant admin" rule). Every revocation is recorded in the tamper-evident audit trail (UC-039) with the token's azp/act/tier.

delete/v1/tenant/members/{sub}/assignments/{id}

Request

  • Base URL: https://api.4chems.com (the document declares no server; this is the origin it was published from)
  • URL: https://api.4chems.com/v1/tenant/members/{sub}/assignments/{id}
  • Auth: HTTP bearer

Path parameters

substring required
idstring uuid required

Query parameters

tenant_idstring nullable

Response

Successful Response

Changes

No recorded changes to this operation across all 1 revision of this API.