---
title: "Revoke Assignment"
method: DELETE
path: "/v1/tenant/members/{sub}/assignments/{id}"
tags: ["authz"]
---

# Revoke Assignment

`DELETE /v1/tenant/members/{sub}/assignments/{id}`

## Request

- Base URL: `https://api.4chems.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.4chems.com/v1/tenant/members/{sub}/assignments/{id}`
- Auth: HTTP bearer

Revoke a role x scope assignment from a tenant member.

Tenant-scoped (ADR 0016 code fix): an assignment id belonging to a
different tenant answers `404 assignment.not_found`, indistinguishable
from an unknown id — no cross-tenant existence leak. An `admin` may
revoke up to `admin`; only an `owner` may revoke an `owner` assignment.
The last `owner` of a tenant cannot be revoked (self-lockout guard,
re-pointed from the old "last tenant admin" rule). Every revocation is
recorded in the tamper-evident audit trail (UC-039) with the token's
`azp`/`act`/`tier`.

## Path parameters

- `sub` string, required
- `id` string, uuid, required

## Query parameters

- `tenant_id` string, nullable

## Response `204`

Successful Response

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/4chems/apis/platform-api.md) · [All operations](https://skmtc.dev/4chems/apis/platform-api/llms.txt) · [OpenAPI document](https://skmtc.dev/4chems/apis/platform-api/revisions/65e4f7b4dba0?raw)