---
title: "PATCH /v2/users/:user-id/rights"
method: PATCH
path: "/v2/users/{user-id}/rights"
---

# PATCH /v2/users/:user-id/rights

`PATCH /v2/users/{user-id}/rights`

Revoke rights from a user.
Revoking rights does not affect the resource version of the corresponding user.

## Path parameters

- `user-id` string, required

## Request body

- RevokeUserRightsRequest — Remove the rights from the set of rights granted to the user. Required authorization: ``HasRight(ParticipantAdmin) OR IsAuthenticatedIdentityProviderAdmin(identity_provider_id)``
  - `userId` string, required — The user from whom to revoke rights. Required
  - `rights` Right[] — The rights to revoke. Optional: can be empty
    - `kind` union — Required
      - object
        - `CanActAs` CanActAs, required
          - `value` CanActAs1, required
            - `party` string, required — The right to authorize commands for this party. Required
      - object
        - `CanExecuteAs` CanExecuteAs, required
          - `value` CanExecuteAs1, required
            - `party` string, required — The right to prepare and execute submissions as this party. This right does not entitle the user to perform any reads. If reading is required, a separate ReadAs right must be added. Right to execute as a party is also implicitly contained in the CanActAs right. Required
      - object
        - `CanExecuteAsAnyParty` CanExecuteAsAnyParty, required — The rights of a user to prepare and execute transactions as any party. Its utility is predominantly for users that perform interactive submissions on behalf of many parties.
          - `value` CanExecuteAsAnyParty1, required — The rights of a user to prepare and execute transactions as any party. Its utility is predominantly for users that perform interactive submissions on behalf of many parties.
      - object
        - `CanReadAs` CanReadAs, required
          - `value` CanReadAs1, required
            - `party` string, required — The right to read ledger data visible to this party. Required
      - object
        - `CanReadAsAnyParty` CanReadAsAnyParty, required — The rights of a participant's super reader. Its utility is predominantly for feeding external tools, such as PQS, continually without the need to change subscriptions as new parties pop in and out of existence.
          - `value` CanReadAsAnyParty1, required — The rights of a participant's super reader. Its utility is predominantly for feeding external tools, such as PQS, continually without the need to change subscriptions as new parties pop in and out of existence.
      - object
        - `Empty` Empty8, required
      - object
        - `IdentityProviderAdmin` IdentityProviderAdmin, required — The right to administer the identity provider that the user is assigned to. It means, being able to manage users and parties that are also assigned to the same identity provider.
          - `value` IdentityProviderAdmin1, required — The right to administer the identity provider that the user is assigned to. It means, being able to manage users and parties that are also assigned to the same identity provider.
      - object
        - `ParticipantAdmin` ParticipantAdmin, required — The right to administer the participant node.
          - `value` ParticipantAdmin1, required — The right to administer the participant node.
  - `identityProviderId` string — The id of the ``Identity Provider`` If not set, assume the user is managed by the default identity provider. Optional

## Response `200`

- RevokeUserRightsResponse
  - `newlyRevokedRights` Right[] — The rights that were actually revoked by the request. Optional: can be empty
    - `kind` union — Required
      - object
        - `CanActAs` CanActAs, required
          - `value` CanActAs1, required
            - `party` string, required — The right to authorize commands for this party. Required
      - object
        - `CanExecuteAs` CanExecuteAs, required
          - `value` CanExecuteAs1, required
            - `party` string, required — The right to prepare and execute submissions as this party. This right does not entitle the user to perform any reads. If reading is required, a separate ReadAs right must be added. Right to execute as a party is also implicitly contained in the CanActAs right. Required
      - object
        - `CanExecuteAsAnyParty` CanExecuteAsAnyParty, required — The rights of a user to prepare and execute transactions as any party. Its utility is predominantly for users that perform interactive submissions on behalf of many parties.
          - `value` CanExecuteAsAnyParty1, required — The rights of a user to prepare and execute transactions as any party. Its utility is predominantly for users that perform interactive submissions on behalf of many parties.
      - object
        - `CanReadAs` CanReadAs, required
          - `value` CanReadAs1, required
            - `party` string, required — The right to read ledger data visible to this party. Required
      - object
        - `CanReadAsAnyParty` CanReadAsAnyParty, required — The rights of a participant's super reader. Its utility is predominantly for feeding external tools, such as PQS, continually without the need to change subscriptions as new parties pop in and out of existence.
          - `value` CanReadAsAnyParty1, required — The rights of a participant's super reader. Its utility is predominantly for feeding external tools, such as PQS, continually without the need to change subscriptions as new parties pop in and out of existence.
      - object
        - `Empty` Empty8, required
      - object
        - `IdentityProviderAdmin` IdentityProviderAdmin, required — The right to administer the identity provider that the user is assigned to. It means, being able to manage users and parties that are also assigned to the same identity provider.
          - `value` IdentityProviderAdmin1, required — The right to administer the identity provider that the user is assigned to. It means, being able to manage users and parties that are also assigned to the same identity provider.
      - object
        - `ParticipantAdmin` ParticipantAdmin, required — The right to administer the participant node.
          - `value` ParticipantAdmin1, required — The right to administer the participant node.

## Other responses

- `400` — Invalid value, Invalid value for: body
- `default`

---

[API](https://skmtc.dev/canton/apis/json-ledger-api-http-endpoints.md) · [All operations](https://skmtc.dev/canton/apis/json-ledger-api-http-endpoints/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/canton/json-ledger-api-http-endpoints/revisions/296292e8b8f1/schema)