---
title: "Revoke Bucket Access"
method: POST
path: "/v2/bucket-access/datasets/{dataset_id}/revoke"
tags: ["Bucket Access"]
---

# Revoke Bucket Access

`POST /v2/bucket-access/datasets/{dataset_id}/revoke`

## Request

- Base URL: `https://api.carbonarc.co` (the document declares no server; this is the origin it was published from)
- URL: `https://api.carbonarc.co/v2/bucket-access/datasets/{dataset_id}/revoke`
- Auth: none declared

Revoke a principal's S3 bucket access by SKU.

Either principal_arn (revoke a specific ARN) or client_name (revoke all
ARNs registered for that client+dataset) must be provided. Idempotent —
revoking a principal that isn't currently granted returns revoked=True
with no policy change (mirrors the CLI behavior).

S3-only, like the grant path: ``log_access=False``, and CAMS removes the
admin_config access row and writes the ACCESS_REVOKED audit row (PLA-6141).

## Path parameters

- `dataset_id` string, required

## Request body

- RevokeBucketAccessRequest
  - `principal_arn` string, nullable: IAM principal ARN to revoke. Either principal_arn or client_name must be provided.
  - `client_name` string, nullable: Client name to revoke all ARNs for. Either principal_arn or client_name must be provided.
  - `lag` string, nullable: Lag of the dataset SKU. Null for the no-lag variant.
  - `cut` string, nullable: Cut of the dataset SKU. Null for the no-cut variant.

## Response `200`

Successful Response

- RevokeBucketAccessResponse
  - `dataset_id` string, required
  - `dataset_name` string, required
  - `lag` string, nullable, required
  - `cut` string, nullable, required
  - `principal_arn` string, nullable, required
  - `client_name` string, nullable, required
  - `revoked` boolean, required

## Other responses

- `400`: Malformed principal ARN, or missing required identifier.
- `403`: compliance_blocked: the SKU is restricted for this client.
- `404`: sku_not_found / bucket_not_registered: the SKU has no bucket in admin_config.bulk_bucket_details. Terminal — retrying cannot help.
- `409`: policy_apply_failed / policy_write_race: the bucket-policy write did not land. Transient — the caller should retry.
- `413`: policy_size_exceeded: the bucket policy hit AWS's 20KB limit.
- `422`: unknown_client: client_name is not in admin_config.clients.

## Changes

- **2026-08-21** `4850d81778a4`: 1 info
  - added the required property `dataset_name` to the response with the `200` status
- **2026-08-14** `fd615712e250`: 1 breaking, 4 info
  - removed the media type `application/json` for the response with the status `422`
  - added the non-success response with the status `400`
  - added the non-success response with the status `403`
  - added the non-success response with the status `409`
  - …1 more

[Operation history](https://skmtc.dev/carbonarc/apis/carbon-arc-api-documentation/changes/v2/bucket-access/datasets/:dataset_id/revoke/post.md)

---

[API](https://skmtc.dev/carbonarc/apis/carbon-arc-api-documentation.md) · [All operations](https://skmtc.dev/carbonarc/apis/carbon-arc-api-documentation/llms.txt) · [OpenAPI document](https://skmtc.dev/carbonarc/apis/carbon-arc-api-documentation/revisions/7362ca3a398d?raw)