---
title: "Revoke a session share"
method: DELETE
path: "/sessions/{sessionId}/shares"
tags: ["Sessions"]
---

# Revoke a session share

`DELETE /sessions/{sessionId}/shares`

## Request

- Base URL: `https://elicit.com/api/v2`
- URL: `https://elicit.com/api/v2/sessions/{sessionId}/shares`
- Auth: HTTP bearer

Revoke a direct session share or pending invitation by email, regardless of permission level. Only the session owner can revoke shares.

**Warning:** this endpoint revokes readers, editors, and reviewers. It is not limited to the read-only entries returned by GET on this path: an editor or reviewer omitted from that list still loses their direct share when their email is deleted. Inspect higher-permission collaborators in the web interface before revoking access.

The operation is idempotent: when the email has no direct share or pending invitation, it returns `revoked: false` with `200 OK`. Absence from the read-only share list alone does not imply there is nothing to revoke.

### Example

```bash
curl -X DELETE https://elicit.com/api/v2/sessions/{sessionId}/shares \
  -H "Authorization: Bearer elk_live_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{"email":"colleague@example.com"}'
```

## Path parameters

- `sessionId` string, uuid, required: The session ID (UUID) returned by the create endpoints and `GET /sessions`

## Request body

- object
  - `email` string, email, required: Email address whose direct share or pending invite should be revoked, at any role. This can remove editor/reviewer permissions even when the email is absent from the read-only share list.

## Response `200`

The share was revoked, or there was nothing to revoke (idempotent).

- DeleteSessionShareResponse
  - `sessionId` string, required: Unique identifier for the session.
  - `email` string, required: Email address whose share was revoked.
  - `revoked` boolean, required: Whether an existing direct share or pending invite was removed, regardless of role (reader, editor, or reviewer). False when nothing was removed; absence from the read-only share list does not imply false. Repeating the call is idempotent.

## Other responses

- `400`: The request body, query parameters, or path ID failed validation.
- `401`: Authentication failed. The API key is missing, invalid, revoked, or expired.
- `403`: API access is not available on your current plan. Upgrade to Pro or above to use the API.
- `404`: The session does not exist or is not accessible to you for this operation.
- `429`: Rate limit exceeded. More than 100 requests per minute were received from your IP address; further requests are blocked for 5 minutes.
- `500`: An unexpected error occurred. Retry reads with backoff; before retrying a write, check whether it took effect. See Error Handling for retry guidance.

## Changes

- **2026-10-16** `22847bf7e65d`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/elicitlabs/apis/elicit-labs-api/changes/sessions/:sessionId/shares/delete.md)

---

[API](https://skmtc.dev/elicitlabs/apis/elicit-labs-api.md) - [All operations](https://skmtc.dev/elicitlabs/apis/elicit-labs-api/llms.txt) - [OpenAPI document](https://skmtc.dev/elicitlabs/apis/elicit-labs-api/revisions/cbbe29509d04?raw)