---
title: "Remove a user role assignment."
method: DELETE
path: "/access-control/users/{userId}/roles/{roleUID}"
tags: ["access_control", "enterprise"]
---

# Remove a user role assignment.

`DELETE /access-control/users/{userId}/roles/{roleUID}`

## Request

- Base URL: `/api` (relative, and the document’s source URL is not known)
- URL: `/api/access-control/users/{userId}/roles/{roleUID}`
- Auth: one of:
  - HTTP basic
  - API key in header `Authorization`

Revoke a role from a user. For bulk updates consider Set user role assignments.

You need to have a permission with action `users.roles:remove` and scope `permissions:type:delegate`. `permissions:type:delegate` scope ensures that users can only unassign roles which have same, or a subset of permissions which the user has. For example, if a user does not have required permissions for creating users, they won’t be able to unassign a role which will allow to do that. This is done to prevent escalation of privileges.

## Path parameters

- `roleUID` string, required
- `userId` integer, required

## Query parameters

- `global` boolean

## Response `200`

An OKResponse is returned if the request was successful.

- SuccessResponseBody
  - `message` string

## Other responses

- `400`: BadRequestError is returned when the request is invalid and it cannot be processed.
- `403`: ForbiddenError is returned if the user/token has insufficient permissions to access the requested resource.
- `404`: NotFoundError is returned when the requested resource was not found.
- `500`: InternalServerError is a general error indicating something went wrong internally.

---

[API](https://skmtc.dev/grafana/apis/grafana-http-api.md) - [All operations](https://skmtc.dev/grafana/apis/grafana-http-api/llms.txt) - [OpenAPI document](https://skmtc.dev/grafana/apis/grafana-http-api/revisions/df55ba1718ba?raw)