---
title: "Revoke role from user"
method: DELETE
path: "/zones/{zoneId}/users/{userId}/roles/{roleId}"
tags: ["Zone Roles"]
---

# Revoke role from user

`DELETE /zones/{zoneId}/users/{userId}/roles/{roleId}`

## Request

- Base URL: `https://docs.keycard.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://docs.keycard.ai/zones/{zoneId}/users/{userId}/roles/{roleId}`
- Auth: one of:
  - HTTP bearer
  - OAuth 2
    - Client credentials
    - Token URL: `/service-account-token`

Revokes a role from the user. Provide the same (scope_type, scope_id) pair the grant was created with, or omit both to revoke the unscoped grant.

## Path parameters

- `zoneId` string, required
- `userId` string, required
- `roleId` string, required

## Query parameters

- `scope_type` string
- `scope_id` string

## Response `204`

Default Response

## Other responses

- `400`: Error response
- `404`: Error response
- `409`: Error response
- `default`: Error response

## Changes

- **2026-08-26** `d65d51379d93`: 2 breaking, 3 info
  - for the `query` request parameter `scope_id`, the minLength was increased from `0` to `1`
  - for the `query` request parameter `scope_type`, the minLength was increased from `0` to `1`
  - added the non-success response with the status `400`
  - added the non-success response with the status `404`
  - …1 more
- **2026-06-09** `7e0e4fa2e16f`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/keycardai/apis/untitled-api/changes/zones/:zoneId/users/:userId/roles/:roleId/delete.md)

---

[API](https://skmtc.dev/keycardai/apis/untitled-api.md) - [All operations](https://skmtc.dev/keycardai/apis/untitled-api/llms.txt) - [OpenAPI document](https://skmtc.dev/keycardai/apis/untitled-api/revisions/0dee67e0a73a?raw)