OPopal
role-assignments

Remove role assignments

Changed on

Revoke one or more role assignments. Each entry identifies a specific stored grant by the 5-tuple (entity_id, entity_type, principal_id, principal_type, access_level_remote_id) — see the field description on access_level_remote_id for when it must be supplied and when it must be omitted. The call is idempotent: an entry that does not match any stored grant is silently skipped and absent from entries in the response. Caller must have EDIT_ASSIGNMENTS on each entity.

delete/role-assignments

Request

  • Base URL
    https://api.opal.dev/v1
  • Auth
    HTTP bearer

Request body

Example request

{
  "role_assignments": [
    {
      "entity_type": "GROUP",
      "principal_type": "GROUP"
    }
  ]
}

Response

The role assignments were revoked (or did not exist; see idempotency note).

task_idsstring[] required

Opaque identifiers for the push tasks enqueued to propagate the revocation to the end system. Encoded identically to the PushTaskId scalar in the GraphQL API (base64 of the underlying protobuf). One ID per deferred revocation (today, resource/user grants are always deferred); empty when every revocation completed inline (resource/group, group/user, group/group).

Example response

{
  "entries": [
    {
      "role_assignment": {
        "entity_type": "GROUP",
        "principal_type": "GROUP",
        "access_level": {
          "access_level_name": "AdminRole",
          "access_level_remote_id": "arn:aws:iam::590304332660:role/AdministratorAccess"
        }
      }
    }
  ]
}

Changes