---
title: "Delete ACLs"
method: DELETE
path: "/v1/acls"
tags: ["Redpanda ACLs"]
---

# Delete ACLs

`DELETE /v1/acls`

Delete all ACLs that match the filter criteria. The `filter.` query string parameters find matching ACLs that meet all specified conditions.

## Query parameters

- `filter.resource_type` 'RESOURCE_TYPE_ANY' | 'RESOURCE_TYPE_TOPIC' | 'RESOURCE_TYPE_GROUP' | 'RESOURCE_TYPE_CLUSTER' | 'RESOURCE_TYPE_TRANSACTIONAL_ID' | 'RESOURCE_TYPE_DELEGATION_TOKEN' | 'RESOURCE_TYPE_USER' | 'RESOURCE_TYPE_REGISTRY' | 'RESOURCE_TYPE_SUBJECT', required
- `filter.resource_name` string
- `filter.resource_pattern_type` 'RESOURCE_PATTERN_TYPE_ANY' | 'RESOURCE_PATTERN_TYPE_MATCH' | 'RESOURCE_PATTERN_TYPE_LITERAL' | 'RESOURCE_PATTERN_TYPE_PREFIXED', required
- `filter.principal` string
- `filter.host` string
- `filter.operation` 'OPERATION_ANY' | 'OPERATION_ALL' | 'OPERATION_READ' | 'OPERATION_WRITE' | 'OPERATION_CREATE' | 'OPERATION_DELETE' | 'OPERATION_ALTER' | 'OPERATION_DESCRIBE' | 'OPERATION_CLUSTER_ACTION' | 'OPERATION_DESCRIBE_CONFIGS' | 'OPERATION_ALTER_CONFIGS' | 'OPERATION_IDEMPOTENT_WRITE' | 'OPERATION_CREATE_TOKENS' | 'OPERATION_DESCRIBE_TOKENS', required
- `filter.permission_type` 'PERMISSION_TYPE_ANY' | 'PERMISSION_TYPE_DENY' | 'PERMISSION_TYPE_ALLOW', required

## Response `200`

OK

- DeleteACLsResponse
  - `matching_acls` MatchingACL[]
    - `error` RpcStatus — The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors).
      - `code` 'OK' | 'CANCELLED' | 'UNKNOWN' | 'INVALID_ARGUMENT' | 'DEADLINE_EXCEEDED' | 'NOT_FOUND' | 'ALREADY_EXISTS' | 'PERMISSION_DENIED' | 'UNAUTHENTICATED' | 'RESOURCE_EXHAUSTED' | 'FAILED_PRECONDITION' | 'ABORTED' | 'OUT_OF_RANGE' | 'UNIMPLEMENTED' | 'INTERNAL' | 'UNAVAILABLE' | 'DATA_LOSS', int32 — RPC status code, as described [here](https://github.com/googleapis/googleapis/blob/b4c238feaa1097c53798ed77035bbfeb7fc72e96/google/rpc/code.proto#L32).
      - `details` union[]
        - union — Details of the error.
          - object — Describes violations in a client request. This error type focuses on the syntactic aspects of the request.
            - `@type` 'type.googleapis.com/google.rpc.BadRequest' — Fully qualified protobuf type name of the underlying response, prefixed with `type.googleapis.com/`.
            - `field_violations` FieldViolation[] — Describes all violations in a client request.
              - …
          - object — Describes the cause of the error with structured details. Example of an error when contacting the "pubsub.googleapis.com" API when it is not enabled: { "reason": "API_DISABLED" "domain": "googleapis.com" "metadata": { "resource": "projects/123", "service": "pubsub.googleapis.com" } } This response indicates that the pubsub.googleapis.com API is not enabled. Example of an error that is returned when attempting to create a Spanner instance in a region that is out of stock: { "reason": "STOCKOUT" "domain": "spanner.googleapis.com", "metadata": { "availableRegions": "us-central1,us-east2" } }
            - `@type` 'type.googleapis.com/google.rpc.ErrorInfo' — Fully qualified protobuf type name of the underlying response, prefixed with `type.googleapis.com/`.
            - `domain` string — The logical grouping to which the "reason" belongs. The error domain is typically the registered service name of the tool or product that generates the error. Example: "pubsub.googleapis.com". If the error is generated by some common infrastructure, the error domain must be a globally unique value that identifies the infrastructure. For Google API infrastructure, the error domain is "googleapis.com".
            - `metadata` object — Additional structured details about this error. Keys must match a regular expression of `[a-z][a-zA-Z0-9-_]+` but should ideally be lowerCamelCase. Also, they must be limited to 64 characters in length. When identifying the current value of an exceeded limit, the units should be contained in the key, not the value. For example, rather than `{"instanceLimit": "100/request"}`, should be returned as, `{"instanceLimitPerRequest": "100"}`, if the client exceeds the number of instances that can be created in a single (batch) request.
            - `reason` string — The reason of the error. This is a constant value that identifies the proximate cause of the error. Error reasons are unique within a particular domain of errors. This should be at most 63 characters and match a regular expression of `[A-Z][A-Z0-9_]+[A-Z0-9]`, which represents UPPER_SNAKE_CASE.
          - object — Describes how a quota check failed. For example if a daily limit was exceeded for the calling project, a service could respond with a QuotaFailure detail containing the project id and the description of the quota limit that was exceeded. If the calling project hasn't enabled the service in the developer console, then a service could respond with the project id and set `service_disabled` to true. Also see RetryInfo and Help types for other details about handling a quota failure.
            - `@type` 'type.googleapis.com/google.rpc.QuotaFailure' — Fully qualified protobuf type name of the underlying response, prefixed with `type.googleapis.com/`.
            - `violations` QuotaFailureViolation[] — Describes all quota violations.
              - …
          - object — Provides links to documentation or for performing an out of band action. For example, if a quota check failed with an error indicating the calling project hasn't enabled the accessed service, this can contain a URL pointing directly to the right place in the developer console to flip the bit.
            - `@type` 'type.googleapis.com/google.rpc.Help' — Fully qualified protobuf type name of the underlying response, prefixed with `type.googleapis.com/`.
            - `links` Link[] — URL(s) pointing to additional information on handling the current error.
              - …
      - `message` string — Detailed error message. No compatibility guarantees are given for the text contained in this message.
    - `host` string — The host address to use for this ACL.
    - `operation` 'OPERATION_ANY' | 'OPERATION_ALL' | 'OPERATION_READ' | 'OPERATION_WRITE' | 'OPERATION_CREATE' | 'OPERATION_DELETE' | 'OPERATION_ALTER' | 'OPERATION_DESCRIBE' | 'OPERATION_CLUSTER_ACTION' | 'OPERATION_DESCRIBE_CONFIGS' | 'OPERATION_ALTER_CONFIGS' | 'OPERATION_IDEMPOTENT_WRITE' | 'OPERATION_CREATE_TOKENS' | 'OPERATION_DESCRIBE_TOKENS' — The operation that is allowed or denied (e.g. READ).
    - `permission_type` 'PERMISSION_TYPE_ANY' | 'PERMISSION_TYPE_DENY' | 'PERMISSION_TYPE_ALLOW' — Whether the operation should be allowed or denied.
    - `principal` string — The user for whom this ACL applies.
    - `resource_name` string — The name of the resource this ACL targets.
    - `resource_pattern_type` 'RESOURCE_PATTERN_TYPE_ANY' | 'RESOURCE_PATTERN_TYPE_MATCH' | 'RESOURCE_PATTERN_TYPE_LITERAL' | 'RESOURCE_PATTERN_TYPE_PREFIXED' — The pattern to use for matching the specified resource_name (any, exact match, literal, or prefixed).
    - `resource_type` 'RESOURCE_TYPE_ANY' | 'RESOURCE_TYPE_TOPIC' | 'RESOURCE_TYPE_GROUP' | 'RESOURCE_TYPE_CLUSTER' | 'RESOURCE_TYPE_TRANSACTIONAL_ID' | 'RESOURCE_TYPE_DELEGATION_TOKEN' | 'RESOURCE_TYPE_USER' | 'RESOURCE_TYPE_REGISTRY' | 'RESOURCE_TYPE_SUBJECT' — The type of resource (topic, consumer group, etc.) this ACL targets.

## Other responses

- `401` — Unauthenticated.
- `500` — Internal Server Error. Reach out to support.
- `default` — An unexpected error response.

## Changes

- **2025-07-17** `34fe5c1a0856` — 2 warning, 2 info
  - added the new `RESOURCE_TYPE_REGISTRY` enum value to the `matching_acls/items/resource_type` response property for the response status `200`
  - added the new `RESOURCE_TYPE_SUBJECT` enum value to the `matching_acls/items/resource_type` response property for the response status `200`
  - added the new enum value `RESOURCE_TYPE_REGISTRY` to the `query` request parameter `filter.resource_type`
  - added the new enum value `RESOURCE_TYPE_SUBJECT` to the `query` request parameter `filter.resource_type`
- **2025-05-27** `dfa71f9d277e` — 2 breaking, 2 info
  - removed the enum value `RESOURCE_TYPE_REGISTRY` from the `query` request parameter `filter.resource_type`
  - removed the enum value `RESOURCE_TYPE_SUBJECT` from the `query` request parameter `filter.resource_type`
  - removed the `RESOURCE_TYPE_REGISTRY` enum value from the `matching_acls/items/resource_type` response property for the response status `200`
  - removed the `RESOURCE_TYPE_SUBJECT` enum value from the `matching_acls/items/resource_type` response property for the response status `200`

[Change history](https://skmtc.dev/redpanda-data/apis/redpanda-cloud-data-plane-api/changes/v1/acls/delete.md)

---

[API](https://skmtc.dev/redpanda-data/apis/redpanda-cloud-data-plane-api.md) · [All operations](https://skmtc.dev/redpanda-data/apis/redpanda-cloud-data-plane-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/redpanda-data/redpanda-cloud-data-plane-api/revisions/7eef0bcc42e7/schema)