---
title: "Cancel a pending enrollment or revoke only its linked grants"
method: DELETE
path: "/buzz-agent-enrollments/v1/{buzz_agent_enrollment_id}"
tags: ["Buzz Control Plane"]
---

# Cancel a pending enrollment or revoke only its linked grants

`DELETE /buzz-agent-enrollments/v1/{buzz_agent_enrollment_id}`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/buzz-agent-enrollments/v1/{buzz_agent_enrollment_id}`
- Auth: one of:
  - API key in header `SIGN-IN-WITH-X`
  - HTTP bearer

## Path parameters

- `buzz_agent_enrollment_id` string, required

## Headers

- `Idempotency-Key` string, required

## Response `200`

Retained cancelled/revoked enrollment with exact grant effect count

- BuzzAgentEnrollment
  - `buzz_agent_enrollment_id` string, required
  - `buzz_community_installation_id` string, required
  - `org_id` string, uuid, required: A Run402 organization id, exactly as returned by GET /agent/v1/whoami, GET /orgs/v1 and GET /projects/v1. Buzz owns no organizations of its own.
  - `requesting_agent_principal_id` string
  - `identity_link_id` string
  - `identity_public_subject` string
  - `status` 'pending' | 'active' | 'denied' | 'expired' | 'cancelled' | 'revoked', required
  - `requested_grants` BuzzProjectGrantRequest[], required
    - `project_id` string, required
    - `capability` 'read' | 'deploy' | 'project:archives:export' | 'functions:write' | 'secrets:read' | 'secrets:write' | 'domains:write' | 'mailbox:write', required
    - `policy` object
    - `expires_at` string, date-time, required
  - `approved_grants` BuzzProjectGrantRequest[], nullable
    - `project_id` string, required
    - `capability` 'read' | 'deploy' | 'project:archives:export' | 'functions:write' | 'secrets:read' | 'secrets:write' | 'domains:write' | 'mailbox:write', required
    - `policy` object
    - `expires_at` string, date-time, required
  - `project_grant_ids` string[], required
  - `identity_evidence` object, required
  - `installation_descriptor_revision` integer, required
  - `installation_policy_revision` integer, required
  - `expires_at` string, date-time, required
  - `decided_by_principal_id` string, nullable
  - `decision_reason` string, nullable
  - `activated_at` string, date-time, nullable
  - `denied_at` string, date-time, nullable
  - `expired_at` string, date-time, nullable, required
  - `cancelled_at` string, date-time, nullable
  - `revoked_at` string, date-time, nullable
  - `created_at` string, date-time, required
  - `updated_at` string, date-time, required
  - `drift` object[], required
  - `next_actions` BuzzNextAction[], required
    - `type` string, required
    - `method` 'GET' | 'POST' | 'PATCH' | 'DELETE'
    - `path` string
    - `field` string: Exact rejected request field or header when the repair is field-specific.
    - `auth` string, required
    - `why` string, required
    - `safe_to_auto_execute` boolean, required
    - `requires_approval` boolean, required
    - `destructive` boolean, required
    - `idempotent` boolean, required
    - `spend_impact` object, required
      - `currency` 'USD', required
      - `max_amount` '0', required
  - `revoked_project_grant_count` integer

## Other responses

- `403`: Canonical Buzz control-plane error. Authorization is existence-obscuring; proof failures never consume a challenge or partially create authority.
- `409`: Canonical Buzz control-plane error. Authorization is existence-obscuring; proof failures never consume a challenge or partially create authority.

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/893607557f50?raw)