---
title: "Revoke Membership"
method: DELETE
path: "/users/{user_id}/memberships/{company_id}"
tags: ["users"]
---

# Revoke Membership

`DELETE /users/{user_id}/memberships/{company_id}`

## Request

- Base URL: `https://app.zeno-works.ch` (the document declares no server; this is the origin it was published from)
- URL: `https://app.zeno-works.ch/users/{user_id}/memberships/{company_id}`
- Auth: none declared

Remove one company membership from a user (admin).

The subtractive counterpart to ``PUT /users/{id}`` — same reasoning as its sibling
above: taking one tenant away should not require restating every other one.

**Not idempotent, deliberately.** Revoking a membership that does not exist answers
404, not 204. Access removal is the one operation where "it already looked done" and
"it is done" must not read the same: an operator revoking the wrong company id, or the
right one on the wrong person, needs to be told nothing happened.

``{company_id}`` in the path puts this route inside the support-session confinement
sweep (``test_support_session_confinement_gate.py``). It satisfies it through
``ScopedDep``, and its real refusal is ``require_admin``'s ``deny_support_session``:
a confined operator has no business editing platform memberships at all. Do not move
this handler off ``ScopedDep``.

## Path parameters

- `user_id` string, required
- `company_id` string, required

## Headers

- `authorization` string, nullable

## Cookies

- `access_token` string, nullable

## Response `200`

Successful Response

- UserResponse: ``GET/POST/PUT /users/...`` → ``{"user": ...}``.
  - `user` UserOut, required: Serialized user (no secrets). ``companies`` is an array of company ids; ``memberships`` adds the per-membership role.
    - `id` string, required
    - `first_name` string, required
    - `last_name` string, required
    - `email` string, email, required
    - `phone` string, nullable
    - `is_admin` boolean, required
    - `is_active` boolean, required
    - `ui_language` string, nullable
    - `companies` string[]
    - `memberships` MembershipOut[]
      - `company_id` string, required
      - `role` 'owner' | 'accountant' | 'member', required
  - `invite_mail_attempted` boolean, nullable

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/zeno-works/apis/zeno-api.md) · [All operations](https://skmtc.dev/zeno-works/apis/zeno-api/llms.txt) · [OpenAPI document](https://skmtc.dev/zeno-works/apis/zeno-api/revisions/1eb93dde146c?raw)