Revoke a grant
DELETE/rbac/grants/:identifier
Soft-deletes the grant. Sends an access-revoked notification email to the recipient.
- Refuses to revoke the last Admin grant in the entity (RBAC_CANNOT_REVOKE_LAST_OWNER).
- Only Admins may revoke Admin grants (RBAC_PERMISSION_DENIED).
- Attempting to revoke an already-revoked grant returns 409 (RBAC_GRANT_ALREADY_REVOKED).
- Wrong-entity grants look identical to missing ones (404) — anti-enumeration.
Requires GRANT_DELETE permission.
Request
Responses
- 204
- 401
- 403
- 404
- 409
Grant revoked
Missing/invalid JWT or entity selection
GRANT_DELETE permission missing, or caller is not an Admin when revoking an Admin grant (RBAC_PERMISSION_DENIED)
Grant not found in this entity (RBAC_GRANT_NOT_FOUND)
RBAC_GRANT_ALREADY_REVOKED — already soft-deleted; RBAC_CANNOT_REVOKE_LAST_OWNER — would leave entity with zero Admins