Revoke Access

Endpoint: DELETE /api/auth/authorization

Removes access from a user, group, or role over a specific resource.

Request body

Parameter	Description	Type	Required/ Optional
subject.type	The type of subject whose access is being revoked. Supported values: user: A user in Orkes Conductor. role: A system/custom role. group: A group in Orkes Conductor.	string	Required.
subject.id	The identifier of the subject. For the type user, it must be the email. For the type role, it must be the role name. For example, ADMIN. For the type group, it must be the group name in Conductor.	string	Required.
target.type	The resource type from which access is being revoked. Supported values: WORKFLOW_DEF TASK_DEF SECRET_NAME APPLICATION INTEGRATION_PROVIDER PROMPT WORKFLOW_SCHEDULE EVENT_HANDLER WEBHOOK ENV_VARIABLE SCHEMA TAG	string	Required.
target.id	The unique identifier of the resource (e.g., the workflow name) to revoke access from.	string	Required.
access	The set of access types to revoke. Supported values: READ CREATE UPDATE DELETE EXECUTE	array of strings	Required.

Response

Returns a confirmation message.

Examples

Revoke a user’s READ and EXECUTE access to a workflow definition

Request

curl -X 'DELETE' \
  'https://<YOUR-SERVER-URL>/api/auth/authorization' \
  -H 'accept: application/json' \
  -H 'X-Authorization: <TOKEN>' \
  -H 'Content-Type: application/json' \
  -d '{
    "subject": {
      "type": "user",
      "id": "jane.doe@acme.com"
    },
    "target": {
      "type": "WORKFLOW_DEF",
      "id": "rate_limit_test"
    },
    "access": ["READ", "EXECUTE"]
  }
'

Response

This revokes the user’s READ and EXECUTE access over the workflow named rate_limit_test.

{
  "message": "Removed permission"
}