Revoke Grants for a Subject

Available since

• v5.4.2 and later

Endpoint: DELETE /api/auth/subjects/{subjectType}/{subjectId}/grants

Revokes all per-instance grants for a subject. Optionally scoped to a specific resource type. Useful for cleanup when a role-level permission is revoked and the associated per-instance grants need to be cleared as well.

Path parameters

Parameter	Description	Type	Required/ Optional
subjectType	The type of subject whose grants are being revoked. Supported values: USER: A user in Orkes Conductor. ROLE: A system/custom role. GROUP: A group in Orkes Conductor.	string	Required.
subjectId	The unique identifier of the subject (e.g., user email, role name, or group name).	string	Required.

Query parameters

Parameter	Description	Type	Required/ Optional
resourceType	Filter the revocation by resource type. If not specified, all per-instance grants across all resource types are revoked for the subject. Supported values: WORKFLOW WORKFLOW_DEF WORKFLOW_SCHEDULE EVENT_HANDLER TASK_DEF TASK_REF_NAME TASK_ID APPLICATION USER SECRET_NAME ENV_VARIABLE TAG DOMAIN INTEGRATION_PROVIDER INTEGRATION PROMPT USER_FORM_TEMPLATE SCHEMA CLUSTER_CONFIG WEBHOOK API_GATEWAY_SERVICE API_GATEWAY_SERVICE_ROUTE AUTH_CONFIG GROUP ROLE SERVICE_REGISTRY	string	Optional.

Response

Returns a confirmation message.

Examples

Revoke grants for a subject

Request

curl -X 'DELETE' \
  'https://<YOUR-SERVER-URL>/api/auth/subjects/USER/jane.doe%40acme.com/grants?resourceType=WORKFLOW_DEF' \
  -H 'accept: application/json' \
  -H 'X-Authorization: <TOKEN>'

Response

{
  "message": "Revoked grants"
}