Remove role assignments
curl --request DELETE \
--url https://api.opal.dev/v1/role-assignments \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"role_assignments": [
{
"entity_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"entity_type": "GROUP",
"principal_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"principal_type": "GROUP",
"access_level_remote_id": "<string>"
}
]
}
'import requests
url = "https://api.opal.dev/v1/role-assignments"
payload = { "role_assignments": [
{
"entity_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"entity_type": "GROUP",
"principal_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"principal_type": "GROUP",
"access_level_remote_id": "<string>"
}
] }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.delete(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'DELETE',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
role_assignments: [
{
entity_id: '3c90c3cc-0d44-4b50-8888-8dd25736052a',
entity_type: 'GROUP',
principal_id: '3c90c3cc-0d44-4b50-8888-8dd25736052a',
principal_type: 'GROUP',
access_level_remote_id: '<string>'
}
]
})
};
fetch('https://api.opal.dev/v1/role-assignments', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.opal.dev/v1/role-assignments",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "DELETE",
CURLOPT_POSTFIELDS => json_encode([
'role_assignments' => [
[
'entity_id' => '3c90c3cc-0d44-4b50-8888-8dd25736052a',
'entity_type' => 'GROUP',
'principal_id' => '3c90c3cc-0d44-4b50-8888-8dd25736052a',
'principal_type' => 'GROUP',
'access_level_remote_id' => '<string>'
]
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.opal.dev/v1/role-assignments"
payload := strings.NewReader("{\n \"role_assignments\": [\n {\n \"entity_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"entity_type\": \"GROUP\",\n \"principal_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"principal_type\": \"GROUP\",\n \"access_level_remote_id\": \"<string>\"\n }\n ]\n}")
req, _ := http.NewRequest("DELETE", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.delete("https://api.opal.dev/v1/role-assignments")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"role_assignments\": [\n {\n \"entity_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"entity_type\": \"GROUP\",\n \"principal_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"principal_type\": \"GROUP\",\n \"access_level_remote_id\": \"<string>\"\n }\n ]\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.opal.dev/v1/role-assignments")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Delete.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"role_assignments\": [\n {\n \"entity_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"entity_type\": \"GROUP\",\n \"principal_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"principal_type\": \"GROUP\",\n \"access_level_remote_id\": \"<string>\"\n }\n ]\n}"
response = http.request(request)
puts response.read_body{
"task_ids": [
"<string>"
],
"entries": [
{
"role_assignment": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"entity_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"entity_type": "GROUP",
"principal_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"principal_type": "GROUP",
"access_level": {
"access_level_name": "AdminRole",
"access_level_remote_id": "arn:aws:iam::590304332660:role/AdministratorAccess"
},
"expiration": "2023-11-07T05:31:56Z",
"granted_at": "2023-11-07T05:31:56Z"
}
}
]
}Remove role assignments
Revoke one or more role assignments. Each entry identifies a specific
stored grant by the 5-tuple (entity_id, entity_type, principal_id, principal_type, access_level_remote_id) — see the field description
on access_level_remote_id for when it must be supplied and when it
must be omitted. The call is idempotent: an entry that does not match
any stored grant is silently skipped and absent from entries in the
response. Caller must have EDIT_ASSIGNMENTS on each entity.
DELETE
/
role-assignments
Remove role assignments
curl --request DELETE \
--url https://api.opal.dev/v1/role-assignments \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"role_assignments": [
{
"entity_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"entity_type": "GROUP",
"principal_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"principal_type": "GROUP",
"access_level_remote_id": "<string>"
}
]
}
'import requests
url = "https://api.opal.dev/v1/role-assignments"
payload = { "role_assignments": [
{
"entity_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"entity_type": "GROUP",
"principal_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"principal_type": "GROUP",
"access_level_remote_id": "<string>"
}
] }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.delete(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'DELETE',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
role_assignments: [
{
entity_id: '3c90c3cc-0d44-4b50-8888-8dd25736052a',
entity_type: 'GROUP',
principal_id: '3c90c3cc-0d44-4b50-8888-8dd25736052a',
principal_type: 'GROUP',
access_level_remote_id: '<string>'
}
]
})
};
fetch('https://api.opal.dev/v1/role-assignments', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.opal.dev/v1/role-assignments",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "DELETE",
CURLOPT_POSTFIELDS => json_encode([
'role_assignments' => [
[
'entity_id' => '3c90c3cc-0d44-4b50-8888-8dd25736052a',
'entity_type' => 'GROUP',
'principal_id' => '3c90c3cc-0d44-4b50-8888-8dd25736052a',
'principal_type' => 'GROUP',
'access_level_remote_id' => '<string>'
]
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.opal.dev/v1/role-assignments"
payload := strings.NewReader("{\n \"role_assignments\": [\n {\n \"entity_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"entity_type\": \"GROUP\",\n \"principal_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"principal_type\": \"GROUP\",\n \"access_level_remote_id\": \"<string>\"\n }\n ]\n}")
req, _ := http.NewRequest("DELETE", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.delete("https://api.opal.dev/v1/role-assignments")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"role_assignments\": [\n {\n \"entity_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"entity_type\": \"GROUP\",\n \"principal_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"principal_type\": \"GROUP\",\n \"access_level_remote_id\": \"<string>\"\n }\n ]\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.opal.dev/v1/role-assignments")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Delete.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"role_assignments\": [\n {\n \"entity_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"entity_type\": \"GROUP\",\n \"principal_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"principal_type\": \"GROUP\",\n \"access_level_remote_id\": \"<string>\"\n }\n ]\n}"
response = http.request(request)
puts response.read_body{
"task_ids": [
"<string>"
],
"entries": [
{
"role_assignment": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"entity_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"entity_type": "GROUP",
"principal_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"principal_type": "GROUP",
"access_level": {
"access_level_name": "AdminRole",
"access_level_remote_id": "arn:aws:iam::590304332660:role/AdministratorAccess"
},
"expiration": "2023-11-07T05:31:56Z",
"granted_at": "2023-11-07T05:31:56Z"
}
}
]
}Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Body
application/json
Request body for DELETE /role-assignments.
Required array length:
1 - 100 elementsShow child attributes
Show child attributes
Response
The role assignments were revoked (or did not exist; see idempotency note).
Response body for DELETE /role-assignments.
Opaque identifiers for the push tasks enqueued to propagate the revocation to the end system. Encoded identically to the PushTaskId scalar in the GraphQL API (base64 of the underlying protobuf). One ID per deferred revocation (today, resource/user grants are always deferred); empty when every revocation completed inline (resource/group, group/user, group/group).
One entry per role assignment that was removed inline. Shorter than the request when some assignments did not exist (idempotent), and empty when every revocation in the batch was deferred to an async propagation task — in that case task_ids carries one ID per deferred revocation and entries is empty. Resource/user grants are currently always deferred; the other (entity, principal) combinations complete inline and populate entries.
Show child attributes
Show child attributes
Was this page helpful?