Remove a role's grant

Revokes a role's grant on an object, removing every privilege and column mask it carried.

DELETE /v1/tenants/{tenant}/db/grants

Remove a complete role-and-object grantRevocation succeeds even when that grant is already absent.

Identify the role and objectSelect the exact permission grant.
Revoke the grantRemove all its privileges and column masks.
Review remaining effective accessOther grants and inherited roles may still apply.

Before you start

Use your database bearer token.

Connection setup

Use an identity authorized to manage access. Send the target role and object in the DELETE request's JSON body.

Path parameters

Field	Type	Required
`tenant`	`string`	Required

Headers

Field	Type	Required	Description
`x-oc-db-user`	`string`	Optional	Acting database user (role, grant and row-policy checks). Send with x-oc-db-key.
`x-oc-db-key`	`string`	Optional	API key of the x-oc-db-user user.

Request body

application/json

Limits and accepted values

Sent as a JSON body on DELETE (not a query string).
Removes the whole grant row;
there is no partial-privilege revoke.
Succeeds even when no such grant exists.

Field	Type	Required
`object`	`string`	Required
`role`	`string`	Required

Read the result

revoked: true also succeeds if the grant was absent. This removes the whole role/object grant, including masks; it is not a partial removal of one privilege.

Response statuses

HTTP status reference

Status	What to do
200	OK
400	Correct the request before retrying.
401	Check the credential and Authorization header.
402	Check feature access or available credits.
403	Check tenant access, roles and permissions.
409	Resolve the conflict before retrying.
413	Split or reduce the request body.
415	Send the required Content-Type.
422	Correct the values or unsupported combination.
429	Honor Retry-After when present; back off.
500	Check the outcome before retrying a write.
501	Check deployment support for this operation.
503	Honor Retry-After when present; check write outcomes.

Request example

curl --include --request DELETE "${OC_BASE_URL}/v1/tenants/${OC_TENANT}/db/grants" \
  --header "Authorization: Bearer ${OC_TOKEN}" \
  --header "Content-Type: application/json" \
  --data-binary '{
  "role": "demo_reader",
  "object": "demo.people"
}'

Response example

Examples use synthetic values to show the response format.

Response status

{
  "revoked": true
}

Download the OpenAPI specification for the complete response schemas.

Before you startCopy Anchor Link

Path parametersCopy Anchor Link

HeadersCopy Anchor Link

Request bodyCopy Anchor Link