> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt
> Use this file to discover all available pages before exploring further.

# Revoke a Role from one Group

> Takes a role away from one group. `{id}` is the ROLE and `{groupId}` is the GROUP — both are slugs, so the order of the two is the only thing telling them apart, and swapping them revokes a grant nobody asked to revoke.

The batch form, `POST /v1/roles/{id}/groups/remove`, does the same for a list.

The group itself is untouched and keeps its members. Revoking from a group that does not hold the role is not an error. On success the response has no body (204).

Failures:
- `404` — no such role in your organization.
- `422 IDE-1067` — the role is declared by a Lerian product, which alone decides the groups it is granted to, and the group holds it. Change who has the access by adding or removing people on the role itself, or in a group the product grants it to. A role reserved for machine credentials stays open to revoke.
- `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later.



## OpenAPI

````yaml /en/openapi/v3-current/AM-identity.yaml delete /v1/roles/{id}/groups/{groupId}
openapi: 3.1.0
info:
  contact:
    name: Lerian Studio
    url: https://lerian.studio
  description: OpenAPI 3.1 surface for the Access Manager identity component.
  license:
    name: Lerian Studio General License
  title: Plugin Access Manager — Identity API
  version: v1
servers:
  - url: https://identity.sandbox.lerian.net
security: []
tags:
  - description: >-
      M2M-only: each plugin declares its own permissions, roles and M2M
      contract, and the server reconciles them.
    name: Declarations
  - description: >-
      A tenant administrator's customers. Each partner holds what its
      credentials may DO (permissions, per product) and WHERE they may do it
      (scope, per product and dimension); an M2M application attached to one is
      confined to that intersection. Administrator-only: authorized on the
      "partners" resource, and every route resolves the owning organization from
      the caller's token.
    name: Partners
paths:
  /v1/roles/{id}/groups/{groupId}:
    delete:
      tags:
        - Roles
      summary: Revoke a Role from one Group
      description: >-
        Takes a role away from one group. `{id}` is the ROLE and `{groupId}` is
        the GROUP — both are slugs, so the order of the two is the only thing
        telling them apart, and swapping them revokes a grant nobody asked to
        revoke.


        The batch form, `POST /v1/roles/{id}/groups/remove`, does the same for a
        list.


        The group itself is untouched and keeps its members. Revoking from a
        group that does not hold the role is not an error. On success the
        response has no body (204).


        Failures:

        - `404` — no such role in your organization.

        - `422 IDE-1067` — the role is declared by a Lerian product, which alone
        decides the groups it is granted to, and the group holds it. Change who
        has the access by adding or removing people on the role itself, or in a
        group the product grants it to. A role reserved for machine credentials
        stays open to revoke.

        - `503 IDE-0066` — the identity provider is unavailable (unreachable,
        too slow to answer, or failing). Nothing about the request was wrong;
        retry it later.
      operationId: revokeRoleFromGroup
      parameters:
        - description: Role ID.
          in: path
          name: id
          required: true
          schema:
            description: Role ID.
            examples:
              - midaz-editor
            type: string
        - description: Group ID.
          in: path
          name: groupId
          required: true
          schema:
            description: Group ID.
            examples:
              - midaz-viewer-group
            type: string
      responses:
        '204':
          description: No Content
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPError'
          description: Bad Request
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPError'
          description: Not Found
        '422':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPError'
          description: Unprocessable Entity
        '500':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPError'
          description: Internal Server Error
        '503':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPError'
          description: Service Unavailable
      security:
        - BearerAuth: []
components:
  schemas:
    HTTPError:
      additionalProperties: false
      properties:
        code:
          type: string
        entityType:
          type: string
        err: {}
        message:
          type: string
        title:
          type: string
      type: object
  securitySchemes:
    BearerAuth:
      bearerFormat: JWT
      description: JWT bearer token issued by the identity provider.
      scheme: bearer
      type: http

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.