> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt
> Use this file to discover all available pages before exploring further.

# Remove Permissions from a Role in Batch

> Narrows a role by several permissions at once, naming them in the body.

It is a POST rather than a DELETE because the permissions travel in a request body; `DELETE /v1/roles/{id}/permissions/{permId}` does the same for exactly one. Both exist and both are supported.

Removing an existing permission the role does not carry is not an error. On success the response has no body (204).

Failures:
- `400` — `permissions` is missing or empty.
- `404` — one of the permissions does not exist.
- `422 IDE-1066` — a permission holding the role is declared by a Lerian product, which alone decides the roles that hold it; the message names it. Change who has the access by adding or removing people on the role, or in a group it is granted to; a machine permission has no client-side change. Permissions earlier in the list are already removed.
- `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later.



## OpenAPI

````yaml /en/openapi/v3-current/AM-identity.yaml post /v1/roles/{id}/permissions/remove
openapi: 3.1.0
info:
  contact:
    name: Lerian Studio
    url: https://lerian.studio
  description: OpenAPI 3.1 surface for the Access Manager identity component.
  license:
    name: Lerian Studio General License
  title: Plugin Access Manager — Identity API
  version: v1
servers:
  - url: https://identity.sandbox.lerian.net
security: []
tags:
  - description: >-
      M2M-only: each plugin declares its own permissions, roles and M2M
      contract, and the server reconciles them.
    name: Declarations
  - description: >-
      A tenant administrator's customers. Each partner holds what its
      credentials may DO (permissions, per product) and WHERE they may do it
      (scope, per product and dimension); an M2M application attached to one is
      confined to that intersection. Administrator-only: authorized on the
      "partners" resource, and every route resolves the owning organization from
      the caller's token.
    name: Partners
paths:
  /v1/roles/{id}/permissions/remove:
    post:
      tags:
        - Roles
      summary: Remove Permissions from a Role in Batch
      description: >-
        Narrows a role by several permissions at once, naming them in the body.


        It is a POST rather than a DELETE because the permissions travel in a
        request body; `DELETE /v1/roles/{id}/permissions/{permId}` does the same
        for exactly one. Both exist and both are supported.


        Removing an existing permission the role does not carry is not an error.
        On success the response has no body (204).


        Failures:

        - `400` — `permissions` is missing or empty.

        - `404` — one of the permissions does not exist.

        - `422 IDE-1066` — a permission holding the role is declared by a Lerian
        product, which alone decides the roles that hold it; the message names
        it. Change who has the access by adding or removing people on the role,
        or in a group it is granted to; a machine permission has no client-side
        change. Permissions earlier in the list are already removed.

        - `503 IDE-0066` — the identity provider is unavailable (unreachable,
        too slow to answer, or failing). Nothing about the request was wrong;
        retry it later.
      operationId: removeRolePermissionsBatch
      parameters:
        - description: Role ID.
          in: path
          name: id
          required: true
          schema:
            description: Role ID.
            examples:
              - midaz-editor
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AssignPermissionsInput'
              description: The permissions to remove from the role.
        required: true
      responses:
        '204':
          description: No Content
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPError'
          description: Bad Request
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPError'
          description: Not Found
        '422':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPError'
          description: Unprocessable Entity
        '500':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPError'
          description: Internal Server Error
        '503':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPError'
          description: Service Unavailable
      security:
        - BearerAuth: []
components:
  schemas:
    AssignPermissionsInput:
      additionalProperties: false
      properties:
        permissions:
          description: Permission identifiers.
          items:
            type: string
          minItems: 1
          type: array
      required:
        - permissions
      type: object
    HTTPError:
      additionalProperties: false
      properties:
        code:
          type: string
        entityType:
          type: string
        err: {}
        message:
          type: string
        title:
          type: string
      type: object
  securitySchemes:
    BearerAuth:
      bearerFormat: JWT
      description: JWT bearer token issued by the identity provider.
      scheme: bearer
      type: http

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.