POST/api/v1/remove-perm-from-role

Remove a permission from a role

Takes one permission away from a role in a workspace, withdrawing it from every member who holds that role there.

AccessRequires a permission in the workspaceMANAGE_ROLE

This is the counterpart to POST /api/v1/add-perm-to-role and takes the same three fields. It removes one permission from one role, so withdraw several permissions by calling it once per permission. rule_uid identifies the permission and comes from GET /api/v1/list-all-permissions.

Check what the role currently holds with GET /api/v1/get-roles-and-perms-detailed before you call this, so you remove the permission you meant to. The change is confined to the workspace you name, because roles are workspace-scoped: see Roles and permissions. If the aim is to change what one person can do rather than what the role can do, move that person to a different role with POST /api/v1/change-user-role instead.

This takes effect immediately

Every member holding this role in this workspace loses the permission as soon as the call returns, and work in progress that depends on it stops being possible for them. List who holds the role with GET /api/v1/get-users-from-workspace and verify the impact before you save the change. Take particular care with PAYMENT_APPROVE and PAYMENT_INIT: removing them can leave a vault with too few members able to approve a movement, or nobody able to start one.

Body parameters

rule_uidnumberrequired

The permission to remove, as returned in UID by list-all-permissions.

role_uidnumberrequired

The role that loses the permission. It must exist in the workspace you name.

workspace_uidnumberrequired

The workspace the role belongs to. The removal applies only here.

bash

curl -X POST "$SQRL_API/api/v1/remove-perm-from-role" \
  -H "authorization: Bearer $SQRL_TOKEN" \
  -H "content-type: application/json" \
  -d '{
        "rule_uid": 6,
        "role_uid": 77,
        "workspace_uid": 342
      }'

const res = await fetch(`${process.env.SQRL_API}/api/v1/remove-perm-from-role`, {
  method: "POST",
  headers: {
    authorization: `Bearer ${process.env.SQRL_TOKEN}`,
    "content-type": "application/json",
  },
  body: JSON.stringify({
    rule_uid: 6,
    role_uid: 77,
    workspace_uid: 342,
  }),
});
const { Success } = await res.json();

rust

let res = client
    .post(format!("{}/api/v1/remove-perm-from-role", api_base))
    .bearer_auth(&token)
    .json(&serde_json::json!({
        "rule_uid": 6,
        "role_uid": 77,
        "workspace_uid": 342,
    }))
    .send()
    .await?;

Response200 OK

{
"Success": true
}

#What happens next

Read the role back with GET /api/v1/get-roles-and-perms-detailed to confirm the permission is no longer listed under it. Members holding the role see the change on their next read of GET /api/v1/get-user-info. The Owner role bypasses all permission checks, so removing a permission from other roles does not restrict it.

Was this page helpful?