Add a capability revoke to a user (admin)

POST

/admin/users/{ref}/revokes

• Local development behind nginx (port 8088 by default)

Authorizations

• cookieAuth
• bearerAuth

Parameters

Path Parameters

ref

required

integer format: int64

Request Body ^required

Body shared by POST /admin/users/{ref}/grants and POST /admin/users/{ref}/revokes. Pass team_id to scope the override to a team — omit / null for a global override.

expires_at is optional. When set, the grant or revoke auto-expires at that time and is reaped by the background sweeper. Past values are rejected with 400 (operator must explicitly choose to delete an already- expired override rather than land it pre-stale).

object

capability

required

Capability code (e.g. assets.read, users.write).

string

team_id

string format: uuid

nullable

note

Optional admin-supplied justification recorded with the row.

string

<= 500 characters

expires_at

Optional auto-expiry. NULL / omitted = permanent. Past values rejected with 400.

string format: date-time

nullable

Responses

204

Revoke inserted.

400

Malformed request

object

error

required

Human-readable error summary

string

Example

the request could not be completed

401

Authentication required, missing, or invalid

object

error

required

Human-readable error summary

string

Example

the request could not be completed

Example

{
  "error": "authentication required: sign in and retry with a valid session or API token"
}

403

Authenticated but missing required capabilities

object

error

required

Human-readable error summary

string

Example

the request could not be completed

404

Resource not found

object

error

required

Human-readable error summary

string

Example

the request could not be completed