permissions

Revoke Capability From Principal

Take one or more capabilities away from a principal: a user, a role, or a tenant.

A member keeps the capability if another level still grants it, since resolution is a union. Revoking something the principal never had succeeds and changes nothing, so a retry is safe.

The caller needs the revoke_capabilities capability in the target tenant; the tenant owner always has it.

Several capabilities can be revoked in one call by repeating the capability parameter, all or nothing like granting.

Error Codes

400 Bad Request: A capability is not in the catalog
403 Forbidden: Caller lacks revoke_capabilities in the target tenant, or the principal or tenant does not exist. These answer the same, so the endpoint cannot be used to discover which ids are real

DELETE

api

permissions

capabilities

{principal_id}

Revoke Capability From Principal

curl --request DELETE \
  --url https://{tenant}.aws.cognee.ai/api/v1/permissions/capabilities/{principal_id} \
  --header 'Authorization: Bearer <token>'

import requests

url = "https://{tenant}.aws.cognee.ai/api/v1/permissions/capabilities/{principal_id}"

headers = {"Authorization": "Bearer <token>"}

response = requests.delete(url, headers=headers)

print(response.text)

{
  "detail": [
    {
      "loc": [
        "<string>"
      ],
      "msg": "<string>",
      "type": "<string>",
      "input": "<unknown>",
      "ctx": {}
    }
  ]
}

Authorizations

Authorization

string

header

required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Path Parameters

principal_id

string<uuid>

required

Query Parameters

capability

string[]

required

Capability to take away. Repeat the parameter to revoke several at once: ?capability=a&capability=b.

Example:

["manage_users"]

tenant_id

string<uuid> | null

Tenant the revoke is scoped to when the principal is a user. Defaults to the caller's current tenant. Ignored for a role or a tenant, whose own tenant is always used.

Response

Successful Response

⌘I

Revoke Capability From Principal

curl --request DELETE \
  --url https://{tenant}.aws.cognee.ai/api/v1/permissions/capabilities/{principal_id} \
  --header 'Authorization: Bearer <token>'

import requests

url = "https://{tenant}.aws.cognee.ai/api/v1/permissions/capabilities/{principal_id}"

headers = {"Authorization": "Bearer <token>"}

response = requests.delete(url, headers=headers)

print(response.text)

{
  "detail": [
    {
      "loc": [
        "<string>"
      ],
      "msg": "<string>",
      "type": "<string>",
      "input": "<unknown>",
      "ctx": {}
    }
  ]
}

Getting Started

auth

add

cognify

memify

search

permissions

datasets

ontologies

settings

visualize

schema

skills

configuration

delete

validate

update

responses

llm

sync

users

checks

health

agent management

agent connections

activity

sessions

remember

recall

improve

forget

slack

integrations

Revoke Capability From Principal

Error Codes

Authorizations

Path Parameters

Query Parameters

Response