Description
Remove one or more access policy bindings from a user group. The bindings are deactivated rather than erased.
A binding that is already inactive is skipped, so the same request can be repeated safely. An identification code that does not belong to this group is rejected.
The application can remove only bindings to PAM access policies released to its authorization in A2A. The rule also applies to an authorization with Super admin enabled. A binding to any other access policy is rejected as if it did not exist, whether it is active or not. If the application has no active authorization in A2A, it cannot remove any binding.
A rejected code does not stop the rest of the request. The other bindings in the request are removed, even when the response is 422.
Removing every binding is also what unblocks the deletion of a group, access DELETE | Delete user group.
Prerequisites
- An application with the Users authorization granted by the administrator in A2A. For more information, access How to manage authorizations in A2A.
- A valid OAuth 2.0 access token. For more information, access How to authenticate an application in A2A.
- The identification codes of the bindings, returned by GET | List all access policies of a user group.
- Each binding must bind a PAM access policy released to the application's authorization in A2A. For more information, access How to manage authorizations in A2A.
Request
POST /api/v2/iam/user-groups/{id}/access-policies/remove
Path parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
id |
integer | Yes | Unique identification code of the user group. |
Headers
| Header | Required | Description |
|---|---|---|
Content-Type |
Yes | Must be application/json. |
Request body
| Field | Type | Required | Description |
|---|---|---|---|
binding_ids |
array[integer] | Yes | Identification codes of the bindings to remove. The array must hold at least one value. Numeric strings, such as "200", are also accepted. |
The values in binding_ids are the binding codes returned in data[].id by the listing, not the identification codes of the access policies themselves. Send only codes returned by the listing.
Example request
POST {{url}}/api/v2/iam/user-groups/7/access-policies/remove
Body
{
"binding_ids": ["200", "201"]
}
Response
HTTP/1.1 204 No Content
X-Request-Id: 7f3c1a90-2c4e-4b1a-9f5e-0a2b7c9d1e34
A successful removal returns no body.
Errors
| HTTP code | Message | Possible cause | Solution |
|---|---|---|---|
401 |
api.auth.unauthorized |
The access token is missing, invalid, or has expired. | Request a new access token. |
404 |
api.resource.not_found |
The user group does not exist or is outside the scope of the authorization. A binding to an access policy outside the scope never returns 404; it returns 422. |
Check the user group's identification code and the authorization scope. |
422 |
api.validation.required_field |
The body does not carry binding_ids. |
Add the field and resend the request. |
422 |
api.validation.invalid_reference |
A binding code does not exist, belongs to another user group, or binds an access policy that is not released to the application's authorization in A2A. The message is One or more access-policy bindings not found. Each rejected code in binding_ids gets one entry in details. The other bindings in the request are still removed. |
List the bindings of the group and use the codes returned there. |
429 |
api.rate_limit_exceeded |
The request rate limit was exceeded. | Wait the number of seconds returned in the Retry-After header and try again. |
For authentication error messages and the 403 versus 404 policy, access API v2 - Conventions and shared behaviors.