---
title: "POST | Remove access policies from a user group by [id]"
slug: "api-v2-remove-user-group-access-policies"
updated: 2026-11-06T19:05:09Z
published: 2026-11-06T19:05:09Z
canonical: "docs.senhasegura.io/api-v2-remove-user-group-access-policies"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.senhasegura.io/llms.txt
> Use this file to discover all available pages before exploring further.

# POST | Remove access policies from a user group by [id]

## Description

Remove one or more access policy bindings from a user group. The bindings are deactivated rather than erased.

A binding that is already inactive is skipped, so the same request can be repeated safely. An identification code that does not belong to this group is rejected.

The application can remove only bindings to PAM access policies released to its authorization in A2A. The rule also applies to an authorization with **Super admin** enabled. A binding to any other access policy is rejected as if it did not exist, whether it is active or not. If the application has no active authorization in A2A, it cannot remove any binding.

A rejected code does not stop the rest of the request. The other bindings in the request are removed, even when the response is `422`.

Removing every binding is also what unblocks the deletion of a group, access [DELETE | Delete user group](/v4-2/docs/api-v2-delete-user-group).

---

## Prerequisites

- An application with the **Users** authorization granted by the administrator in A2A. For more information, access [How to manage authorizations in A2A](/v4-2/docs/api-v2-how-to-manage-authorizations-in-a2a).
- A valid OAuth 2.0 access token. For more information, access [How to authenticate an application in A2A](/v4-2/docs/how-to-authenticate-an-application-in-a2a).
- The identification codes of the bindings, returned by [GET | List all access policies of a user group](/v4-2/docs/api-v2-get-list-user-group-access-policies).
- Each binding must bind a PAM access policy released to the application's authorization in A2A. For more information, access [How to manage authorizations in A2A](/v4-2/docs/api-v2-how-to-manage-authorizations-in-a2a).

---

## Request

`POST` `/api/v2/iam/user-groups/{id}/access-policies/remove`

### Path parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `id` | integer | Yes | Unique identification code of the user group. |

### Headers

| Header | Required | Description |
| --- | --- | --- |
| `Content-Type` | Yes | Must be `application/json`. |

### Request body

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `binding_ids` | array[integer] | Yes | Identification codes of the bindings to remove. The array must hold at least one value. Numeric strings, such as `"200"`, are also accepted. |

Info

The values in `binding_ids` are the binding codes returned in `data[].id` by the listing, not the identification codes of the access policies themselves. Send only codes returned by the listing.

---

### Example request

`POST` `{{url}}/api/v2/iam/user-groups/7/access-policies/remove`

#### Body

```
{
  "binding_ids": ["200", "201"]
}
```

---

## Response

```
HTTP/1.1 204 No Content
X-Request-Id: 7f3c1a90-2c4e-4b1a-9f5e-0a2b7c9d1e34
```

A successful removal returns no body.

---

## Errors

| HTTP code | Message | Possible cause | Solution |
| --- | --- | --- | --- |
| `401` | `api.auth.unauthorized` | The access token is missing, invalid, or has expired. | Request a new access token. |
| `404` | `api.resource.not_found` | The user group does not exist or is outside the scope of the authorization. A binding to an access policy outside the scope never returns `404`; it returns `422`. | Check the user group's identification code and the authorization scope. |
| `422` | `api.validation.required_field` | The body does not carry `binding_ids`. | Add the field and resend the request. |
| `422` | `api.validation.invalid_reference` | A binding code does not exist, belongs to another user group, or binds an access policy that is not released to the application's authorization in A2A. The message is `One or more access-policy bindings not found.` Each rejected code in `binding_ids` gets one entry in `details`. The other bindings in the request are still removed. | List the bindings of the group and use the codes returned there. |
| `429` | `api.rate_limit_exceeded` | The request rate limit was exceeded. | Wait the number of seconds returned in the `Retry-After` header and try again. |

For authentication error messages and the `403` versus `404` policy, access [API v2 - Conventions and shared behaviors](/v4-2/docs/api-v2-conventions-and-shared-behaviors).