Skip to main content
PUT
Remove permissions from a user
Removes one or more permissions from a user’s existing permissions list. Only admin-level users can perform this action.

Request

Headers

Request Body

Request Body Schema

Permission Format

Permissions follow the pattern: compass.module.action
  • Use * as wildcard (e.g., compass.dashboard.*)
  • Specific actions (e.g., compass.dashboard.overview)
  • Module-level access (e.g., compass.emailmeter)

Response

200 OK - Successfully removed permissions

400 Bad Request

401 Unauthorized

403 Forbidden

404 Not Found

500 Internal Server Error

Example

Notes

  • This is an admin-only endpoint - requires administrative privileges
  • Permissions are removed from the user’s existing permissions
  • Non-existent permissions are automatically ignored
  • The user ID must be a valid MongoDB ObjectId
  • Permission strings must match exactly to be removed
  • Changes take effect immediately for the user’s next request
  • Use the /user/add-permissions endpoint to add permissions
  • Permission changes are logged for audit purposes
  • Removing all permissions may restrict user access to the system

Important Considerations

  • Wildcard Permissions: Removing compass.dashboard.* removes all dashboard permissions
  • Specific Permissions: Must match exactly (case-sensitive)
  • Minimum Permissions: Ensure users retain necessary permissions for their role
  • Audit Trail: All permission changes are tracked
  • Immediate Effect: Changes apply on the user’s next authenticated request

Best Practices

  1. Review user’s current permissions before removal
  2. Test permission changes in a non-production environment
  3. Document permission changes for compliance
  4. Consider using role-based permissions instead of individual management
  5. Regularly audit user permissions for security

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Body

application/json
payload
object
required

Response

Successfully removed permissions

message
string
Example:

"Successfully removed permissions for this user."

data
object
Example: