Remove User Permissions

​

Request

​

Headers

​

Request Body

{
  "payload": {
    "userId": "68bb46bb4db8c853599f1ebb",
    "permissions": [
      "compass.dashboard.*",
      "compass.dashboard.overview"
    ]
  }
}

​

Request Body Schema

​

Permission Format

• Use * as wildcard (e.g., compass.dashboard.*)
• Specific actions (e.g., compass.dashboard.overview)
• Module-level access (e.g., compass.emailmeter)

​

Response

​

200 OK - Successfully removed permissions

{
  "message": "Successfully removed permissions for this user.",
  "data": {}
}

​

400 Bad Request

{
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "Invalid payload or missing required fields"
  }
}

​

401 Unauthorized

{
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Missing or invalid authentication token"
  }
}

​

403 Forbidden

{
  "error": {
    "code": "FORBIDDEN",
    "message": "Insufficient permissions"
  }
}

​

404 Not Found

{
  "error": {
    "code": "USER_NOT_FOUND",
    "message": "User with this ID does not exist anymore"
  }
}

​

500 Internal Server Error

{
  "error": {
    "code": "SERVER_ERROR",
    "message": "Internal server error"
  }
}

​

Example

curl -X PUT 'http://localhost:2000/user/remove-permissions' \
  -H 'Authorization: Bearer your-jwt-token' \
  -H 'Content-Type: application/json' \
  -d '{
    "payload": {
      "userId": "68bb46bb4db8c853599f1ebb",
      "permissions": [
        "compass.dashboard.*",
        "compass.dashboard.overview",
        "compass.emailmeter.stats"
      ]
    }
  }'

​

Notes

• This is an admin-only endpoint - requires administrative privileges
• Permissions are removed from the user’s existing permissions
• Non-existent permissions are automatically ignored
• The user ID must be a valid MongoDB ObjectId
• Permission strings must match exactly to be removed
• Changes take effect immediately for the user’s next request
• Use the /user/add-permissions endpoint to add permissions
• Permission changes are logged for audit purposes
• Removing all permissions may restrict user access to the system

​

Important Considerations

• Wildcard Permissions: Removing compass.dashboard.* removes all dashboard permissions
• Specific Permissions: Must match exactly (case-sensitive)
• Minimum Permissions: Ensure users retain necessary permissions for their role
• Audit Trail: All permission changes are tracked
• Immediate Effect: Changes apply on the user’s next authenticated request

​

Best Practices

1. Review user’s current permissions before removal
2. Test permission changes in a non-production environment
3. Document permission changes for compliance
4. Consider using role-based permissions instead of individual management
5. Regularly audit user permissions for security

{}