Remove Role Membership
Revoke a specific (client_uuid, role_uuid) assignment. The pair is passed in the request body rather than the URL — a membership has no public id of its own, and using the body keeps the API symmetric with create.
Effect is immediate: the next request from this client no longer carries this role's permissions. If that was their only role, they retain authentication ability but get no permission grants — your upstream service should treat them as "logged in but unauthorised".
Path parameters
uuid from /endpoints.Request body
uuid of the RBAC client whose membership to remove. Resolved under this endpoint only.uuid of the role to revoke. Resolved under this endpoint only.Deprecated: client_id and role_id (integers) are still accepted until the sunset. Send client_uuid and role_uuid; sending both forms for different objects is a 400 id_uuid_mismatch.
Response (200 OK)
Returns the full updated memberships array for the endpoint (same shape as List Role Memberships), not 204. Removing a non-existent pairing still returns 200 with the unchanged list.
Deprecated: until the sunset this response also carries the legacy integer id, client_id, role_id and assigned_by fields. Don't use them; read the *_uuid fields.
Errors
client_uuid or role_uuid (client_uuid and role_uuid are required), a malformed uuid (client_uuid must be a uuid), both forms naming different objects (id_uuid_mismatch), an integer after the sunset (integer_id_unsupported), unknown fields, or invalid JSON.endpoints:delete permission in the active account.client_uuid not found / role_uuid not found).