Revokes a principal's access to resources (entitlement values, entitlement bundles, or apps).
Returns 200 OK HTTP code after access is revoked with _links to updated resources.
The revocation request parameters
The Okta user in ORN format
Example:"orn:okta:directory:00o8rk36Bp5eZKOrw0g4:users:00u1ktfFMZ5HNoj7k0g4"
The flow that triggered the grant request
Default:"API"
| Enum Value | Description |
|---|---|
| API | The grant request was triggered from the API. |
| ACCESS_REQUEST | The grant request was triggered from an access request. |
| NONE | The grant request wasn't triggered from the API, an access request, or the Admin Console. |
| ADMIN | The grant request was triggered from the Admin Console. |
List of resource ORNs to revoke access:
- Entitlement value and entitlement bundle resources can be combined in a single request (with a maximum of five resources in a request).
- App resources must be revoked separately (a request can only contain one app ORN).
POST
- Revoke access to a single app
- Revoke access to multiple entitlement values
- Revoke access to multiple entitlement bundles
- Revoke access to entitlement values and bundles
curl -i -X POST \
https://okta-subdomain.pixtulate.com/governance/api/v2/revoke-principal-access \
-H 'Content-Type: application/json' \
-d '{
"principalOrn": "orn:okta:directory:00o11edPwGqbUrsDm0g4:users:00ub0oNGTSWTBKOLGLNR",
"actor": "ADMIN",
"revokeOrns": [
"orn:okta:idp:00o11rndFqmZ5rNfs0g4:apps:oidc_client:0oa251e7jQHXVgg5r0g4"
]
}'