---
type: api
title: Remove Role Assignments
description: Removes a set of RoleAssignments from the specified User. Currently unavailable in self-hosted ECE.
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/cloud/operation/operation-remove-role-assignments
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/cloud/operation/operation-remove-role-assignments
products:
  - Elastic Cloud Hosted
---

# Remove Role Assignments

- Server: `https://api.elastic-cloud.com/api/v1`

## Paths

- `DELETE` `/users/{user_id}/role_assignments`

#### Path Parameters

- `user_id` (string)
  Identifier for the user; include realm name and id if required

## Description

Removes a set of RoleAssignments from the specified User. Currently unavailable in self-hosted ECE.

## Request Body

`application/json`

The Role Assignments to remove

- `platform` ([] PlatformRoleAssignment) — optional
  Assignments for roles with platform scope.
  - `role_id` (string) — required
    The ID of the role that is assigned.
- `organization` ([] OrganizationRoleAssignment) — optional
  Assignments for roles with organization scope.
  - `role_id` (string) — required
    The ID of the role that is assigned.
  - `organization_id` (string) — required
    The ID of the organization the role is scoped to.
  - `application_roles` ([] string) — optional
    If provided, the user assigned this role assignment will be granted this application role when signing in to a deployment or project
- `deployment` ([] DeploymentRoleAssignment) — optional
  Assignments for roles with deployment scope.
  - `role_id` (string) — required
    The ID of the role that is assigned.
  - `organization_id` (string) — required
    The ID of the organization the role is scoped to.
  - `all` (boolean) — optional
    When true, the role applies to all deployments in the organization, otherwise the role is scoped to the deployments specified in `deployment_ids`.
  - `deployment_ids` ([] string) — optional
    The IDs of the deployments the role is scoped to. Must be absent if `all` is true, and present if `all` is false.
  - `application_roles` ([] string) — optional
    If provided, the user assigned this role assignment will be granted this application role when signing in to the deployment(s) specified in the role assignment.
- `project` ({} ProjectRoleAssignments) — optional
  Assignments for roles with project scope.
  - `elasticsearch` ([] ProjectRoleAssignment) — optional
    The Elasticsearch project-scoped role assignments to set
    - `role_id` (string) — required
      The ID of the role that is assigned.
    - `organization_id` (string) — required
      The ID of the organization the role is scoped to.
    - `all` (boolean) — optional
      When true, the role applies to all projects in the organization, otherwise the role is scoped to the projects specified in `project_ids`.
    - `project_ids` ([] string) — optional
      The IDs of the projects the role is scoped to. Must be absent if `all` is true, and present if `all` is false.
    - `application_roles` ([] string) — optional
      If provided, the user assigned this role assignment will be granted this application role when signing in to the project(s) specified in the role assignment.
  - `observability` ([] ProjectRoleAssignment) — optional
    The Observability project-scoped role assignments to set
    - `role_id` (string) — required
      The ID of the role that is assigned.
    - `organization_id` (string) — required
      The ID of the organization the role is scoped to.
    - `all` (boolean) — optional
      When true, the role applies to all projects in the organization, otherwise the role is scoped to the projects specified in `project_ids`.
    - `project_ids` ([] string) — optional
      The IDs of the projects the role is scoped to. Must be absent if `all` is true, and present if `all` is false.
    - `application_roles` ([] string) — optional
      If provided, the user assigned this role assignment will be granted this application role when signing in to the project(s) specified in the role assignment.
  - `security` ([] ProjectRoleAssignment) — optional
    The Security project-scoped role assignments to set
    - `role_id` (string) — required
      The ID of the role that is assigned.
    - `organization_id` (string) — required
      The ID of the organization the role is scoped to.
    - `all` (boolean) — optional
      When true, the role applies to all projects in the organization, otherwise the role is scoped to the projects specified in `project_ids`.
    - `project_ids` ([] string) — optional
      The IDs of the projects the role is scoped to. Must be absent if `all` is true, and present if `all` is false.
    - `application_roles` ([] string) — optional
      If provided, the user assigned this role assignment will be granted this application role when signing in to the project(s) specified in the role assignment.
  - `workplaceai` ([] ProjectRoleAssignment) — optional
    The WorkplaceAI project-scoped role assignments to set
    - `role_id` (string) — required
      The ID of the role that is assigned.
    - `organization_id` (string) — required
      The ID of the organization the role is scoped to.
    - `all` (boolean) — optional
      When true, the role applies to all projects in the organization, otherwise the role is scoped to the projects specified in `project_ids`.
    - `project_ids` ([] string) — optional
      The IDs of the projects the role is scoped to. Must be absent if `all` is true, and present if `all` is false.
    - `application_roles` ([] string) — optional
      If provided, the user assigned this role assignment will be granted this application role when signing in to the project(s) specified in the role assignment.

## Responses

#### `200`

Role Assignments were successfully removed from the target User

`application/json`

Type: `EmptyResponse`

#### `400`

The target user Id is invalid. (code: `role_assignments.invalid_target_user_id`)

`application/json`

- `errors` ([] BasicFailedReplyElement)
  A list of errors that occurred in the failing request
  - `code` (string)
    A structured code representing the error type that occurred
  - `message` (string)
    A human readable message describing the error that occurred
  - `fields` ([] string)
    If the error can be tied to a specific field or fields in the user request, this lists those fields
##### Response Headers

- `x-cloud-error-codes` (enum)
  The error codes associated with the response

#### `401`

Credentials were invalid. (code: `root.unauthorized`)

`application/json`

- `errors` ([] BasicFailedReplyElement)
  A list of errors that occurred in the failing request
  - `code` (string)
    A structured code representing the error type that occurred
  - `message` (string)
    A human readable message describing the error that occurred
  - `fields` ([] string)
    If the error can be tied to a specific field or fields in the user request, this lists those fields
##### Response Headers

- `x-cloud-error-codes` (enum)
  The error codes associated with the response

#### `403`

You are not authorised to remove the specified RoleAssignments. (code: `role_assignments.unauthorized_role_assignments`)

`application/json`

- `errors` ([] BasicFailedReplyElement)
  A list of errors that occurred in the failing request
  - `code` (string)
    A structured code representing the error type that occurred
  - `message` (string)
    A human readable message describing the error that occurred
  - `fields` ([] string)
    If the error can be tied to a specific field or fields in the user request, this lists those fields
##### Response Headers

- `x-cloud-error-codes` (enum)
  The error codes associated with the response

## Code Examples

#### Console

```console
DELETE /users/{user_id}/role_assignments
```

#### curl

```curl
curl -X DELETE "https://api.elastic-cloud.com/api/v1/users/{user_id}/role_assignments"
```