Revoke a role via the REST API interface (IDM 4.7.3)

[dtesenair]

I have written a simple app that allows me ADD an IDM role to a user using the IDM4.7.3 REST API.  However, I can not find any method/endpoint in the documentation that allows me to REVOKE a user role.  There is an endpoint that revokes a resource but not a role.  I have even checked the 4.8 API documentation and there is no role revoke endpoint there, either.  Am I missing something?  Or is this a glaring omission from the REST API's capabilities?

[al_b]

You right,
The documentation mentioned about REVOKE only for resources
/resources/resource/assignments/revoke
API Objective: Revoke resource to users.

but at the same time, I can see <revokeRequestDef> and <revokeRequired> in RoleNode section. You can try it
<json_RoleNode>
<id>...</id>
<name>...</name>
<description>...</description>
<categories>
<id>...</id>
<name>...</name>
</categories>
<categories>
<id>...</id>
<name>...</name>
</categories>
<owners>
<id>...</id>
<name>...</name>
<type>...</type>
</owners>
<owners>
<id>...</id>
<name>...</name>
<type>...</type>
</owners>
<approvalRequestDef>...</approvalRequestDef>
<approvalRequestDefName>...</approvalRequestDefName>
<revokeRequestDef>...</revokeRequestDef>

...

<revokeRequired>true</revokeRequired> 

[klasen · Accepted solution]

Hi,

that endpoint is documented here:

https://www.netiq.com/documentation/identity-manager-developer/rest-api-documentation/idmappsdoc/#/Access/resource_Access_removeUserPermissionAssignmentsFromAssignees_DELETE

A sample payload:

{
    "reason": "revoke REST test",
    "assignments": [
        {
            "id": "cn=testöäüß,cn=level30,cn=roledefs,cn=roleconfig,cn=appconfig,cn=user application driver,cn=driverset1,o=system",
            "entityType": "role",
            "assignmentToList": [
                {
                    "assignedToDn": "cn=1234567,ou=users,ou=data",
                    "subtype": "user"
                }
            ]
        }
    ]
}