delete_role¶

ManagementApi.delete_role(id, role_id, _request_timeout=None, _request_auth=None, _content_type=None, _headers=None, _host_index=0)¶

Delete a role

Triggers deletion of an access role. Only a role manager (or a Super Admin) may call this. Deletion is asynchronous: a 200 means the request passed its synchronous checks and deletion has been triggered, not that the role is gone. Failures that occur during the asynchronous deletion are never surfaced to the caller. Two conflict conditions are checked synchronously and both return HTTP 500 rather than 400 or 409, because the handler raises them as backend exceptions: the role is mapped to a SAML group, or the role is attached to an access token. An unknown role id is likewise a 500. Roles whose name begins with “SystemRole” cannot be deleted; that case returns 400 with a plain message carrying no error-code prefix.

Parameters:

id (str) – Identifier of the role to delete. (required)
role_id (str) – Amorphic role ID the request is authorized against. Must be a role the caller belongs to. Not required when the request carries Super Admin context. (required)
_request_timeout (int, tuple(int, int), optional) – timeout setting for this request. If one number provided, it will be total request timeout. It can also be a pair (tuple) of (connection, read) timeouts.
_request_auth (dict, optional) – set to override the auth_settings for an a single request; this effectively ignores the authentication in the spec for a single request.
_content_type (str, Optional) – force content-type for the request.
_headers (dict, optional) – set to override the headers for a single request; this effectively ignores the headers in the spec for a single request.
_host_index (int, optional) – set to override the host_index for a single request; this effectively ignores the host_index in the spec for a single request.

Return type:

DeleteRoleResponse

Returns:

Returns the result object.

Request and Response Examples¶

HTTP: DELETE /roles/{id}

Parameter examples¶

Name	In	Example
`id`	path	`"role-b1e6c2a0-9f4d-4c7a-8f2e-1a2b3c4d5e6f"`
`role_id`	header	`"role-admin"`

Success (HTTP 200)¶

Deletion triggered. The role is removed asynchronously, so a subsequent GET may still return it briefly.

Request / response example

{
  "Message": "Successfully triggered access role deletion"
}

Errors¶

Documented error codes: AUTH-1002, AUTH-1001, AUTH-1003, AUTH-1030, ROLE-1008, IPV-1002, DB-1002, DB-1003, GE-1008.

HTTP 400

Authorization failure, or an attempt to delete a system role. Body is {“Message”: “<CODE> - <text>”}, except for the system-role case whose message carries no error-code prefix. Codes: AUTH-1002 (caller is not a role manager), AUTH-1001 / AUTH-1003 / AUTH-1030 (authorization on the role_id header).

Caller is not a role manager

{
  "Message": "AUTH-1002 - User is not authorized to perform this operation as they are not a role manager."
}

System role cannot be deleted, message has no error-code prefix

{
  "Message": "Failed, Cannot remove default system access role"
}

HTTP 500

Backend failure, and also the two synchronous conflict conditions and the not-found case, which the handler raises as backend exceptions. Codes: ROLE-1008 (the role is attached to a SAML group or to an access token), IPV-1002 (role id not found), DB-1002 / DB-1003 (deletion could not be persisted), GE-1008 (generic). Body is {“Message”: “<CODE> - <text>”}.

Role is mapped to a SAML group

{
  "Message": "ROLE-1008 - Role is attached to SAML groups, cannot be deleted"
}

Role is attached to an access token

{
  "Message": "ROLE-1008 - Role is attached to access tokens, cannot be deleted"
}

Role id does not exist

{
  "Message": "IPV-1002 - Invalid RoleId - role-b1e6c2a0-9f4d-4c7a-8f2e-1a2b3c4d5e6f, resource not found."
}