Delete a role

DELETE 
/roles/:id

Triggers deletion of an access role. Only a role manager (or a Super Admin) may call this.

Deletion is asynchronous: a 200 means the request passed its synchronous checks and deletion has been triggered, not that the role is gone. Failures that occur during the asynchronous deletion are never surfaced to the caller.

Two conflict conditions are checked synchronously and both return HTTP 500 rather than 400 or 409, because the handler raises them as backend exceptions: the role is mapped to a SAML group, or the role is attached to an access token. An unknown role id is likewise a 500.

Roles whose name begins with "SystemRole" cannot be deleted; that case returns 400 with a plain message carrying no error-code prefix.

Request

Responses

200

Deletion triggered. The role is removed asynchronously, so a subsequent GET may still return it briefly.

Response Headers

Access-Control-Allow-Origin
Access-Control-Allow-Methods
Access-Control-Allow-Headers

400

Authorization failure, or an attempt to delete a system role. Body is {"Message": " - "}, except for the system-role case whose message carries no error-code prefix. Codes: AUTH-1002 (caller is not a role manager), AUTH-1001 / AUTH-1003 / AUTH-1030 (authorization on the role_id header).

Response Headers

Access-Control-Allow-Origin
Access-Control-Allow-Methods
Access-Control-Allow-Headers

500

Backend failure, and also the two synchronous conflict conditions and the not-found case, which the handler raises as backend exceptions. Codes: ROLE-1008 (the role is attached to a SAML group or to an access token), IPV-1002 (role id not found), DB-1002 / DB-1003 (deletion could not be persisted), GE-1008 (generic). Body is {"Message": " - "}.

Response Headers

Access-Control-Allow-Origin
Access-Control-Allow-Methods
Access-Control-Allow-Headers