Delete a permission set

DELETE 
/permission-sets/:id

Deletes a permission set definition from Prism.

A permission set can only be deleted once nothing is assigned to it. If any assignment still references it (in any state, provisioned or failed, permanent or Just-In-Time) the call is refused with 409 and the response lists the assignments in the way. Delete those through DELETE /permission-set-assignments/{id} first, then retry.

This call touches nothing in AWS. It removes the definition row and nothing else. Because the operation is refused while assignments exist, the roles those assignments cut are torn down by deleting the assignments, not by this call.

Returns 200 with a body, not 204. The body's data is a single-key object echoing the id you deleted, not the deleted resource. Read it before the delete if you need to keep a copy.

Request

Responses

200

The permission set was deleted.

401

Authentication failed: the X-API-Token header was missing, malformed, expired or not recognised.

This response is text/plain, not JSON. It is written by http.Error in the authentication middleware, which runs before any handler and therefore before anything that would build a JSON envelope. A client that unconditionally JSON-parses response bodies will fail on this one, so check the status code first.

403

The token is valid, but it is not allowed to act on this tenant.

An API token is minted inside one tenant and stays bound to it for life. Sending it to a path whose tenant segment names a different tenant is refused here, in middleware, before the operation runs, so this says nothing about the resource you asked for, only about which tenant the path named. Check the tenant server variable against the console the token was created in.

404

No permission set with this id exists in your tenant, so nothing was deleted. A repeated DELETE lands here, as does a permission set belonging to another tenant and a tenant segment that names no tenant.

409

The permission set still has assignments and was not deleted.

This is the one error in this group that carries a data payload: it lists every assignment blocking the delete, so a client can show them or clear them without a second round trip. Those entries are only partially populated; see PermissionSetBlockingAssignment.

500

The assignment check or the delete itself failed against the database. The permission set may or may not still exist; re-fetch it.