Skip to main content

Delete a permission set assignment

DELETE 
/permission-set-assignments/:id

Revokes an assignment: the principal stops seeing the role through Prism, and the assignment record is removed.

Deleting does not undo creating. Where POST reaches into the member account and cuts an IAM role, this operation makes no AWS call at all. It unbinds the role from the user or group in the identity provider and deletes Prism's row. The IAM role itself, and every policy attached to it, stays behind in the AWS account. The principal can no longer assume it by signing in through Prism, but the role remains in the account, still assumable by anything else that is entitled to, and it will still be there if the same permission set is assigned to the same account again later. Delete it in AWS yourself if it has to be gone.

Everything this operation does is synchronous, so unlike POST the response reflects a finished state rather than a started one.

Unbinding the role in the identity provider is nonetheless best-effort: if that step fails it is logged and the row is deleted anyway, and the call still returns 200. So a 200 guarantees the assignment is gone from Prism, not that the directory binding was cleanly removed.

The operation is not idempotent: a second DELETE of the same id returns 404. And it returns 200 with a body, not 204, where that body echoes the id rather than the deleted assignment. Read the assignment first if you need a copy of it.

Request​

Responses​

The assignment was deleted.