Remove a permission

Takes one resource:action permission away from a property manager and returns their full list afterwards. Removing one they do not hold leaves the list as it was.

Authorization

Authorizationstringrequired

Bearer token — Send your API token in the Authorization header as Bearer <token>. Requests without a valid token are rejected with 401 Unauthorized.

Path parameters

propertyManagerIdstringrequired

The property manager. A Snowflake id, sent as a decimal string.

example: 1830472847398404098

Body

application/json

Note that this DELETE carries a body.

permissionstringrequired

The permission to take away, as resource:action. 1 to 100 characters.

Response

200 · The property manager's full permission list after the change.

permissionsstring[]

Every resource:action string this property manager holds. * means every permission.

401 · The access token is missing, expired, or does not belong to a property manager.

404 · No property manager with that id exists for the calling company. A record that belongs to another company is reported the same way as one that does not exist. The id you asked for is in `entityId`; `detail` names only the kind of record.

Two different gates

A property manager is limited in three independent ways, and it is easy to confuse them.

Permissions are resource:action strings such as property:read. They decide what the API lets this person do. See list permissions.
Property access decides which properties those permissions reach — all of them, or a named set of portfolios and properties. See get property access.
Menu access decides which top-level menus MagicDoor's own web app draws for them. It hides screens; it does not stop an API call. See get menu access.

Removing a permission does not narrow a wildcard

A property manager holding * holds every permission. Removing a single string from that list does not carve an exception out of the wildcard — take * away and grant the specific permissions you do want.