MagicDoorAPI
SupportOpen MagicDoor
Property managers

Revoke property access

Narrows a property manager's reach by removing one portfolio, one property, or the company-wide wildcard, and returns their reach afterwards. Send exactly one of the three.

DELETE
https://api.portal.magicdoor.com/company-app/property-managers/{propertyManagerId}/property-access

Authorization

Authorizationstringrequired
Bearer token — Send your API token in the Authorization header as Bearer <token>. Requests without a valid token are rejected with 401 Unauthorized.

Path parameters

propertyManagerIdstringrequired

The property manager. A Snowflake id, sent as a decimal string.

example: 1830472847398404098

Body

application/json

Note that this DELETE carries a body. Send allProperties: true on its own, or exactly one of portfolioId and propertyId.

allPropertiesboolean

true revokes access to every property the company has. When you send true, both id fields must be left out.

default: false
portfolioIdstring

The portfolio to revoke. Reaches every property in it. Send this or propertyId, not both.

propertyIdstring

The property to revoke. Send this or portfolioId, not both.

Response

200 · The property manager's reach after the revoke.

allPropertiesboolean

true when this property manager reaches every property the company has, now and in future. When it is true, propertyIds and portfolioIds carry no meaning.

propertyIdsstring[]

The individual properties they reach. Properties that no longer exist are filtered out of this list rather than reported.

portfolioIdsstring[]

The portfolios they reach. Granting a portfolio reaches every property in it, including properties added to it later. Portfolios that no longer exist are filtered out of this list rather than reported.

400 · The three fields do not make a valid request: `allProperties` was true alongside an id, both ids were sent, or none of the three was sent.

401 · The access token is missing, expired, or does not belong to a property manager.

404 · No property manager with that id exists for the calling company. A record that belongs to another company is reported the same way as one that does not exist. The id you asked for is in `entityId`; `detail` names only the kind of record.

Two different gates

A property manager is limited in three independent ways, and it is easy to confuse them.

  • Permissions are resource:action strings such as property:read. They decide what the API lets this person do. See list permissions.
  • Property access decides which properties those permissions reach — all of them, or a named set of portfolios and properties. See get property access.
  • Menu access decides which top-level menus MagicDoor's own web app draws for them. It hides screens; it does not stop an API call. See get menu access.

Revoking is exact, not subtractive

You remove the same grant you gave. Revoking a property that was only ever reachable through a portfolio grant changes nothing — the portfolio grant is still there and still reaches it. To take that property away you either revoke the portfolio, or revoke it and grant the individual properties you do still want.

The same holds for allProperties: while the wildcard is in place, revoking individual properties has no effect on what the person can reach. Revoke allProperties: true first.

The id is not checked

Unlike granting, revoking does not verify that the portfolio or property still exists — it removes the grant either way.