Remove an identity from an Environment (revoke EnvironmentMembership)
/portal/v1/accounts/{accountSlug}/identities/{id}/environment-memberships/{envId}Deactivates the EnvironmentMembership joining one identity to the Environment identified by envId and revokes every role assignment that identity holds at the Environment's hierarchy nodes. The identity row itself is retained (it may still belong to other Environments). Returns 404 when the identity is unknown or holds no membership in that Environment, and responds 204.
Authentication
AuthorizationJWT access token. Never send alongside X-API-Key: a request carrying both is refused.
identities.manageIdentitiesManage end-user identities across the account. Granted through an administrator role in the Admin Workspace; a valid token without it is refused with 403.
Path Parameters
idstring Required envIdstring Required Responses
Deactivates the EnvironmentMembership row and revokes every role assignment the identity holds at this Environment's hierarchy nodes. The Identity row itself stays (it may still belong to other Environments).
application/json
errorApiErrorBodyDto
application/json
errorApiErrorBodyDto
application/json
errorApiErrorBodyDto
Errors
When the request can't be completed, the response body includes a stable error code you can branch on.
account.capability_requiredForbiddenThe signed-in user's administrator roles do not grant the capability this endpoint requires.
Ask an account administrator to grant a role carrying the capability named in the Authentication section, then retry.
curl -X DELETE "https://auth.canopy-io.com/portal/v1/accounts/{accountSlug}/identities/value/environment-memberships/value" \ -H "Authorization: Bearer $CANOPY_TOKEN"
HTTP/1.1 204 Deactivates the EnvironmentMembership row and revokes every role assignment the identity holds at this Environment's hierarchy nodes. The Identity row itself stays (it may still belong to other Environments). (empty body)
Tell us how we can improve this guide.