Pawsitive Future Pawsitive FutureDeveloper docs

delete_roles_by_id_permissions

Changes data · you confirm first Idempotent

Calls DELETE /api/roles/{id}/permissions as the signed-in person · REST reference

Revoke permissions from a role

Requires execute:RemovePermissionFromRoleCommand; platform staff bypass that gate. The DAL write, its organization pinning, its 403 refusals and the 404 are the same as for the POST, and so are its 400 and 409 refusals. THE REVOKE ARRIVES IN THE BODY OF A DELETE, which many HTTP clients and proxies drop. A request whose body is stripped fails validation with 400 rather than silently revoking nothing. Unlike the add path this ALWAYS saves, even when nothing matched — so a revoke naming permissions the role never held still writes and still answers 200. Names not held are ignored; there is no report of what was actually removed, and data is null.

Arguments

ArgumentTypeDescription
idpathstring (uuid)required
bodyJSONobjectrequiredThe request body, as a JSON object. Its fields are listed below.

Fields of body

FieldTypeDescription
permissionsarray of stringrequiredPermission strings to revoke. Unknown names are silently skipped.

Example call

A client sends this over the MCP session; Claude and other agents build it for you. The values are placeholders — the shape is real.

json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "delete_roles_by_id_permissions",
    "arguments": {
      "id": "11111111-1111-4111-8111-111111111111",
      "body": {
        "permissions": [
          "string"
        ]
      }
    }
  }
}
Confirmation
The client shows the person the exact request and waits. Nothing runs until they tick Make this change. See Reading and changing.

Result

On success (HTTP 200) the tool returns one text item holding the API's JSON, pretty-printed.

Acknowledgement. data is explicitly null; nothing is returned.

json
{
  "data": {},
  "message": "Permissions removed from role successfully",
  "success": true
}

Fields

FieldTypeDescription
dataany | nullAlways JSON null — the key is present because the controller passes an explicit null rather than omitting the argument.
message"Permissions removed from role successfully"
successtrue

When it fails

A failed call returns isError: true with the API's message as text. A change the person declines, or lets time out, also comes back this way and nothing changes.

400

id is not a UUID, or permissions is missing / not an array / has a non-string element — which is also what a dropped DELETE body produces — with an ARRAY-shaped details; or the DAL refused the write, carrying its sentence.

403

Authenticated, but the caller holds none of the required permissions.

404

No such role — Role not found with code: ROLE_NOT_FOUND — or a DAL NOT_FOUND refusal, which carries the DAL sentence and no code.

409

The resource is not in a state that allows this operation.

What the model is shown

This is the tool exactly as the server lists it in tools/list. The description starts with the REST call it makes.

json
{
  "name": "delete_roles_by_id_permissions",
  "description": "DELETE /api/roles/{id}/permissions — Requires `execute:RemovePermissionFromRoleCommand`; platform staff bypass that gate. The DAL write, its organization pinning, its 403 refusals and the 404 are the same as for the `POST`, and so are its 400 and 409 refusals. THE REVOKE ARRIVES IN THE BODY OF A DELETE, which many HTTP clients and proxies drop. A request whose body is stripped fails validation with 400 rather than silently revoking nothing. Unlike the add path this ALWAYS saves, even when nothing matched — so a revoke naming permissions the role never held still writes and still answers 200. Names not held are ignored; there is no report of what was actually removed, and `data` is null.\n\nThis changes data. The person is asked to confirm it before it runs, and nothing happens if they decline.",
  "inputSchema": {
    "type": "object",
    "properties": {
      "id": {
        "type": "string"
      },
      "body": {
        "type": "string",
        "description": "The JSON request body: { permissions*: array of string (Permission strings to revoke.) }"
      }
    },
    "required": [
      "id",
      "body"
    ]
  },
  "annotations": {
    "readOnlyHint": false,
    "destructiveHint": true,
    "idempotentHint": true,
    "openWorldHint": false
  }
}