> ## Documentation Index > Fetch the complete documentation index at: https://docs-staging-quickstart-revamp.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. > Learn how to remove permissions directly assigned to a user using the Auth0 Dashboard or the Management API. # Remove Permissions from Users You can remove the permissions directly assigned to a user using the Auth0 Dashboard or the Management API. The assigned permissions are used with the API Authorization Core feature set. To learn more, read [Role-Based Access Control](/docs/manage-users/access-control/rbac). ## Prerequisites For role-based access control (RBAC) to work properly, you must enable it for your API using either the Dashboard or the Management API. The Authorization Core functionality is different from the Authorization Extension. For a comparison, read [Authorization Core vs. Authorization Extension](/docs/manage-users/access-control/authorization-core-vs-authorization-extension). ## Use the Dashboard 1. Go to [Dashboard > User Management > Users](https://manage.auth0.com/#/users) and click the name of the user. 2. Click the **Permissions** view, then click the trash can icon next to the permission you want to remove, and confirm. Auth0 Dashboard User Detail list of permissions assigned to this user ## Use the Management API Make a `DELETE` call to the [Delete User Permissions endpoint](https://auth0.com/docs/api/management/v2#!/Users/delete_permissions). Be sure to replace `USER_ID`, `MGMT_API_ACCESS_TOKEN`, `API_ID`, and `PERMISSION_NAME` placeholder values with your user ID, Management API access token, API ID(s), and permission name(s), respectively. ```bash cURL lines curl --request DELETE \ --url 'https://{yourDomain}/api/v2/users/USER_ID/permissions' \ --header 'authorization: Bearer MGMT_API_ACCESS_TOKEN' \ --header 'cache-control: no-cache' \ --header 'content-type: application/json' \ --data '{ "permissions": [ { "resource_server_identifier": "API_ID", "permission_name": "PERMISSION_NAME" }, { "resource_server_identifier": "API_ID", "permission_name": "PERMISSION_NAME" } ] }' ``` ```csharp C# lines var client = new RestClient("https://{yourDomain}/api/v2/users/USER_ID/permissions"); var request = new RestRequest(Method.DELETE); request.AddHeader("content-type", "application/json"); request.AddHeader("authorization", "Bearer MGMT_API_ACCESS_TOKEN"); request.AddHeader("cache-control", "no-cache"); request.AddParameter("application/json", "{ \"permissions\": [ { \"resource_server_identifier\": \"API_ID\", \"permission_name\": \"PERMISSION_NAME\" }, { \"resource_server_identifier\": \"API_ID\", \"permission_name\": \"PERMISSION_NAME\" } ] }", ParameterType.RequestBody); IRestResponse response = client.Execute(request); ``` ```go Go lines expandable package main import ( "fmt" "strings" "net/http" "io/ioutil" ) func main() { url := "https://{yourDomain}/api/v2/users/USER_ID/permissions" payload := strings.NewReader("{ \"permissions\": [ { \"resource_server_identifier\": \"API_ID\", \"permission_name\": \"PERMISSION_NAME\" }, { \"resource_server_identifier\": \"API_ID\", \"permission_name\": \"PERMISSION_NAME\" } ] }") req, _ := http.NewRequest("DELETE", url, payload) req.Header.Add("content-type", "application/json") req.Header.Add("authorization", "Bearer MGMT_API_ACCESS_TOKEN") req.Header.Add("cache-control", "no-cache") res, _ := http.DefaultClient.Do(req) defer res.Body.Close() body, _ := ioutil.ReadAll(res.Body) fmt.Println(res) fmt.Println(string(body)) } ``` ```java Java lines HttpResponse response = Unirest.delete("https://{yourDomain}/api/v2/users/USER_ID/permissions") .header("content-type", "application/json") .header("authorization", "Bearer MGMT_API_ACCESS_TOKEN") .header("cache-control", "no-cache") .body("{ \"permissions\": [ { \"resource_server_identifier\": \"API_ID\", \"permission_name\": \"PERMISSION_NAME\" }, { \"resource_server_identifier\": \"API_ID\", \"permission_name\": \"PERMISSION_NAME\" } ] }") .asString(); ``` ```javascript Node.JS lines var axios = require("axios").default; var options = { method: 'DELETE', url: 'https://{yourDomain}/api/v2/users/USER_ID/permissions', headers: { 'content-type': 'application/json', authorization: 'Bearer MGMT_API_ACCESS_TOKEN', 'cache-control': 'no-cache' }, data: { permissions: [ {resource_server_identifier: 'API_ID', permission_name: 'PERMISSION_NAME'}, {resource_server_identifier: 'API_ID', permission_name: 'PERMISSION_NAME'} ] } }; axios.request(options).then(function (response) { console.log(response.data); }).catch(function (error) { console.error(error); }); ``` ```obj-c Obj-C lines expandable #import NSDictionary *headers = @{ @"content-type": @"application/json", @"authorization": @"Bearer MGMT_API_ACCESS_TOKEN", @"cache-control": @"no-cache" }; NSDictionary *parameters = @{ @"permissions": @[ @{ @"resource_server_identifier": @"API_ID", @"permission_name": @"PERMISSION_NAME" }, @{ @"resource_server_identifier": @"API_ID", @"permission_name": @"PERMISSION_NAME" } ] }; NSData *postData = [NSJSONSerialization dataWithJSONObject:parameters options:0 error:nil]; NSMutableURLRequest *request = [NSMutableURLRequest requestWithURL:[NSURL URLWithString:@"https://{yourDomain}/api/v2/users/USER_ID/permissions"] cachePolicy:NSURLRequestUseProtocolCachePolicy timeoutInterval:10.0]; [request setHTTPMethod:@"DELETE"]; [request setAllHTTPHeaderFields:headers]; [request setHTTPBody:postData]; NSURLSession *session = [NSURLSession sharedSession]; NSURLSessionDataTask *dataTask = [session dataTaskWithRequest:request completionHandler:^(NSData *data, NSURLResponse *response, NSError *error) { if (error) { NSLog(@"%@", error); } else { NSHTTPURLResponse *httpResponse = (NSHTTPURLResponse *) response; NSLog(@"%@", httpResponse); } }]; [dataTask resume]; ``` ```php PHP lines expandable $curl = curl_init(); curl_setopt_array($curl, [ CURLOPT_URL => "https://{yourDomain}/api/v2/users/USER_ID/permissions", CURLOPT_RETURNTRANSFER => true, CURLOPT_ENCODING => "", CURLOPT_MAXREDIRS => 10, CURLOPT_TIMEOUT => 30, CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1, CURLOPT_CUSTOMREQUEST => "DELETE", CURLOPT_POSTFIELDS => "{ \"permissions\": [ { \"resource_server_identifier\": \"API_ID\", \"permission_name\": \"PERMISSION_NAME\" }, { \"resource_server_identifier\": \"API_ID\", \"permission_name\": \"PERMISSION_NAME\" } ] }", CURLOPT_HTTPHEADER => [ "authorization: Bearer MGMT_API_ACCESS_TOKEN", "cache-control: no-cache", "content-type: application/json" ], ]); $response = curl_exec($curl); $err = curl_error($curl); curl_close($curl); if ($err) { echo "cURL Error #:" . $err; } else { echo $response; } ``` ```python Python lines import http.client conn = http.client.HTTPSConnection("") payload = "{ \"permissions\": [ { \"resource_server_identifier\": \"API_ID\", \"permission_name\": \"PERMISSION_NAME\" }, { \"resource_server_identifier\": \"API_ID\", \"permission_name\": \"PERMISSION_NAME\" } ] }" headers = { 'content-type': "application/json", 'authorization': "Bearer MGMT_API_ACCESS_TOKEN", 'cache-control': "no-cache" } conn.request("DELETE", "/{yourDomain}/api/v2/users/USER_ID/permissions", payload, headers) res = conn.getresponse() data = res.read() print(data.decode("utf-8")) ``` ```ruby Ruby lines require 'uri' require 'net/http' require 'openssl' url = URI("https://{yourDomain}/api/v2/users/USER_ID/permissions") http = Net::HTTP.new(url.host, url.port) http.use_ssl = true http.verify_mode = OpenSSL::SSL::VERIFY_NONE request = Net::HTTP::Delete.new(url) request["content-type"] = 'application/json' request["authorization"] = 'Bearer MGMT_API_ACCESS_TOKEN' request["cache-control"] = 'no-cache' request.body = "{ \"permissions\": [ { \"resource_server_identifier\": \"API_ID\", \"permission_name\": \"PERMISSION_NAME\" }, { \"resource_server_identifier\": \"API_ID\", \"permission_name\": \"PERMISSION_NAME\" } ] }" response = http.request(request) puts response.read_body ``` ```swift Swift lines expandable import Foundation let headers = [ "content-type": "application/json", "authorization": "Bearer MGMT_API_ACCESS_TOKEN", "cache-control": "no-cache" ] let parameters = ["permissions": [ [ "resource_server_identifier": "API_ID", "permission_name": "PERMISSION_NAME" ], [ "resource_server_identifier": "API_ID", "permission_name": "PERMISSION_NAME" ] ]] as [String : Any] let postData = JSONSerialization.data(withJSONObject: parameters, options: []) let request = NSMutableURLRequest(url: NSURL(string: "https://{yourDomain}/api/v2/users/USER_ID/permissions")! as URL, cachePolicy: .useProtocolCachePolicy, timeoutInterval: 10.0) request.httpMethod = "DELETE" request.allHTTPHeaderFields = headers request.httpBody = postData as Data let session = URLSession.shared let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in if (error != nil) { print(error) } else { let httpResponse = response as? HTTPURLResponse print(httpResponse) } }) dataTask.resume() ``` | Value | Description | | ----------------------- | --------------------------------------------------------------------------------------------------------------------- | | `USER_ID` | Τhe ID of the user to be updated. | | `MGMT_API_ACCESS_TOKEN` | [Access Token for the Management API](https://auth0.com/docs/api/management/v2/tokens) with the scope `update:users`. | | `API_ID` | ID(s) of the API(s) associated with the permission(s) you would like to remove for the specified user. | | `PERMISSION_NAME` | Name(s) of the permission(s) you would like to remove for the specified user. | ## Learn more * [Assign Permissions to Users](/docs/manage-users/access-control/configure-core-rbac/rbac-users/assign-permissions-to-users) * [Remove Permissions from Roles](/docs/manage-users/access-control/configure-core-rbac/roles/remove-permissions-from-roles) * [View Role Permissions](/docs/manage-users/access-control/configure-core-rbac/roles/view-role-permissions) * [Manage Role-Based Access Control Permissions](/docs/manage-users/access-control/configure-core-rbac/manage-permissions)