Method: projects.locations.instances.users.disableRole

Disables one role of a User. The role stays in roleStatuses as DISABLED, and the User's other roles are not affected.

SIGNER is disabled immediately and the User leaves their Team; it fails with FAILED_PRECONDITION while the User holds key shares, until resharing is supported. ADMIN and POLICY_AUTHOR need authorizationInfo. An ACTIVE role becomes PENDING_DISABLED, still usable, until enough Admins approve with users.approveRoleChange. A PENDING_ACTIVE role is canceled: it becomes DISABLED at once, without Admin approval.

Disabling ADMIN fails with FAILED_PRECONDITION if it would leave too few active Admins (see the service rules). Fails with FAILED_PRECONDITION if the role is already DISABLED or PENDING_DISABLED.

HTTP request

POST https://mpc.googleapis.com/v1beta/{name=projects/*/locations/*/instances/*/users/*}:disableRole

The URL uses gRPC Transcoding syntax.

Path parameters

Parameters
name

string

Required. The name of the User. Format: projects/{project}/locations/{location}/instances/{instance}/users/{user}

Request body

The request body contains data with the following structure:

JSON representation 
{
  "role": enum (Role),
  "authorizationInfo": {
    object (AuthorizationInfo)
  }
}
Fields
role

enum (Role)

Required. The role to disable.
authorizationInfo

object (AuthorizationInfo)

Optional. The calling Admin's signature over a UserSigningPayload with the User's role changes that are pending after this request: the DISABLE change for role plus any other pending changes. Not needed when the request only cancels a pending enable of role. Otherwise required if role is ADMIN or POLICY_AUTHOR; must be empty for other roles.

Response body

If successful, the response body contains an instance of User.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.