Revoke a grant
POST https://{tenant}.atomicwork.com/api/v1/iga/grants/{grant_id}/revoke
Revoke an identity grant. Supports two modes depending on whether you want the identity provider to be notified:
Immediate revocation (default): With skip_deprovisioning=true (the default), the grant is marked as REVOKED immediately in Atomicwork. No action is taken in the identity provider — use this when you've already removed access externally or when the grant is informational only.
Full deprovisioning: With skip_deprovisioning=false, Atomicwork triggers the full deprovisioning workflow. Depending on the entitlement's provisioning config, this may:
- Remove the user from an Azure AD or Okta group
- Remove a JumpCloud or Google Workspace assignment
- Create a manual service request for IT to action
The response includes a revocation_status object with status (IN_PROGRESS, COMPLETED, or FAILED) and a schedule_id you can use to track the deprovisioning execution.
Optional fields:
reason— free-text reason for the revocation (recorded in grant history)
Authorization
X-Api-KeyrequiredAPI key authentication.
Headers
X-Workspace-IdPath Parameters
grant_idrequiredThe grant ID to revoke
Body
reasonOptional reason for revoking the grant
skip_deprovisioningWhen true (default), marks the grant as REVOKED immediately without triggering IDP deprovisioning. When false, triggers the full deprovisioning workflow (Azure AD/Okta group removal or service request creation).
Response
Successful response