Open Inventory / Docs
EndpointsAccess controlApiAccessRolesKey

Delete an access role

The API runs on your application instance. Schemas and field names come directly from the OpenAPI specification. Session-authenticated requests require a session on that instance.

DELETE
/api/access/roles/{key}

Requires an authenticated browser session with the roles.manage permission. Built-in roles and roles assigned to users cannot be deleted; deleting a role also deletes its conditional inventory rules.

Authorization

adminSession
cookieauthjs.session-token<token>

Authenticated Auth.js browser session cookie; each operation declares its required permission. Not restricted to administrators. HTTPS deployments use the secure-prefixed cookie variant.

Path Parameters

key*string

Stable role key.

Match^[a-z][a-z0-9_-]{0,63}$
Length1 <= length <= 64

Header Parameters

X-Organization-ID?string

Organization membership selected for this request. User-bound credentials may select any active membership; standalone tokens may only repeat their pinned organization ID.

Formatuuid

Response Body

Role and its conditional inventory rules deleted

Example Request
curl -X DELETE 'https://example.com/api/access/roles/editor'
Example Response
Empty

Create an access role POST

Requires an authenticated browser session with the roles.manage permission. Role keys are stable identifiers used by users and conditional rules.

Update an access role PATCH

Requires an authenticated browser session with the roles.manage permission. Changing permissions revokes user-bound API tokens for members of this role. The built-in Admin role must retain every permission.