> ## Documentation Index
> Fetch the complete documentation index at: https://docs.prisme.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Revoke access

> Requires `admin`+ (or owner).



## OpenAPI

````yaml /api-reference/storage/swagger.yml delete /v1/knowledge_bases/{knowledgeBaseId}/access/{principalType}/{principalId}
openapi: 3.0.3
info:
  version: 1.0.0
  title: Knowledges API
  description: >
    Public REST API for the Prisme.ai Knowledges (storage) workspace: knowledge
    bases, documents (uploaded files, web pages, remote files, connector
    documents), recurring web-crawl sources, semantic search, access control,
    per-knowledge-base API keys, and skills.


    Resource identifiers use the physical prefixes emitted by the implementation
    (`vs_` knowledge base, `vsf_` document, `seed_` web source, `kb-` API-key
    slug).


    This spec documents the public REST surface only. Internal helpers (private
    automations prefixed with `_`) and admin/GDPR lifecycle operations are not
    part of the public contract.
  contact:
    name: Prisme.ai
    url: https://prisme.ai
servers:
  - url: https://{host}/v2/workspaces/slug:storage/webhooks
    description: Prisme.ai workspace webhooks
    variables:
      host:
        default: api.studio.prisme.ai
        description: API host (override for self-hosted or sandbox)
security:
  - BearerAuth: []
  - WorkspaceApiKeyAuth: []
tags:
  - name: Knowledge Bases
    description: >-
      Create, list, read, update, and delete knowledge bases (vector-backed
      document stores).
  - name: Documents
    description: >-
      Ingest and manage documents (uploaded files, web pages, remote files,
      connector documents) and their indexing.
  - name: Web Sources
    description: >-
      Recurring web crawl seeds that discover and index pages into a knowledge
      base.
  - name: Search
    description: Semantic search over a knowledge base.
  - name: Access
    description: Per-knowledge-base access bindings (user, group, org, agent principals).
  - name: API Keys
    description: Per-knowledge-base API keys for connector authentication.
  - name: Stats
    description: Aggregate dashboard statistics.
  - name: Skills
    description: Prompt/instruction registry entries.
paths:
  /v1/knowledge_bases/{knowledgeBaseId}/access/{principalType}/{principalId}:
    parameters:
      - name: knowledgeBaseId
        in: path
        required: true
        schema:
          type: string
          pattern: ^vs_[A-Za-z0-9-]+$
          maxLength: 128
        description: >-
          Knowledge base id. Legacy physical prefix `vs_` (the `kb_` rename is
          deferred).
      - name: principalType
        in: path
        required: true
        schema:
          type: string
          enum:
            - user
            - group
            - org
            - agent
        description: |
          Type of access principal. `agent` is a first-class owner
          principal for conversation/agent-owned knowledge bases (§F-6);
          `principal_id` is then the agent id (or its service-account id).
      - name: principalId
        in: path
        required: true
        schema:
          type: string
          maxLength: 128
        description: |
          Identifier of the principal. For `user`, the user id; for
          `group` and `org`, the group/org slug or id resolvable by the
          platform.
    delete:
      tags:
        - Access
      summary: Revoke access
      description: Requires `admin`+ (or owner).
      operationId: deleteAccessBinding
      responses:
        '200':
          description: Revoked.
          content:
            application/json:
              schema:
                type: object
                required:
                  - object
                  - deleted
                properties:
                  object:
                    type: string
                    enum:
                      - knowledge_base.access_binding
                  deleted:
                    type: boolean
                    enum:
                      - true
        '401':
          $ref: '#/components/responses/Error401'
        '403':
          $ref: '#/components/responses/Error403'
        '404':
          $ref: '#/components/responses/Error404'
      security:
        - BearerAuth: []
components:
  responses:
    Error401:
      description: Authentication missing or invalid.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          examples:
            unauthenticated:
              value:
                error:
                  code: UNAUTHENTICATED
                  message: Authentication required.
    Error403:
      description: Authentication present, authorization denied.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          examples:
            forbidden:
              value:
                error:
                  code: FORBIDDEN
                  message: Caller is not allowed to access this resource.
            hook_rejected:
              summary: An external content hook blocked ingestion (sync)
              value:
                error:
                  code: HOOK_REJECTED
                  message: Content was rejected by a compliance hook.
                  details:
                    rejected_by: hook_pii_filter
                    rejection_reason: detected_unmasked_pii
    Error404:
      description: Resource does not exist or is not visible to the caller.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          examples:
            not_found:
              value:
                error:
                  code: NOT_FOUND
                  message: knowledge_base.document not found.
                  details:
                    resource: knowledge_base.document
                    id: vsf_unknown
  schemas:
    Error:
      type: object
      description: |
        Single error envelope shared by every non-2xx response. `code`
        is the stable machine-readable identifier; `message` is the
        human-readable text; `details` is optional structured context.
      properties:
        error:
          type: object
          required:
            - code
            - message
          properties:
            code:
              type: string
              example: VALIDATION_ERROR
            message:
              type: string
            details:
              type: object
              additionalProperties: true
      required:
        - error
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: >-
        User session JWT or instance API key (`iak_*`). Send as `Authorization:
        Bearer <token>`.
    WorkspaceApiKeyAuth:
      type: apiKey
      in: header
      name: x-prismeai-api-key
      description: Workspace- or knowledge-base-scoped API key.

````