Cubicle

Revoke access to a Box

DELETE
/v1/boxes/{box}/grants/{user}

Revokes a member's grant on the Box and returns 204 No Content. Any member may revoke their own grant; revoking someone else's needs the owner or admin role. The route needs a sign-in session; API keys cannot use it.

The member's exec, SSH, private-network and console access to the Box ends, including connections already open, and without the owner or admin role they can no longer manage it. Their guest account is locked and loses its SSH keys, at once if the Box is running or when it next starts; its home directory stays on the disk. The grant stays listed with status: "revoked" and can be granted again. See Revoking access.

Authorization

session
headerAuthorizationBearer <token>

A sign-in session token (jvs_…) from the Dashboard, cubicle login or the device authorization flow.

Path Parameters

box*string

The Box's ID, ORG/NAME with the slash encoded as %2F, or a bare NAME, which ?org= narrows. See Box references.

user*string

The member's user ID: a person's, or a service account's. List members shows them.

Formatuuid

Query Parameters

org?string

The organization's ID or name, to narrow a bare NAME in {box}. Ignored for an ID or ORG/NAME.

Response Body

The grant is revoked.

Example Request
curl -X DELETE 'https://api.cubicle.sh/v1/boxes/acme%2Fjob-1/grants/2c4e6a8b-0d1f-4e3a-9b5c-7d9f1b3d5e7a'
Example Response
Empty