Revoke a Role from one Group
Takes a role away from one group. {id} is the ROLE and {groupId} is the GROUP — both are slugs, so the order of the two is the only thing telling them apart, and swapping them revokes a grant nobody asked to revoke.
The batch form, POST /v1/roles/{id}/groups/remove, does the same for a list.
The group itself is untouched and keeps its members. Revoking from a group that does not hold the role is not an error. On success the response has no body (204).
Failures:
404— no such role in your organization.422 IDE-1067— the role is declared by a Lerian product, which alone decides the groups it is granted to, and the group holds it. Change who has the access by adding or removing people on the role itself, or in a group the product grants it to. A role reserved for machine credentials stays open to revoke.503 IDE-0066— the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later.
DELETE
Revoke a Role from one Group

