latestOpenAPI 3.1.02026-08-21134175230.7 KB

4850d81778a4

Bucket Access

Revoke Bucket Access

Revoke a principal's S3 bucket access by SKU.

Either principal_arn (revoke a specific ARN) or client_name (revoke all ARNs registered for that client+dataset) must be provided. Idempotent — revoking a principal that isn't currently granted returns revoked=True with no policy change (mirrors the CLI behavior).

S3-only, like the grant path: log_access=False, and CAMS removes the admin_config access row and writes the ACCESS_REVOKED audit row (PLA-6141).

post/v2/bucket-access/datasets/{dataset_id}/revoke

Path parameters

dataset_idstring required

Request body

principal_arnstring nullable

IAM principal ARN to revoke. Either principal_arn or client_name must be provided.

client_namestring nullable

Client name to revoke all ARNs for. Either principal_arn or client_name must be provided.

lagstring nullable

Lag of the dataset SKU. Null for the no-lag variant.

cutstring nullable

Cut of the dataset SKU. Null for the no-cut variant.

Response

Successful Response

dataset_idstring required

dataset_namestring required

lagstring nullable required

cutstring nullable required

principal_arnstring nullable required

client_namestring nullable required

revokedboolean required