---
title: "Revoke Bucket Access"
method: POST
path: "/v2/bucket-access/datasets/{dataset_id}/revoke"
tags: ["Bucket Access"]
---

# Revoke Bucket Access

`POST /v2/bucket-access/datasets/{dataset_id}/revoke`

Revoke a principal's S3 bucket access by SKU.

Either principal_arn (revoke a specific ARN) or client_name (revoke all
ARNs registered for that client+dataset) must be provided. Idempotent —
revoking a principal that isn't currently granted returns revoked=True
with no policy change (mirrors the CLI behavior).

S3-only, like the grant path: ``log_access=False``, and CAMS removes the
admin_config access row and writes the ACCESS_REVOKED audit row (PLA-6141).

## Path parameters

- `dataset_id` string, required

## Request body

- RevokeBucketAccessRequest
  - `principal_arn` string, nullable — IAM principal ARN to revoke. Either principal_arn or client_name must be provided.
  - `client_name` string, nullable — Client name to revoke all ARNs for. Either principal_arn or client_name must be provided.
  - `lag` string, nullable — Lag of the dataset SKU. Null for the no-lag variant.
  - `cut` string, nullable — Cut of the dataset SKU. Null for the no-cut variant.

## Response `200`

Successful Response

- RevokeBucketAccessResponse
  - `dataset_id` string, required
  - `dataset_name` string, required
  - `lag` string, nullable, required
  - `cut` string, nullable, required
  - `principal_arn` string, nullable, required
  - `client_name` string, nullable, required
  - `revoked` boolean, required

## Other responses

- `400` — Malformed principal ARN, or missing required identifier.
- `403` — compliance_blocked: the SKU is restricted for this client.
- `404` — sku_not_found / bucket_not_registered: the SKU has no bucket in admin_config.bulk_bucket_details. Terminal — retrying cannot help.
- `409` — policy_apply_failed / policy_write_race: the bucket-policy write did not land. Transient — the caller should retry.
- `413` — policy_size_exceeded: the bucket policy hit AWS's 20KB limit.
- `422` — unknown_client: client_name is not in admin_config.clients.

---

[API](https://skmtc.net/carbonarc/apis/carbon-arc-api-documentation.md) · [All operations](https://skmtc.net/carbonarc/apis/carbon-arc-api-documentation/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/carbonarc/carbon-arc-api-documentation/revisions/4850d81778a4/schema)