---
title: "Revoke Bucket Access"
method: POST
path: "/v2/bucket-access/datasets/{dataset_id}/revoke"
tags: ["Bucket Access"]
---

# Revoke Bucket Access

`POST /v2/bucket-access/datasets/{dataset_id}/revoke`

Revoke a principal's S3 bucket access by SKU.

Either principal_arn (revoke a specific ARN) or client_name (revoke all
ARNs registered for that client+dataset) must be provided. Idempotent —
revoking a principal that isn't currently granted returns revoked=True
with no policy change (mirrors the CLI behavior).

## Path parameters

- `dataset_id` string, required

## Request body

- RevokeBucketAccessRequest
  - `principal_arn` string, nullable — IAM principal ARN to revoke. Either principal_arn or client_name must be provided.
  - `client_name` string, nullable — Client name to revoke all ARNs for. Either principal_arn or client_name must be provided.
  - `lag` string, nullable — Lag of the dataset SKU. Null for the no-lag variant.
  - `cut` string, nullable — Cut of the dataset SKU. Null for the no-cut variant.

## Response `200`

Successful Response

- RevokeBucketAccessResponse
  - `dataset_id` string, required
  - `lag` string, nullable, required
  - `cut` string, nullable, required
  - `principal_arn` string, nullable, required
  - `client_name` string, nullable, required
  - `revoked` boolean, required

## Other responses

- `404` — Not Found
- `422` — Validation Error

---

[API](https://skmtc.net/carbonarc/apis/carbon-arc-api-documentation.md) · [All operations](https://skmtc.net/carbonarc/apis/carbon-arc-api-documentation/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/carbonarc/carbon-arc-api-documentation/revisions/bd33ea42994c/schema)