Remove emails from access policy (legacy)

Legacy API

This page describes the legacy Sign In API. New integrations use the Sign In API with an Organization API key. The same operation there: Remove email patterns.

DELETE /v1/org/{organizationId}/contexts/sign-in/{contextId}/policies/{accessPolicyId}/emails

Removes email addresses or patterns from an access policy and, by default, revokes any active sign-ins the departing emails have made through modules gated by this policy.

Request

Parameter	In	Type	Required	Description
organizationId	Path	string	Yes	Organization ID.
contextId	Path	string	Yes	Sign-In Context ID.
accessPolicyId	Path	string	Yes	Access policy UUID.
x-auth-token	Header	string	Yes	Context API key.
emails	Body	string[]	Yes	List of email addresses or patterns to remove. Entries that are not in the policy are ignored.
revokeUserEngagement	Body	boolean		When true (default), active sign-ins associated with the removed emails are revoked. Set false to leave existing sessions intact and only prevent future sign-ins. (default: true)

Request example

cURL

curl -X DELETE "$API_HOST/v1/org/$ORG_ID/contexts/sign-in/$CTX_ID/policies/$POLICY_ID/emails" \
  -H "x-auth-token: $NETGRAPH_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "emails": ["alice@acme.com"],
    "revokeUserEngagement": true
  }'

Response

Field	Type	Description
policyEmails	string[]	Emails still in the policy after the removal.
removedEmails	object[]	One entry per email that was actually removed, including how many active sign-ins (per module) were revoked.
removedEmails[].email	string	The removed email.
removedEmails[].revokedLoginsForSelfProvisioning	integer	Self-Provisioning by Email sign-ins terminated.
removedEmails[].revokedLoginsForMeetingHost	integer	Meeting Host sign-ins terminated.
removedEmails[].revokedWhitelisting	integer	Whitelist-created sign-ins terminated (if the removed email was the whitelist creator).
removedEmails[].revokeLoginsforConferences	integer	Reserved. Conference sessions are not revoked by removing access-policy emails, so this endpoint currently always returns 0 for this field.

Response example

200

{
  "policyEmails": ["*@external.example.com", "bob@acme.com"],
  "removedEmails": [
    {
      "email": "alice@acme.com",
      "revokedLoginsForSelfProvisioning": 3,
      "revokedLoginsForMeetingHost": 0,
      "revokedWhitelisting": 0,
      "revokeLoginsforConferences": 0
    }
  ]
}