> ## Documentation Index > Fetch the complete documentation index at: https://docs.cloud.cdata.com/llms.txt > Use this file to discover all available pages before exploring further. # Delete Role > Delete a custom access role. The request fails if the role is assigned to any user, service account, or group in any workspace. Remove all assignments first. System roles cannot be deleted. ## OpenAPI ````yaml en/API/Management-API.yaml DELETE /roles/{id} openapi: 3.1.0 info: title: CData Connect AI Management API version: v1 description: > The Connect AI Management API provides programmatic control over enterprise platform administration. Base path: /api/v1/admin. Use it to manage users, service accounts, roles, and resource permissions without manual UI operations. The API follows OAS 3.0 standards with OAuth 2.0 scoped authentication. Authentication: use OAuth 2.0 client credentials, or send a personal access token (PAT) with HTTP Basic authentication by using the header `Authorization: Basic base64(email:PAT)`. On versioning: the version prefix is incremented when breaking changes require it. A new /api/v2/admin path will be introduced with a 6-month deprecation notice before any v1 endpoint is retired. On human users vs. service accounts: human users are provisioned and lifecycle-managed by SCIM; the Management API handles direct overrides and atomic deprovisioning. Service accounts (CI/CD pipelines, IaC tooling, Terraform) are fully managed via the Management API and are not SCIM-owned. servers: - url: https://cloud.cdata.com/api/v1/admin description: Production base URL security: - oauth2: [] - basicAuth: [] tags: - name: Users description: > Lifecycle management for human users: create, update, deprovision, and manage direct role assignments, workspace-scoped roles, and direct resource permissions. SCIM handles group-based provisioning and user creation at scale; this API handles direct overrides and atomic deprovisioning. - name: Service Accounts description: > Full lifecycle management for machine identities (CI/CD pipelines, IaC tooling, Terraform automation). Service accounts are not SCIM-owned and authenticate via OAuth 2.0 client credentials using the `client_id` returned on creation. - name: Projects description: > List the projects in a workspace. Use a project's `project_id` when you create or list virtual keys for that project. - name: Virtual Keys description: > Create, list, disable, re-enable, and revoke LLM Gateway virtual keys. A virtual key is the credential a client sends to the LLM Gateway to authenticate, and it is issued to a user or service account for a project. The full key secret is returned only once, in the create response. Revoking a key is permanent, and the record is kept for auditing. Callers must be an Admin, or a Workspace Admin of the workspace in the path. The account must have the AI Gateway and LLM Gateway enabled; revoking a key requires only the AI Gateway. Each account is limited to 600 Management API calls per minute, and revoking or disabling a key never counts against the limit. - name: Roles description: > Role definitions: the permission vocabulary that users, service accounts, and groups reference. Two types exist: `system_role` (built-in, non-modifiable) and `access_role` (custom, fully manageable). Access roles are defined once for the account and assigned per workspace. System roles other than `admin` are workspace-scoped, and `admin` is account-wide. - name: Groups description: > Read SCIM-synced and API-managed groups, and assign workspace-scoped roles to groups so that group membership confers the correct Connect AI access. Membership of SCIM groups is owned by the identity provider (IdP). - name: Workspaces description: > Create and manage workspaces, which are isolation boundaries at the account level, and manage workspace membership for users, service accounts, and groups. paths: /roles/{id}: delete: tags: - Roles summary: Delete Role description: >- Delete a custom access role. The request fails if the role is assigned to any user, service account, or group in any workspace. Remove all assignments first. System roles cannot be deleted. operationId: deleteRole parameters: - name: id in: path required: true description: Role identifier (UUID). schema: type: string format: uuid responses: '204': description: No Content '404': $ref: '#/components/responses/RoleNotFound' '409': description: Conflict content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: role_not_modifiable: summary: System role value: error: code: ROLE_NOT_MODIFIABLE message: Cannot delete a system role. role_in_use: summary: Role is assigned value: error: code: ROLE_IN_USE message: >- Role is assigned to one or more users, service accounts, or groups in any workspace. Remove all assignments before deleting. security: - oauth2: - management:roles:write - basicAuth: [] components: responses: RoleNotFound: description: Not Found content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: error: code: ROLE_NOT_FOUND message: The specified role does not exist. schemas: ErrorResponse: type: object properties: error: type: object description: Error details. properties: code: type: string description: SCREAMING_SNAKE_CASE error code. message: type: string description: Human-readable error description. details: type: array description: Additional error context, present only where needed. items: type: object additionalProperties: true securitySchemes: oauth2: type: oauth2 description: > OAuth 2.0 client credentials. Alternatively, you can authenticate with a personal access token (PAT) by sending `Authorization: Basic base64(email:PAT)`. flows: clientCredentials: tokenUrl: https://cloud-login.cdata.com/oauth/token scopes: management:users:read: Read access to user resources. management:users:write: Write access to user resources. management:service-accounts:read: Read access to service account resources. management:service-accounts:write: Write access to service account resources. management:roles:read: Read access to role resources. management:roles:write: Write access to role resources. management:groups:read: Read access to group resources. management:groups:write: Write access to group resources. management:workspaces:read: Read access to workspace resources. management:workspaces:write: Write access to workspace resources. basicAuth: type: http scheme: basic description: > HTTP Basic authentication with a personal access token (PAT). Send `Authorization: Basic base64(email:PAT)`. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.