User leaves a shared A/S/F

John is an existing Digital Identity Management user who is sharing access to one or more accounts or services that belong to Jane, another Digital Identity Management end use. Jane previously associated her billing account and/or service subscriptions to her User profile, and then shared access to some of those entitlements with John. In this scenario, John is currently authenticated, and he selects to leave one or more of Jane’s shared services. On the back end, this means that Digital Identity Management will remove the association between John’s User entity and the corresponding Account, Subscription, or Feature entitlement entities. Note: If John removes his access (i.e., his associations) to all accounts or services in Jane’s Group, then Digital Identity Management will automatically remove him from the Group as well. [product: dim]

[/product: dim]

Initial Request

Your client calls the Process Start API to initialize the Process:

**POST https://\{your.url\}/process/start/entitlementManagement.UserLeavesASF.v1.0**
<no body>

Response: Request to specify A/S/F entitlements

Digital Identity Management responds with a prompt to specify the accounts or services that the user wants to leave. In other words, the Process requests for the client to specify the Digital Identity Management Account(s), Subscription(s), or Feature(s) entitlement entities with which the currently authenticated User has an association.

**RESPONSE - body**
{
   "processId": "57afa130-aadd-4f62-ace3-c3e94c974822",
   "processName": "entitlementManagement.UserLeavesASF.v1.0",
   "stepName": "Prompt",
   "output": {
      "validTypes": [
         "account",
         "subscription",
         "feature"
      ]
   },
   "parameters": {
      "entities": [
         {
            "entityType": "account",
            "entityId": 12345
         },
         {
            "entityType": "subscription",
            "entityId": 34567
         }
      ]
   }
}

The accounts or services to share must be specified by the unique, internal id property on each Digital Identity Management entity. As this number is likely not known to the user, the client application should leverage the relevant APIs (e.g., GET /user/accounts API, or GET /user/subscriptions), in conjunction with this Process, to retrieve additional details stored on each entity, and then render the appropriate options (e.g., the displayName of each applicable entity).

`processId`	Unique identifier for the current instance of this Process.
`processName`	Full name of the Process, including the category and version number.
`stepName`	Name of the specific step that the Process is currently on.
`lastStep`	Boolean that indicates whether or not this was the last step in the Process.
`output`	Object that contains data that the client can consume, retain, and use for additional operations.
`validTypes`	Array of acceptable entity types that the client can specify.
`parameters`	Object that specifies the info this Process requires to continue its task.
`entities`	An array of entities to be removed from the current Digital Identity Management User. Each entity object must include:
`entityType`	The type of entity being shared. Possible values are `account`, `subscription`, and `feature`.
`entityId`	The unique internal identifier on the entity (i.e., the `id` property). A list of available entities along with their internal identifiers can be obtained by using the relevant APIs (e.g. GET /user/accounts, GET /user/subscriptions).

Final Request: User Selection

The user is free to select any number of applicable entities to leave. In this example, the user opts to leave a shared Digital Identity Management Subscription, and the client passes that choice back to Digital Identity Management in the Process Step API:

**PUT https://\{your.url\}/process/step**
{
   "processId": "57afa130-aadd-4f62-ace3-c3e94c974822",
   "parameters": {
      "entities": [
         {
            "entityType": "subscription",
            "entityId": 606
         }
      ]
   }
}

Note that relinquishing one entitlement entity in a specific Account/Subscriptions/Features entity hierarchy does not cascade up or down that hierarchy. In other words, each and every association to remove must be explicitly selected. For example, if a Digital Identity Management User is associated to both an Account, a Subscription under the Account, and a Feature inside the Subscription, and the User’s association to the Subscription is revoked (either voluntarily through this Process, or by another Digital Identity Management User using the Revoke Access Process), then this does not affect the separate associations between the same Digital Identity Management User and the Account and Feature entities in the hierarchy. Digital Identity Management enables fine-grain entitlements control by making each and every association within an A/S/F hierarchy explicit. However, if desired, the client application can simply provide the additional entity types and identifiers if it wants to silently enforce a “leave all” function on behalf of the user, or use the Remove User from Group Process to remove the target user from the associated Group. Removing a user from a group automatically removes all existing associations between that User entity and the entitlement entities in that Group. This is all largely dependent on your own implementation of Digital Identity Management Processes and APIs, and how you choose to represent Accounts, Subscriptions, and Features at the UI level (if at all).

`processId`	Unique identifier for the current instance of this Process.
`parameters`	Object that contains the data requested in the previous Process response.
`entities`	Array of entities to be removed from target User. Each entity object includes:
`entityType`	The type of entity being shared. Possible values are `account`, `subscription`, and `feature`.
`entityId`	The unique internal identifier on the entity (i.e., the `id` property). A list of available entities along with their internal identifiers can be obtained by using the relevant APIs (e.g. GET /user/accounts, GET /user/subscriptions).

Process Complete

Digital Identity Management removes all associations between the current User and the specified entities. The Process returns a 200 HTTP status:

**RESPONSE - body**
{
   "processId": "57afa130-aadd-4f62-ace3-c3e94c974822",
   "processName": "entitlementManagement.UserLeavesASF.v1.0",
   "lastStep": true,
}

`processId`	Unique identifier for the current instance of this Process.
`processName`	Full name of the Process, including the category and version number.
`lastStep`	Boolean that indicates whether or not this was the last step in the Process.
Parent topic:User Leaves a Shared Account, Subscription, or Feature

Home

Guides

APIs

Initial Request

Response: Request to specify A/S/F entitlements

Final Request: User Selection

Process Complete

​Initial Request

​Response: Request to specify A/S/F entitlements

​Final Request: User Selection

​Process Complete

Initial Request

Response: Request to specify A/S/F entitlements

Final Request: User Selection

Process Complete