> ## Documentation Index > Fetch the complete documentation index at: https://docs.ulm.m1amdocs.com/llms.txt > Use this file to discover all available pages before exploring further. # Revoke access to A/S/F entities An existing, authenticated user, is the Primary User in a Group, and that Group has an associated hierarchy of Account/Subscription/Feature entitlement entities. The Primary User is currently sharing access to one or more entitlement entities with another Regular User in the Group. In this use case, the Primary User removes the Regular (or Admin) association to one or more entitlement entities in the Group. \[product: dim]\[/product: dim] **Note:** The above flow diagram includes a conventional or recommended order in which to retrieve additional user information, to make the actual front user experience a bit more clear and meaningful. Since the Process requires that the relevant Account (or Subscription or Feature), target User, and possibly target Group are all specified by their internal identifying numbers, then the client will likely need to make additional call against those Digital Identity Management entities and parse out the right details to show to the user. ## Initial Request Your client calls the [Process Start](c_processStart) API to initialize the Process: ``` **POST https://\{your.url\}/process/start/entitlementManagement.RevokeUserAccess.v1.0** ``` ## Response: Specify Targets Digital Identity Management responds with a prompt to specify the Account, Subscription, or Feature entitlement entity, and which User entity to un-associate from the entitlement. The response also includes a list of applicable entity types for the client to specify: ``` **RESPONSE - body** { "processId": "a1fbea6f-6462-4138-b297-484a9be74af1", "processName": "entitlementManagement.RevokeUserAccess.v1.0", "stepName": "Prompt", "output": { "validTypes": [ "account", "subscription", "feature" ] }, "parameters": { "userId": 1, "entities": [ { "entityType": "account", "entityId": 12345 }, { "entityType": "subscription", "entityId": 34567 } ] } } ``` The target user (and the accounts or services to remove from that user) must be specified by the unique, internal `id` property on each Digital Identity Management entity. As this number is likely not known to the user, the client application should leverage the relevant APIs (e.g., **GET /user/groups** API, or **GET /group/\{groupid}/users**), in conjunction with this Process, to retrieve additional details stored on each entity, and then render them to the user (e.g., to display each possible target user by their `firstName` and each possible entity by their `displayName`). **Note:** The `parameters` object indicates what it needs from the client to continue its task. In this scenario, the values for each field in the object are **generic** and indicative of format (strings and integers), but not the specific exact values expected in the next request. In other words, the client should ignore the any sample values (e.g., "1" account, "12345,") in this response, and instead simply return the user's selections (the target Digital Identity Management User entity, specified by the `id` property and the entities to remove from that User, specified by their entity type and unique `id` property.). | `processId` | Unique identifier for the current instance of this Process. | | - | - | | `processName` | Full name of the Process, including the category and version number. | | `stepName` | Name of the specific step that the Process is currently on. | | `lastStep` | Boolean that indicates whether or not this was the last step in the Process. | | `output` | Object that contains data that the client can consume, retain, and use for additional operations. | | `validTypes` | Array of acceptable entity types that the client can specify. | | `parameters` | Object that specifies the info this Process requires to continue its task. | | `userId` | The unique internal identifier of the target Digital Identity Management User (i.e., the `id` property) from whom to remove account/service access. Clients may obtain valid identifiers by using the relevant Group APIs (e.g. GET /group/\{groupId\}/users). | | `entities` | An array of entities to be revoked from the target User (chosen by the above-noted User identifier). Each entity object includes: | | `entityType` | The type of entity being shared. Possible values are `account`, `subscription`, and `feature`. | | `entityId` | The unique internal identifier on the entity (i.e., the `id` property). A list of available entities along with their internal identifiers can be obtained by using the relevant APIs (e.g. GET /user/accounts, GET /user/subscriptions). | ## Final Request: User Selections Your client passes the user's explicit selections to the Process using the [Process Step](c_processStep) API: ``` **PUT https://\{your.url\}/process/step** { "processId": "a1fbea6f-6462-4138-b297-484a9be74af1", "parameters": { "userId": 93612, "entities": [ { "entityType": "account", "entityId": 6007 } ] } } ``` **Note:** In this example, a previously shared single account is being revoked from the target user. It is possible to revoke access to multiple entitlement entities in a single request, if applicable, by adding additional entries into the `entities` array. For example: ``` { "processId": "a1fbea6f-6462-4138-b297-484a9be74af1", "parameters": { "userId": 93612, "entities": [ { "entityType": "subscription", "entityId": 8358 }, { "entityType": "subscription", "entityId": 8354 }, { "entityType": "feature", "entityId": 723 }, ] } } ``` | `processId` | Unique identifier for the current instance of this Process. | | - | - | | `parameters` | Object that specifies the info this Process requires to continue its task. | | `userId` | The unique internal identifier of the target Digital Identity Management User (i.e., the `id` property) from whom to remove account/service access. Clients may obtain valid identifiers by using the relevant Group APIs (e.g. GET /group/\{groupId\}/users). | | `entities` | Array of entities to be removed from target User. Each entity object includes: | | `entityType` | The type of entity being shared. Possible values are `account`, `subscription`, and `feature`. | | `entityId` | The unique internal identifier on the entity (i.e., the `id` property). A list of available entities along with their internal identifiers can be obtained by using the relevant APIs (e.g. GET /user/accounts, GET /user/subscriptions). | ## Process Complete Digital Identity Management removes the entitlement entity associations in order to revoke the target end user's access to the shared account/service(s). The Process returns an `HTTP 200` status: ``` **RESPONSE - body** { "processId": "a1fbea6f-6462-4138-b297-484a9be74af1", "processName": "entitlementManagement.RevokeUserAccess.v1.0", "lastStep": true, } ``` | `processId` | Unique identifier for the current instance of this Process. | | - | - | | `processName` | Full name of the Process, including the category and version number. | | `lastStep` | Boolean that indicates whether or not this was the last step in the Process. | | **Parent topic:**[Revoke Access to an Account, Subscription, or Feature Process](../topics/c_revokeAccessASF) | | This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.