# Birthright roles removal events

**URL:** <https://developer.sailpoint.com/discuss/t/birthright-roles-removal-events/123904>\
**Category:** SHF Discussion and Questions\
**Tags:** identity-security-cloud, apis, search\
**Created:** [May 2, 2025, 3:24pm UTC](https://developer.sailpoint.com/discuss/t/birthright-roles-removal-events/123904 "2025-05-02T15:24:14Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![abeltran](https://avatars.discourse-cdn.com/v4/letter/a/258eb7/32.png) [@abeltran](https://developer.sailpoint.com/discuss/u/abeltran)\
**Post date:** [May 2, 2025, 3:24pm UTC](https://developer.sailpoint.com/discuss/t/birthright-roles-removal-events/123904/1 "2025-05-02T15:24:14Z")

</div>

Hi,

I’m trying to identify role removal (Birthright roles) events that occur within a period of time (i.e., 1 day) and that are performed by a specific user (i.e., Service.user). To do this, I’m using search and look for the events as follows:  
`created:[now-1d TO now] AND name.exact:"Remove Role Passed" AND actor.name:service.user`

Viewing the results of this search, I find that there are removal events for Access Profiles, but not for the roles that contain those Access Profiles:

 ![Remove_role](https://global.discourse-cdn.com/sailpoint/original/3X/f/1/f1661f0f77ebb4aebc25bd1b856376307a1c144b.png)

Is there a way to specifically find removal events only for roles?  
Thanks in advance!

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\
**Post date:** [July 1, 2025, 3:24pm UTC](https://developer.sailpoint.com/discuss/t/birthright-roles-removal-events/123904/2 "2025-07-01T15:24:16Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.